Subscribe to Our Newsletter
State of California Department of Justice
Rob Bonta
Attorney General
Attorney General
Tilting Point Media LLC, in a stipulated judgment, agreed to pay $500,000 to resolve allegations that the mobile video game developer collected and shared children’s data without obtaining parental consent, in violation of the California Consumer Privacy Act and the Children’s Online Privacy Protection Act. Our joint investigation with the Los Angeles City Attorney’s Office revealed that in connection with Tilting Point’s popular mobile app game “SpongeBob: Krusty Cook-Off,” which is directed to children under the age of 13 as well as targeted to older teens and adults, Titling Point’s age screen did not ask age in a neutral manner, meaning children were not encouraged to enter their age correctly to be directed to a child-version of the game. Tilting Point also inadvertently misconfigured third-party software development kits (SDKs), resulting in the collection and sale of kid’s data without parental consent. The settlement requires Tilting Point to take significant steps to prevent future improper collection and sale of children’s data and improper advertising to children in connection with all of its games directed to children, including: using only neutral age screens that encourage children to enter their age accurately; not selling or sharing the personal information of consumers less than 13 years old without parental consent, and not selling or sharing the personal information of consumers at least 13 and less than 16 years old without the consumer’s affirmative “opt-in” consent; minimizing data collection and use from children; complying with laws and best practices related to advertising to minors; and implementing and maintaining a SDK governance framework to review the use and configuration of SDKs within its apps.
Blackbaud, Inc., in a stipulated judgment, agreed to pay $6.75 million to resolved allegations that it violated consumer protection and privacy laws arising from a 2020 data breach. In connection with their use of Blackbaud’s products and services, these non-profit organizations store, among other things, names, Social Security numbers, bank account information, and medical information of California residents in Blackbaud’s databases. Blackbaud’s failure to implement reasonable data security—such as failing to ensure that old backup databases had been delete and implementing multi-factor authentication—allowed a threat actor to steal consumers’ personal information. Blackbaud then made misleading statements regarding the sufficiency of its data security efforts prior to the breach, and misleading statements about the extent of the breach to its non-profit customers and the public. The Consumer Protection Section-Privacy Unit and Healthcare Rights & Access Section investigated jointly. The settlement also requires Blackbaud to improve its security to safeguard personal and protected health information.
DoorDash, Inc., in a stipulated judgment, agreed to pay $375,000 to resolve allegations that the food delivery platform had sold the personal information of its customers without providing notice or the opportunity to opt-out, in violation of the California Consumer Privacy Act and the California Online Privacy Protection Act. The sale occurred in connection with DoorDash’s participation in marketing co-operatives, where businesses contribute the personal information of their customers in exchange for the opportunity to advertise their products to each other’s customers. The investigation found that DoorDash customer data was subsequently disclosed to businesses that were not participants of the marketing co-operatives, including to a data broker that re-sold the customer data many times over. The settlement required DoorDash to take significant steps to prevent future unlawful misconduct, including reviewing contracts with marketing and analytics vendors, using technology to evaluate if the company is selling or sharing consumer personal information, and providing annual reports monitoring any potential sale or sharing of consumer personal information.
Google, LLC in a stipulated judgment, agreed to pay $93 million to resolve allegations that the technology company’s location-privacy practices violated California consumer protection laws. The multi-year investigation determined Google was deceiving users by collecting, storing, and using their location data for consumer profiling and advertising purposes without consent. The settlement required Google to take significant steps to prevent future unlawful misconduct, including showing additional information to users when enabling location-related account settings, providing more transparency about its location tracking, and obtaining review by Google’s internal Privacy Working Group and documenting approval for all material changes to location-setting and ads personalization disclosures that will have a material impact on privacy.
Kaiser Foundation Health Plan, Inc. and Kaiser Foundation Hospitals (collectively “Kaiser”), in a stipulated judgment, agreed to be liable for $49 million to resolve allegations that the healthcare provider unlawfully disposed of medical waste, hazardous waste, and protected health information at Kaiser facilities statewide. The investigation began after district attorneys’ offices conducted undercover inspections of unsecured dumpsters destined for disposal at 16 different Kaiser facilities, finding hazardous and medical waste, as well as over 10,000 paper records containing the information of over 7,700 patients. The Consumer Protection and Environment Sections subsequently partnered with six district attorneys on the investigation. As part of the settlement, Kaiser agreed to be liable for $49 million, including $42.3 million in civil penalties, fees, and costs as well as $4.9 million for environmental projects such as environmental trainings for investigators and prosecutors. The settlement also required Kaiser to take significant steps to prevent future unlawful disposals, including retaining an independent auditor to conduct trash and field audits to monitor Kaiser’s compliance with the judgment and laws regarding proper disposal of regulated waste, including protected health information.
Sephora, Inc., in a stipulated judgment, agreed to pay $1.2 million to resolve allegations that the company violated the California Consumer Privacy Act (CCPA). The Attorney General alleged that Sephora failed to disclose to consumers that it was selling their personal information, that it failed to process user requests to opt-out of sale via user-enabled global privacy controls in violation of the CCPA, and that it did not cure these violations within 30 days. The settlement requires Sephora to clarify its online disclosures and privacy policy; provide mechanisms for consumers to opt-out of the sale of personal information, including via the Global Privacy Control; conform its service provider agreements to the CCPA’s requirements; and provide reports to the Attorney General.
Glow, Inc. (and its parent company, Upward Labs Holdings, Inc.), in a stipulated judgment, agreed to pay a $250,000 settlement to resolve allegations that its mobile app violated California’s medical privacy and data security laws. The Glow mobile app is marketed as a fertility-tracker and stores highly sensitive data related to women’s sexual and reproductive health. Our investigation found that the app had clear basic security flaws that put its users’ data at risk, and that the company failed to realize that it had to comply with the Confidentiality of Medical Information Act (CMIA), which goes beyond federal law to cover health apps such as Glow. The settlement requires Glow to improve the app’s data security, including a first-ever injunctive term that requires Glow to consider how privacy or security lapses may uniquely impact women. Glow must also incorporate privacy and security design principles into its mobile apps, obtain affirmative consent from users prior to sharing or disclosing personal, medical, or sensitive information, and allow users to revoke previously granted consent.
Anthem, a health insurance provider, in a stipulated judgment, agreed to pay a $8.69 million settlement to resolve allegations that it violated consumer protection and privacy laws arising from a 2014 data breach. Attackers used phishing emails to gain access to Anthem’s network and accessed Anthem’s most sensitive database holding personal information including name, address, email address, Social Security number, healthcare identification number, and date of birth. The data breach affected over 78 million consumers, including over 13.5 million Californians. The settlement also requires Anthem to improve its data security.
Equifax, in a nationwide settlement, agreed to pay a total of up to $600 million to resolve allegations that it improperly exposed the personal information of 147 million consumers, including 15 million Californians, in a 2017 data breach. The breach occurred after Equifax had failed to apply a critical software fix and implement security measures, including encrypting consumer Social Security numbers. The settlement requires Equifax to pay up to $425 million in restitution to affected consumers and $175 million to states in penalties, as well as provide additional benefits to consumers. The company must also implement and maintain critical data security enhancements.
Premera Blue Cross, in a stipulated judgment, agreed to pay a $10 million multi-state settlement to resolve allegations that it violated state and federal medical privacy laws arising from a 2014 data breach. Attackers used phishing emails to gain access to Premera's network and then took advantage of the company's lack of basic data security to access the personal information of 10.5 million consumers, including name, Social Security number, bank account information, medical information, and health-claims-related data. The settlement requires Premera to improve its information security program and implement a corporate compliance program that includes an independent Chief Compliance Officer and regular program assessments.
Aetna Inc., in a stipulated judgment, agreed to pay $935,000 to settle an investigation of the company after its mailing vendor sent letters to 1,991 Californians that revealed through an over-sized window in the envelope that the recipients took HIV-related medication. The settlement includes strong injunctive terms requiring Aetna to change its mailing procedures to better protect the confidentiality of medical information and conduct risk assessments for several years.
Uber Technologies, Inc., in a stipulated final judgment, agreed to pay a $148 million nationwide settlement to resolve allegations that it violated data breach notification and reasonable data security laws in connection with a 2016 data breach where Uber failed to notify regulators and users of a data breach involving personal information. Uber instead covered up the breach for over a year, paying off hackers $100,000 for their silence. The settlement includes robust injunctive terms requiring Uber to maintain a Corporate Integrity Program, implement privacy-by-design principles, and have a comprehensive information security program. California's share of the payment, which will be split between our office and our partners at the San Francisco District Attorney's Office, is around $25.6 million.
Cottage Health System, in a stipulated final judgment, agreed to pay a $2 million settlement to resolve allegations that it failed to implement basic, reasonable safeguards to protect patient medical information in violation of state and federal privacy laws. The settlement requires Cottage to upgrade its data security practices and procedures to protect patients' medical information from unauthorized access or disclosure. It requires Cottage to maintain an information security program that meets reasonable security practices and procedures for the healthcare industry, and it requires Cottage designate an employee to serve in the capacity of a Chief Privacy Officer and to complete periodic risk assessments. This settlement follows two separate data breach incidents by Cottage Health where more than 50,000 patients' medical information was made publicly available online.
Lenovo Corporation, in a stipulated final judgment, agreed to pay $3.5 million to settled a multi-state investigation resolving allegations that it had illegally preinstalled ad-injecting software that compromised the security of its computers. This case marks the first time that California has held a hardware manufacturer accountable for software preinstalled on its products. As part of the settlement, Lenovo is required to adopt advanced measures to prevent future misconduct, including making clear and conspicuous disclosures about how pre-installed advertising software will operate, obtaining a consumer's affirmative consent before using such software, and providing a reasonable and effective means for consumers to opt-out, disable or remove the software. California will receive $389,204, the largest share of the 32 states involved in the settlement. The settlement was negotiated and finalized in coordination with the Federal Trade Commission.
Target Corporation, in a stipulated final judgment, settled a multi-state investigation in response to allegations that over 40 million customers had their payment card information compromised during the 2013 holiday season after the company failed to provide reasonable data security. Target agreed to pay a record $18.5 million; California received more than $1.4 million, the largest share of any state. As part of the settlement, Target is required to adopt advanced measures to secure customers' information. The settlement requires Target to employ an executive to oversee a comprehensive information security program and advise its CEO and Board, encrypt or otherwise protect payment card information to make it useless if stolen, and adopt other technological measures. In addition, today's settlement in part requires Target to integrate business practices recommended in the Attorney General's Data Breach Reports previously published by the California Department of Justice.
Wells Fargo Bank, in a stipulated final judgement, agreed to an $8.5 million settlement for violating California privacy laws by recording consumers' phone calls without a timely disclosure to consumers, as required by sections 632 and 632.7 of the California Penal Code. This investigation and subsequent settlement agreement was a collaboration between the Attorney General's Office and five District Attorney Offices throughout the state. Wells Fargo, a California-based bank, agreed to pay $7,616,000 in civil penalties and $384,000 in prosecutors' investigative costs, as well as contribute $500,000 to two organizations that advance consumer protection and privacy rights in California. In keeping with California's strong privacy-protection standards, Wells Fargo also agreed to make clear, conspicuous, and accurate disclosures when recording confidential communications between the bank and its customers, as well as implement an internal compliance program to ensure policy changes.
Houzz, an online platform for home remodeling and design, agreed to resolve allegations that the company violated California privacy laws by recording incoming and outgoing telephone calls without notifying all parties on the call that they were being recorded. As part of the stipulated judgment, the company agreed to appoint an individual to serve in a Chief Privacy Officer capacity who will oversee Houzz's compliance with privacy laws and who will report any significant concerns to the Chief Executive Officer and/or other senior executives, to conduct a privacy risk assessment addressing its efforts to comply with applicable privacy laws governing its U.S. operations; and to pay $175,000.
Comcast agreed to a stipulated final judgment to resolve allegations that the company posted online the names, phone numbers and addresses of tens of thousands of customers who had paid for unlisted voice over internet protocol ("VOIP") phone service. Comcast agreed to improve how it handles customer complaints, strengthen its restrictions on vendors' use of personal information about customers, and provide a simple disclosure form to customers. The company Comcast must pay $25 million in penalties and investigative costs to the California Department of Justice and the California Public Utilities Commission, and approximately $8 million in additional restitution to customers whose numbers were improperly disclosed.
Aaron's agreed to a stipulated final judgment to resolve allegations that the company permitted its franchised stores to install spyware on laptop computers rented to customers without their knowledge or consent, as well as charging improper late fees, overcharging customers who paid off contracts early and omitting important contract disclosures. Aaron's agreed to refund $25 million to California customers and to pay $3.4 million in civil penalties and fees.
Kaiser agreed to a stipulated final judgment after it delayed notifying its employees after an unencrypted USB drive was discovered at a Santa Cruz thrift store that contained over 20,000 employee records. Kaiser paid $150,000 in penalties and attorneys' fees, and agreed to comply with California's data breach notification law in the future, provide notification of any future breach on a rolling basis, and implement additional training regarding the sensitive nature of employee records.
Citibank agreed to stipulated final judgment arising out a breach of its Citibank Online website via a known technical vulnerability that affected over 80,000 California account holders. Citibank paid $420,000 in penalties and attorneys' fees to California and $55,000 to the Connecticut Attorney General. Citibank also agreed to improve their security procedures, conduct an independent audit of Account Online, and provide credit monitoring for affected individuals for two years.
Anthem agreed to a stipulated final judgment as a result of it printing Social Security Numbers on mailings to its customers that were visible on the envelope. Anthem paid $150,000 in penalties and attorneys' fees and agreed to implement new technical safeguards for its data management system, restrict employee access to members' Social Security numbers and provide enhanced data security training for all of its associates.
The Attorney General filed a brief for the State of California as amicus curiae in support of neither party, in Fraley v. Facebook on appeal from the U.S. District Court for the Northern District of California, arguing that California law protecting publicity rights of minors remained valid and enforceable.