We know that California has a lot of privacy laws, but the Shine the Light law is one of the oldest in the state, and it still catches businesses off guard because it is not about cookies or ad tech. It’s about who you share customer information with for marketing and what you must disclose when a customer asks. Increasingly, it is also about litigation risk because plaintiffs’ attorneys are now filing claims against companies for alleged Shine the Light violations.
California’s Shine the Light law gives California residents the right to ask a business:
- Whether the business shared their personal information with third parties for those third parties’ direct marketing purposes; and
- Who those third parties are, plus what categories of information were shared.
This law is aimed at businesses that:
- Do business with California residents;
- Have an established customer relationship with a California resident; and
- Share certain personal information with third parties for the third parties’ direct marketing.
Of course, there are exceptions and nuances, but the simplest way to think about it is this: if you share customer data (e.g., name, email address, telephone number, other account related information, etc.) with other companies so they can market their own products or services, you should assume Shine the Light applies and prepare accordingly. Such planning and preparedness means that your business should publish a clear request method (i.e., a simple “Shine the Light” statement in your website privacy policy), make sure customer support and privacy teams know what a Shine the Light request is and how to respond, track marketing-related sharing, respond on time with the right content and, importantly, when you receive a valid request, respond with the required disclosures. Don’t improvise—use a vetted template.
Even with newer California privacy frameworks, Shine the Light remains a classic compliance tripwire because it is consumer initiated and simple enough that plaintiffs’ attorneys can test compliance quickly, by reading your policy, submitting a request, and then filing claims if the company allegedly lacks the required intake path or fails to provide the required disclosures. These alleged violations are showing up in demand letters and lawsuits, which means the cost of getting it wrong can include legal fees and operational disruption, not just a policy update.