Businesses Beware: CPPA Launches Online Complaint Form

On July 14, 2023, the California Privacy Protection Agency (CPPA) launched an online complaint webform that allows California consumers to submit complaints about alleged CCPA/CPRA violations directly to the Agency.

How the Complaint Form Works

The online form enables consumers to report businesses that may have violated their privacy rights under the CCPA/CPRA, including:

• Failure to honor opt-out rights (Do Not Sell/Share)
• Failure to respond to deletion requests
• Failure to respond to correction requests
• Use of dark patterns that undermine consumer privacy choices
• Failure to honor the right to limit use of sensitive personal information

According to CPPA FAQs, complaints should describe the specific violation, provide the business’s information, and include any supporting documentation.

Early Data: 13 Initial Complaints

Within days of the launch, the CPPA reported receiving 13 initial complaints. Of those:

• 7 related to the right to limit the use and disclosure of sensitive personal information
• The remaining 6 covered other CCPA/CPRA rights

This initial data suggests that consumers are particularly focused on sensitive data practices, an area that deserves heightened attention from businesses.

Practical Implications for Businesses

The launch of the complaint form lowers the barrier for consumers to report violations and signals the CPPA’s readiness to receive and act on complaints. Organizations should:

1. Verify opt-out mechanisms are functional: Test all “Do Not Sell or Share My Personal Information” links and Global Privacy Control (GPC) signal processing
2. Audit sensitive data practices: Ensure consumers can limit the use of sensitive personal information as required
3. Check dark pattern compliance: Avoid UI/UX designs that make exercising privacy rights confusing or difficult
4. Test data subject request processes: Confirm that deletion, correction, and access requests are being honored within required timeframes
5. Train consumer-facing teams: Ensure staff know how to handle privacy requests and escalate issues appropriately

The combination of this complaint form and the CPPA’s/AG’s ongoing enforcement appeal makes this a critical time for California privacy compliance.