Privacy Law Library

Shine the Light law (disclosure of personal information shared for direct marketing)

Shine the Light

Marketing · Comprehensive privacy

Lets California customers ask businesses once a year which categories of their personal information were shared with third parties for those third parties' direct marketing, and with whom. Businesses must designate a way to receive these requests and answer within 30 days, or may instead adopt a qualifying opt-out or opt-in policy.

Where

California

Citation

Cal. Civ. Code 1798.83-1798.84

Status

In force

In force since

2005-01-01

Last amended

2010-01-01

Enforced by

Private plaintiffs; courts (injunctions)

People can sue

Yes

Penalties

Damages for injured customers; civil penalty up to $3,000 per willful, intentional, or reckless violation or up to $500 per other violation, plus attorney's fees; cure defense within 90 days for non-willful lapses (1798.84).

Applies to

• Businesses with an established business relationship with a California customer that disclosed the customer's personal information to third parties for the third parties' direct marketing in the prior year
• Businesses with fewer than 20 full-time or part-time employees are exempt