Widener University School of Law graduate, Managing Legal Editor at TermsFeed.
On this page
This kind of clause is required for certain businesses by the "California Civil Code Section 1798.83" also known as California's "Shine the Light" law.
It typically informs California residents that they have the right, once per calendar year, to request disclosure of what kind of personal information has been collected about them and then shared with other third parties for the third party's direct marketing use, as well as the names and addresses of those third parties with which the information has been shared.
At Step 1, select the Website option or App option or both.
Answer some questions about your website or app.
Answer some questions about your business.
This clause and the right for California residents to request this information is a requirement of the California Civil Code Section, but it's commonly known as the "Shine the Light" law.
The "Shine the Light" Law
The "Shine the Light" law is a California State privacy law that was proposed in 2003, amended three times in the State Senate and five times in the State Assembly, and was finally passed by the California State Legislature in 2003.
The law officially became an active part of the California Civil Code on January 1, 2005.
Businesses were commonly collecting personal information from their customers, such as email addresses, mailing addresses, and phone numbers, and then selling this information to third-parties without letting the customers know.
These third parties were then using this personal information to directly market to customers via email, mailings, and phone calls that the customer never authorized or expected.
The "Shine the Light" law was created in an attempt to protect the privacy of California residents and help end these undesirable business practices by making it a requirement that businesses disclose certain information that those businesses collect and then share with third parties for marketing purposes, as well as let consumers know to whom their personal information was shared with.
Who must follow this law
Not every business are required to comply with the "Shine the Light" law.
If your business meets the following requirements, you'll be responsible for complying with this law:
- If your business has 20 or more employees,
- Has any customers who are residents of California, and
- Has, within the past calendar year, shared personal information from any of your customers with a third party for the purpose of direct marketing.
The following types of businesses are exempt from having to comply with this law:
- Those with fewer than 20 employees
- Non-profit organizations
- Politicians and political groups
- Religious organizations
- Credit reporting bureaus
- Federal financial institutions
- Providers of public real estate records, or
- Businesses that only share information after users have opted in to this sharing, or that provides easy access to an opt-out function that allows users to opt out of having their information shared.
Requirements of the law
If your business must comply with the "Shine the Light" law, there are a number of requirements that must be met.
You must let customers know, free of charge, and either in writing or electronically, if you have, in the previous calendar year, disclosed any of the following information to third parties for those third parties to use for direct marketing purposes:
- Name and address, including any email addresses
- Information about children: name, age, date of birth, gender, how many children someone has
- Physical information such as height, weight, race, medical conditions, drugs or therapies used
- Financial information such as credit card, debit card, or bank account number, investment history
- Lifestyle information such as political party affiliation, education level, religion etc.
Find the entire list as defined by the law here.
You must also provide who are (name, address) the third parties that received any of the above personal information from your business in the previous calendar year for the purposes of direct marketing.
Note that the law explicitly states the following:
[..] if the nature of the third parties' business cannot reasonably be determined from the third parties' name, examples of the products or services marketed, if known to the business, sufficient to give the customer a reasonable indication of the nature of the third parties' business
You must, according to the "Shine the Light" law:
[..] designate a mailing address, electronic mail address, or, if the business chooses to receive requests by telephone or facsimile, a toll-free telephone or facsimile number, to which customers may deliver requests.
You must let your employees, agents, managers, etc., and anyone who has regular contact (like your customer support team) with customers of this method of contact, and make this information available to customers upon request at every place of business located within California or where contact is made regularly with customers.
In either case, the first page of either link must "describe a customer's rights" and "shall provide the designated mailing address, e-mail address, as required, or toll-free telephone number or facsimile number."
You must comply with any requests by customers within 30 days, or no longer than 150 days if a request is made in some way that hasn't been designated by your business but that you still receive.
You are only required to disclose this information to customers who ask for it once per the calendar year.
Penalties for non-compliance
If your business must comply with the "Shine the Light" law and does not do so, there may be legal and financial repercussions.
If a customer requests information under the law and your business does not provide this information, the customer may file a civil lawsuit to recover damages that he feels were caused by your failure to disclose.
Typically, a business will have a 90-day grace period in which the information the customer requested can be finally provided to him.
If the information is provided within this grace period, the business will not have to pay damages.
Damages are limited to $500 unless a willful, intentional or reckless violation is found by the court. In that case, damages can be as high as $3,000 and there will be no 90-day grace period.
Examples of "Your California Privacy Rights" clauses
Their "California Privacy Rights" section is very short and lets users know that residents of California are permitted to "request information regarding the disclosure of your personal information by Digital River, Inc. or its subsidiaries to a third party for the third party's direct marketing purposes" and gives users an email address and mailing address where requests can be sent:
Ford Motor Company
Ford places a link to the "Your CA Privacy Rights" page in its website footer section:
When a user clicks on this link, she is taken to the "Your California Privacy Rights" section that explains how the "Shine the Light" law affects users and what rights it gives them.
The Ford Motor Company does a great job of explaining the law in a way that's easy to understand by stating that:
California residents who provide personal information in obtaining products or services for personal, family, or household use are entitled to request and obtain from us once a calendar year information about the customer information we shared, if any, with other businesses for their own direct marketing use. If applicable, this information would include the categories of customer information and the names and addresses of those businesses with which we shared customer information for the immediately prior calendar year (e.g., requests made in 2016 will receive information regarding 2015 sharing activities).
An email address where requests can be sent is also included, as well as a notice that only information covered by the "Shine the Light" law will be shared.
UPS takes a different approach to this type of legal requirement by informing users of their rights under the "Shine the Light" law.
Their "California Privacy Rights" section informs California residents that they have the right to ask UPS to refrain from sharing personal information with certain affiliates and third parties for their marketing purposes and invites users to send in their preferences either by email or written mail.
Note how no information is included here about requesting this type of information once per year.
This kind notice by UPS simply gives users the ability to opt-in to explicitly allow their information to be shared and provides a clear and easy way for users to opt-out of having their information shared.
While the UPS CA Privacy Rights section is very short and vague, Disney takes a very different approach with their "California Privacy Rights" section by making it longer, more informative, and very personable.
This is a great way to convey not only the factual information about what effects the "Shine the Light" law has but also to convey the overall notion of trust and respect for privacy rights of customers, which is exactly what the "Shine the Light" law aims to establish.
NVIDIA does not have a separate link or web page for its "California Privacy Rights" clause.
The "Notice to California Residents" section is short and to the point, informing NVIDIA customers who are California residents of their rights under the "Shine the Light" law:
Each of these different policies can be found by a user by clicking on links in its website footer section:
Walmart includes a link directly to its "California Privacy Rights" section in the website footer:
Customers are informed that Walmart shares personal information with other businesses within the Walmart family, and provides a method for customers to contact them with any questions or to request information.
Jostens includes a separate footer link to its "CA Privacy Rights policy" page:
The "Legal Notices" link also includes a link directly to this legal page:
Jostens has a very clear and basic "CA privacy rights" section that let users know that "under California law, Jostens customers who are California residents may request certain information regarding the types of information shared by Jostens with third parties for their direct marketing purposes, and the identities of those third parties."
This language used in their legal policy is very similar to the actual language of the law.
Let users know that they have the right to request what personal information you have shared with third parties, for the purpose of direct marketing, within the previous calendar year.
Provide a way for users to contact you to make this request, either via email, written mail, or both. Include this information in your "CA Privacy Rights" section.