California Shine the Light Direct Marketing Disclosure

What it is

The Policy establishes a process for California residents to request disclosure of the categories of personal information shared with third parties for direct marketing purposes and the identities of those third parties, limited to one request per calendar year submitted in writing.

Why it matters (compliance & governance perspective)

This provision addresses California's Shine the Light statute obligations but does not address California Consumer Privacy Act rights such as the right to know, right to delete, or right to opt out of sale or sharing of personal information for cross-context behavioral advertising. The scope of California privacy rights described in this Policy may not fully reflect the company's obligations under current California law.

Consumer impact (what this means for users)

California residents may submit one written request per calendar year to receive a list of personal information categories disclosed to third parties for direct marketing and the names and addresses of those third parties. The request must be submitted by mail or email as specified in the Contact Us section, with a subject line of 'California Privacy Rights-Direct Marketing.'

What you can do

Institutional analysis (regulatory & governance intelligence)

1. REGULATORY LANDSCAPE: This provision addresses California Civil Code Section 1798.83, commonly known as the Shine the Light law. The California Consumer Privacy Act and California Privacy Rights Act, enforced by the California Privacy Protection Agency and the California Attorney General, establish broader consumer rights regarding personal data that are not addressed in this provision of the Policy, including opt-out of sale or sharing for behavioral advertising and rights to deletion. 2. GOVERNANCE EXPOSURE: Medium. The absence of explicit CCPA or CPRA rights enumeration in the California-specific section of this Policy, despite the scope of data collection and third-party sharing described elsewhere in the document, creates a potential gap between the Policy's California disclosures and the company's obligations under current California law. The California Privacy Protection Agency has authority to audit and enforce CPRA compliance. 3. JURISDICTION FLAGS: This provision applies specifically to California residents. Other states with comprehensive privacy statutes, including Connecticut, Colorado, Virginia, Texas, and others, may have enacted analogous rights not addressed in this Policy. The one-per-year limitation on requests reflects the Shine the Light statute's specific constraints but does not address CCPA or CPRA request frequency rules. 4. CONTRACT AND VENDOR IMPLICATIONS: Third parties receiving personal information for direct marketing purposes should be identified in vendor agreements that address Shine the Light compliance obligations. If third-party advertising network data sharing described elsewhere in the Policy constitutes sharing for direct marketing, the scope of potential disclosure responsive to these requests may be broader than anticipated. 5. COMPLIANCE CONSIDERATIONS: Legal teams should assess whether the California privacy rights section of this Policy accurately reflects the company's full obligations under CCPA and CPRA, including opt-out of sale or sharing rights, data deletion rights, and required CCPA privacy notice disclosures. The absence of a CCPA-specific section should be evaluated in the context of the company's data processing activities described in the Policy.

Applicable agencies

Provision details

Other risks in this policy

• Combination of Online and Offline Information high
• Company May Change Policy at Any Time high
• Company Right to Remove or Edit Social Media Content high
• Consent to US Data Transfer Processing high
• Continued Use Constitutes Consent to Policy Changes high
• Do Not Track Signals Not Honored high