On February 21, 2024, California Attorney General Rob Bonta announced a $375,000 settlement with DoorDash for alleged violations of the California Consumer Protection Act (“CCPA”) and California Online Privacy Protection Act (“CalOPPA”). The complaint alleged that DoorDash violated the CCPA and CalOPPA while participating in a “marketing co-operative” where businesses shared customer data with other businesses in the co-operative. The specific violations included 1) failing to give proper notice that they were “selling” consumers’ personal information, 2) failing to post an easy-to-find “Do Not Sell My Personal Information” link on the website and mobile app, 3) failing to give consumers the right to opt out of the “sale” of their personal information, and 4) failing to disclose the categories of third parties with which it shared personal information.

At the time, DoorDash had the opportunity to cure its violation under a now expired provision of the CCPA.¹ However, curing may have been functionally impossible. The personal information had already been shared to other organizations, and DoorDash’s contract with the co-op “did not permit DoorDash to audit who the marketing co-op sold customer data to, nor sufficiently restrict [the co-op] to only use DoorDash’s data in furtherance of the marketing co-op.”² Furthermore, it is not clear whether DoorDash could have met the California AG’s standard of “cure.” The complaint notes that California state courts interpret “cure” as “making consumers whole by restoring them to their pre-violation position.” Even if DoorDash had taken the contemplated remedial actions, such as instructing the co-op to cease data transfers or updating its privacy policy, it is difficult to see how these actions would have restored consumers to their pre-violation condition.

Key Takeaways for Businesses:

1. Ensure that your business has an accurate internal definition of “sale.” The “sale” of data is not just the exchange of personal information for money. As established by the Sephora settlement and made clear by DoorDash, under the CCPA a “sale” of data is any disclosure of consumer personal information to third parties in exchange for a benefit. If your organization is disclosing consumer’s personal information to another entity that is not a contractor or a service provider, it is likely a “sale.”
2. Ensure that your business has a CCPA compliant website, privacy notice, and consumer rights process. A business has multiple obligations if it “sells” consumer personal information. The business must 1) provide numerous specific disclosures in its privacy notice, 2) post an easy-to-find “Do Not Sell My Personal Information” link on the website and/or mobile app, 3) give consumers the ability to opt-out of that sale, and 4) enter into a CCPA compliant contract with the third-party.³
3. “Violations” are tabulated at the number of affected data subjects. The Attorney General may impose a penalty of up to $2,500 for “each violation” of the CCPA.⁴ The complaint states that “each time” DoorDash “sold” an individual consumer’s personal information, it was a violation. This is consistent with precedent set by People v. Superior Court that the number of violations for a single act is the number of affected individuals, not the number of provisions the single act violated.⁵
4. CalOPPA compliance still matters. Businesses have been understandably focused on the notice provisions of the CCPA, particularly as a California Appellate Court recently found the California Privacy Protection Agency regulations are immediately enforceable.⁶ However, the disclosure requirements of CalOPPA, such as describing the process by which the website operator will notify consumers of material changes to the website,⁷ or whether other parties may collect personal information about a consumer's activities cross-contextually⁸ are still important. Unlike the CCPA, CalOPPA does not have jurisdictional thresholds for applicability. Therefore, even if your business is not required to comply with the CCPA,⁹ it may still be required to comply with CalOPPA if it has a "commercial" website and processes the data of California consumers.¹⁰
5. Prior violations may still lead to enforcement. The complaint is based on activity from January 2020, which, as noted by Attorney General Rob Bonta,¹¹ was the first month the CCPA was in effect. Businesses that received inquiry letters from the Attorney General’s office during investigative sweeps, like those targeting employers and businesses with mobile applications, should be aware that enforcement may still be coming. Additionally, businesses should carefully analyze their disclosures related to prior activities. Privacy notices must list the categories of personal information the business sold or shared in the prior 12 months. Ceasing the “sale” after discovery without updating the privacy notice may lead to regulatory enforcement.

1. The provision previously appeared at Cal. Civ. Code § 1798.155(b), but expired on January 1, 2023.↩
2. People v. DoorDash, Inc., (https://oag.ca.gov/system/files/attachments/press-docs/DoorDash%20Complaint.pdf)., para. 4.↩
3. 11 CCR §7053(b)(1)-(6).↩
4. Cal. Civ. Code 1798.199.90(a). The cap for “willful” violations is $7,500.↩
5. People v. Superior Ct., 9 Cal. 3d 283, 289, 507 P.2d 1400, 1404 (1973), “Rather, we believe the Legislature intended that the number of violations is to be determined by the number of persons to whom the misrepresentations were made, and not by the number of separately identifiable misrepresentations involved. Thus, regardless of how many misrepresentations were allegedly made to any one potential customer, the penalty may not exceed $2,500 for each customer solicited by a defendant.”↩
6. California Priv. Prot. Agency v. Superior Ct. of Sacramento Cnty., No. C099130, (Cal. Ct. App. Feb. 9, 2024), review filed (Feb. 20, 2024).↩
7. Cal. Bus. & Prof. Code §22575(b)(3).↩
8. Cal. Bus. & Prof. Code §22575(b)(6).↩
9. Generally, the CCPA governs organizations (i) with annual gross revenues in excess of $25,000,000, (ii) that process the personal information of 100,000 California consumers, or (iii) that derive 50% of revenue from the “sale” of personal information.↩
10. CalOPPA imposes obligations the website “operator” which is “any person or entity that owns a Web site located on the Internet or an online service that collects and maintains personally identifiable information from a consumer residing in California who uses or visits the Web site or online service if the Web site or online service is operated for commercial purposes.” Cal. Bus. & Prof. Code §22577(c).↩
11. https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-doordash-investigation-finds-company.↩