California Attorney General announces investigative initiative aimed at streaming services

The recently unveiled investigative inquiry targeting streaming services marks the Attorney General Rob Bonta’s ongoing efforts to position California at the forefront of privacy enforcement, underscoring the necessity for companies to take proactive measures regarding state compliance and investigative procedures. Attorney General Bonta stresses consumer personal information on streaming platforms, signaling a shift towards impending regulatory scrutiny for non-compliance with CCPA obligations in regards to opt-out processes.

California State Attorney General Rob Bonta announced a new investigative sweep focusing on streaming services' compliance with the opt-out requirements under the California Consumer Privacy Act (CCPA). Specifically, the CCPA requires businesses that "sell" personal information or "share" it for targeted advertising must offer consumers the right to opt-out. Notably, assessing what is considered a "sale" or "sharing" can be complex, particularly given the broad definitions under the CCPA.

The investigation into streaming services represents the latest step in Attorney General Bonta's broader mission to have California lead the way in privacy enforcement. Over the past two years, Attorney General Bonta has initiated a wave of similar sweeps, focusing on topics including employers' use of human resources-related data, mobile applications, and loyalty programs. Across these sweeps, the Attorney General has prioritized privacy concerns in contexts that resonate with a broad spectrum of consumers. 

The focus on streaming services appears to be a direct reaction to the integral role they now play in modern entertainment consumption and the extent of personal data collection, use, and disclosure on streaming platforms that may be surprising to consumers. In the announcement, Attorney General Bonta explains, “From watching live sporting events to blockbuster movies, families increasingly use streaming platforms for entertainment, and we must make sure that their personal information is protected." 

Attorney General Bonta's insistence on the ease and accessibility of the opt-out process intends to be emphasized through letters of non-compliance to businesses considered lacking in CCPA obligations. Companies that fall under the purview of the CCPA are tasked with distinct obligations, such as offering prescribed means to opt-out, promptly addressing consumer requests to exercise their rights, and providing consumers with informative notices explaining their privacy practices.

Beyond the immediate impact of the CCPA investigation, Attorney General Bonta's actions signal a broader shift toward regulatory scrutiny in the digital landscape and proactive review of organizations' compliance efforts. He has already spearheaded two enforcement settlements, resulting in a US$1.2 million penalty against Sephora and a US$375,000 penalty against DoorDash for failing to comply with the CCPA's sales requirements. In addition to significant monetary penalties, Attorney General Bonta has sought extensive injunctive relief, including requiring Sephora and DoorDash to develop and report on updated compliance programs. The CCPA allows for injunctive relief and monetary penalties of up to US$7,500 per intentional violation and US$2,500 for other violations (with a single violation likely calculated on a granular, per consumer, per data collection level).

State Attorneys General are ascendent and are actively pursuing industry-wide actions to enforce compliance. It is more imperative than ever for companies operating on a large scale and under public scrutiny to be proactive concerning state internal compliance and investigatory efforts. This most recent enforcement focus on streaming services could mean more significant impacts to businesses in the sports, media, and entertainment sector. 

Annually recognized as the legal market leader for this sector and in privacy and cybersecurity, our Hogan Lovells team proactively advises streaming services clients on CCPA compliance issues. We leverage this practice with our rapidly emerging top State AG practice led by the former and first-elected Attorney General of the District of Columbia and former President of the National Association of Attorneys General (NAAG). Our Hogan Lovells team works cross-functionally to give clients comprehensive solutions to meet their specific legal needs. For more information, please contact Karl Racine and Shelita Stewart.



Authored by Karl Racine and Shelita Stewart.

Karl Racine
Washington, D.C.
Shelita Stewart
Washington, D.C.


This website is operated by Hogan Lovells International LLP, whose registered office is at Atlantic House, Holborn Viaduct, London, EC1A 2FG. For further details of Hogan Lovells International LLP and the international legal practice that comprises Hogan Lovells International LLP, Hogan Lovells US LLP and their affiliated businesses ("Hogan Lovells"), please see our Legal Notices page. © 2024 Hogan Lovells.

Attorney advertising. Prior results do not guarantee a similar outcome.