State Attorneys General

Earlier this week, 50 states and D.C. obtained a $141 million settlement with Intuit related to its advertising of free and freemium TurboTax products. This settlement, which took the form of an Assurance of Voluntary Compliance (a special kind of settlement authorized by many state unfair and deceptive trade practice laws), concluded a three year

In a major development, the States of Missouri, Montana, and Texas have announced their withdrawal from the National Association of Attorneys General (NAAG).  For several months, there have been increasing rumblings from certain states over questions and concerns about the organization, leading to this significant announcement.  The long term impact of this announcement, however, remains

As we’ve discussed in recent posts, State Attorneys General often take positions on important consumer protection policy issues through a joint letter from the National Association of Attorneys General, often referred to as a “NAAG letter.”  This leads to the inevitable question – what is NAAG and what does it do?  As former State

This month’s update kicks off spring with a Best in Show throwback ad comparing dog flea and tick medication, pivots to claims for survivalist ready-to-eat meals (don’t even try to act like you saw that coming), highlights FDA’s recently-issued voluntary recall guidance, provides a food court update on the latest ingredient class actions and cleans

How the Utah Consumer Privacy Act Stacks Up Against Other State Privacy Laws

As companies wait to see whether the Utah Consumer Privacy Act (UCPA) becomes the fourth comprehensive state privacy law, we are providing an overview of some of the Act’s key provisions – and how they depart from comprehensive privacy laws in California, Colorado, and Virginia.

Utah’s Senate unanimously passed the UCPA on February 25.  The House – also through a unanimous vote – followed on March 2.  The Legislature sent the UCPA to Governor Spencer Cox on March 15.  Because the Legislature adjourned on March 4, Governor Cox has 20 days from the date of adjournment – March 24 – to sign or veto the Act.  If Governor Cox takes no action, the UCPA will become law, with an effective date of December 31, 2023.

In broad strokes, the UCPA is similar to the Virginia Consumer Data Protection Act (VCDPA) and Colorado Privacy Act (CPA).  And, like the laws in Colorado and Virginia, the UCPA borrows some concepts from the CCPA – including a version of the right to opt out of the “sale” of personal data.

However, the UCPA pares back important features of all three of these laws.  Some of the significant changes include:

  • Applicability.  The UCPA’s applicability is narrower than the three other comprehensive state privacy laws.  The UCPA applies only to controllers or processors that (1) do business in the state (or target Utah residents with products or services); (2) earn at least $25 million in revenue; and (3) either: (a) control or process personal data of 100,000 or more consumers in a calendar year; or (b) derive more than 50 percent of gross revenue from selling personal data and control or process data of 25,000 or more consumers.  By contrast, the $25 million revenue threshold is an independent basis for the CCPA to apply to a business; and neither the CPA nor VCDPA includes a revenue-based exemption.
  • Exemptions.  In addition to exempting personal data that is subject to sector-specific privacy laws and regulations, such as HIPAA, the Gramm-Leach-Bliley Act, and the Fair Credit Reporting Act, the UCPA provides that the Act does not apply to certain entities, including a tribes, institutions of higher education, and nonprofit corporations.
  • Sale and Targeted Advertising Opt-Out Rights.  Although the UCPA requires controllers to provide consumers with the ability to opt out of sale and targeted advertising, the Act does not provide a right to opt out of profiling (or otherwise address profiling).  Like the VCDPA, the UCPA restricts the definition of “sale” to “the exchange of personal data for monetary consideration by a controller to a third party.”  This definition does not include “other valuable consideration,” found in the definitions of “sale” under the CCPA and CPA.
  • Opt-Out Consent to Process Most Sensitive Data.  The UCPA does not require opt-in consent to process most sensitive data, unless the data “concern[s] a known child,”  unlike the opt-in requirements of the CPA and VCDPA.  Instead, the UCPA requires controllers to “present[] the consumer with clear notice and an opportunity to opt out” of sensitive data processing.
  • Other Consumer Rights.  The UCPA provides consumers the right to confirm processing and to delete personal data they provided to a controller.  Consumers also have the right to obtain a portable copy of personal data that the consumer “previously provided to the controller.”  This “provided to” language follows the VCDPA’s access and portability right and contrasts with obligations to provide personal data “concerning” (CPA) or “about” (CCPA) a consumer.  The UCPA does not provide a right of correction or accuracy.
  • Enforcement and Regulation.  The UCPA does not include a private cause of action, nor does it authorize the Attorney General or other state official or agency to issue regulations.  The Division of Consumer Protection, in the Utah Department of Commerce, investigates potential violations and can refer an action to the Utah Attorney General for enforcement.  The Attorney General can recover actual damages for consumers and a penalty of up to $7,500 per violation, but only after a 30 day notice and right to cure period.


Continue Reading How the Utah Consumer Privacy Act Stacks Up Against Other State Privacy Laws

Remington recently agreed to a groundbreaking $73 million settlement of claims brought by families of Sandy Hook school shooting victims. Notably, the plaintiffs secured this settlement by deploying consumer protection claims, which are exempted from the otherwise broad immunity provided to firearm manufacturers under the Protection of Lawful Commerce in Arms Act (“PLCAA”).

Attorneys General now appear to be pursuing a similar strategy of using consumer protection laws against firearm manufacturers, including by using their authority to investigate the companies’ internal files. For example, litigation concerning the New Jersey Attorney General’s subpoena to Smith & Wesson demonstrates how AGs will seek to use their consumer protection investigative powers in this area and further how courts in response will continue to grapple with the intersection between consumer protection law, the PLCAA, and the Second Amendment.

On October 13, 2020, the New Jersey Attorney General served an investigative subpoena to Smith & Wesson pursuant to its authority under the New Jersey Consumer Fraud Act (“CFA”).The New Jersey Division of Consumer Affairs’ preliminary investigation suggested the company’s advertisements to New Jersey residents “may misrepresent the impact owning a firearm has on personal safety and/or safety in the home.” The Agency also noted that certain of the manufacturer’s advertisements “market the concealed carry of firearms while omitting the material fact that, in New Jersey, concealed carry of a firearm requires a permit.”
Continue Reading After Remington Settlement, Attorneys General Aim To Press Forward With Consumer Protection Investigations of Firearms Manufacturers

Last week, 49 State Attorneys General joined in a National Association of Attorneys General letter authored by Florida, Iowa, Mississippi, Pennsylvania, and Tennessee responding to the FTC’s Request for Public Comment concerning impersonation scams. While a bipartisan coalition from the State AGs on consumer issues isn’t particularly surprising, the call for additional federal oversight into

Food + Personal Care Litigation and Regulatory Highlights – January 2022Welcome to our 2022 inaugural issue of Food and Personal Care Litigation and Regulatory Highlights, where we explore trends and developments from around these industries.  It’s fair to say that the year has started off very busy in both the courtroom and the regulatory arena.  On this chilly winter day, our first stop is in California.

Prop 65

Our friends at Kelley Green Law Blog get the starting position for this issue by highlighting a precipitous uptick in the number of Prop 65 filings over the prior year.  While the Covid-19 pandemic caused all sorts of disruptions to society and the economy, at least one area of business has thrived over the last two years:  private plaintiff enforcement of California Proposition 65.  In 2020-2021, over 40% more Prop 65 actions were brought by private plaintiff “bounty hunters” than in the two years prior to the pandemic (2018-2019).  Compared to a decade ago, private plaintiff groups now initiate three times more Prop 65 actions each year, and five times more than in 2008.  Learn more here about the most frequently cited chemicals and those that are emerging, including PFAS.
Continue Reading Food + Personal Care Litigation and Regulatory Highlights – January 2022