Privacy Bolo: Custom Event Data

This podcast episode discusses the Texas Attorney General's lawsuit against Sony regarding the use of Automated Content Recognition (ACR) technology. It highlights issues of informed consent, transparency in data collection, and the legal implications of deceptive trade practices. The conversation emphasizes the importance of clear communication with consumers about data usage and the necessity for businesses to adhere to privacy laws.

In this episode of the Privacy Enforcement Podcast, host Christopher Smith breaks down a recent California Attorney General enforcement action against Sling TV and explains why cookie banners alone do not satisfy CCPA opt-out requirements.Using People of the State of California v. Sling TV as a case study, this episode explores how opt-out rights apply far beyond cookies, how interface design choices can become enforcement risks, and why businesses—especially app-based and ad-supported platforms—must rethink how they operationalize consumer privacy rights.If you work in privacy, legal, compliance, marketing, or product, this episode offers practical insights into how regulators evaluate opt-out mechanisms in the real world.

In this episode, we break down how something as simple as an auto-fill feature on online quote forms can trigger an accidental data leak—and why strong MFA requirements on agent portals are essential for every insurance carrier.Link to Case: https://www.dfs.ny.gov/system/files/documents/2025/10/ea20251014-co-hartford-fire-ins-company.pdf

In this episode, I dive into the FTC's enforcement action against Marriott, issued on October 9, 2024. (Link to case) Below are my key takeaways from this enforcement action: Due Diligence for Mergers: Ensure thorough due diligence on data security when acquiring a new company. Implement Reasonable Data Security Policies: Companies should adopt security measures addressing common vulnerabilities across their assets. Start with a security framework or hire a third-party assessor if budget allows to evaluate internal systems for vulnerabilities. Flag systems storing sensitive information to enforce and maintain robust security protocols. Accurate Privacy Policy Representation: Make sure your privacy policy aligns with actual security practices. Avoid using absolute terms like “industry standard” or “the best.” Instead, provide a realistic overview of security practices without overpromising.

In this episode, I discuss the FTC's enforcement action against Verkada, announced on August 30, 2024. The FTC charged Verkada with violations of Section 5(a) and the CAN-SPAM Act. Key takeaways from this case include: Businesses are required to include their postal address in commercial emails. Employees and investors must disclose their affiliations when posting reviews about the company's products and services. Companies should promptly address vulnerabilities identified by third-party security assessors. For any questions about this enforcement action, feel free to email me at [email protected]. Link to Case

In this episode, we'll discuss why companies should be on the lookout when agreeing to third-party vendor’s Terms of Service agreements. **Opinions expressed in this episode are my own and do not express the views of others**

In this episode, I’m going to discuss how companies how companies’ attempt to retain their customer and obtain new customers could indirectly result in disclosing their customers’ sensitive information to third parties. For this episode, I’m going to reference the recent the FTC complaint filed in federal court against Monument. 

Today, I have the pleasure of introducing you to a brand new video series I’m creating called "BOLO" – that's right, "Be on the Lookout!" In this series, I will identify key activities that companies need to monitor closely, as they are attracting the attention of privacy regulators. These activities include, labeling Custom Events may lead to disclosing sensitive data to third parties to instances of companies not enforcing contract provisions when sharing personal data with third parties. With each episode, I’ll draw upon real-world cases in order to provide concrete enforcement examples that highlight each activity. 

In this episode, I discuss the 2023 FTC District Court complaint issued against Easy Healthcare. Topics discussed in this episode: 1. The risk of mistakenly sharing sensitive health data with AppsFlyer and Google Analytics with "App Custom Events." 2. The risk of collecting and sharing "Non-Resettable Identifiers." 3. Compliance with the "Health Breach Notification Rule." Link to FTC enforcement action: https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3186-easy-healthcare-corporation-us-v

In this episode, I discuss the 2023 FTC District Court complaint issued against Amazon in regards to their Alexa products. Key Takeaways from this complaint are: 1. Companies are not allowed to store users' personal data indefinitely for purposes of product development. 2. Companies that collect personal data from users under 13 must comply with the Children Online Privacy Protection Act "COPPA."