Attorney General Kamala D. Harris Files Suit Against Delta Airlines for Failure to Comply with California Privacy Law

SAN FRANCISCO – Attorney General Kamala D. Harris announced today the first legal action under California’s online privacy law against Delta Airlines, Inc. for failing to comply with the state’s Online Privacy Protection Act.

Delta, headquartered in Atlanta, GA, was among the companies given 30 days to conspicuously post a privacy policy within their mobile app that informs users of what personally identifiable information is being collected and what will be done with it.

“Losing your personal privacy should not be the cost of using mobile apps, but all too often it is,” said Attorney General Harris. “California law is clear that mobile apps collecting personal information need privacy policies, and that the users of those apps deserve to know what is being done with their personal information.”

The California Online Privacy Protection Act requires commercial operators of websites and online services, including mobile and social apps, which collect personally identifiable information from Californians to conspicuously post a privacy policy. Privacy policies are an important safeguard for consumers. Privacy policies promote transparency in how companies collect, use, and share personal information.  If developers do not comply with their stated privacy policies, they can be prosecuted under California’s Unfair Competition Law and/or False Advertising Law.

The complaint alleges that since at least 2010, Delta has operated a mobile app called “Fly Delta” for use on smartphones and other electronic devices.   The Fly Delta app may be used to check-in online for an airplane flight, view reservations for air travel, rebook cancelled or missed flights, pay for checked baggage, track checked baggage, access a user’s frequent flyer account, take photographs, and even save a user’s geo-location. Despite collecting substantial personally identifiable information such as a user’s full name, telephone number, email address, frequent flyer account number and pin code, photographs, and geo-location, the Fly Delta application does not have a privacy policy.

The suit seeks to enjoin Delta from distributing its app without a privacy policy and penalties of up to $2,500 for each violation.  The suit was filed in San Francisco Superior Court and a copy of the complaint is attached to the online version of this press release.

This action by Attorney General Harris follows an agreement she forged among the seven leading mobile and social app platforms to improve privacy protections for millions of users around the globe who use apps on their smart phones, tablets, and other electronic devices. Those platforms – Amazon, Apple, Facebook, Google, Hewlett-Packard, Microsoft, and Research in Motion – agreed to privacy principles designed to bring the industry in line with California law requiring mobile apps that collect personal information to have a privacy policy. The agreement allows consumers the opportunity to review an app’s privacy policy before they download the app rather than after, and offers consumers a consistent location for an app’s privacy policy on the application-download screen in the platform store. 

The California Online Privacy Protection Act is one of the privacy laws that the DOJ’s Privacy Enforcement and Protection Unit is charged with enforcing. Created by Attorney General Harris in 2012, the Privacy Unit’s mission is to enforce federal and state privacy laws regulating the collection, retention, disclosure, and destruction of private or sensitive information by individuals, organizations, and the government. This includes laws relating to cyber privacy, health privacy, financial privacy, identity theft, government records and data breaches.

The October 2012 press release announcing the notification to mobile app developers can be found here: https://www.oag.ca.gov/news/press-releases/attorney-general-kamala-d-harris-notifies-mobile-app-developers-non-compliance. The February 2012 press release announcing the apps agreement can be found here: https://www.oag.ca.gov/news/press-releases/attorney-general-kamala-d-harris-secures-global-agreement-strengthen-privacy. The June 2012 press release announcing that Facebook joined the apps agreement can be found here: https://www.oag.ca.gov/news/press-releases/attorney-general-kamala-d-harris-announces-expansion-california%E2%80%99s-consumer.