California's Streaming TV Sweep Leads to $530K Settlement with Sling

Stacey Schesser, the department's supervising deputy attorney general, revealed the settlement Thursday during a mobile privacy panel at IAPP's privacy and security conference.

California alleges that consumers must go to another web form and click through multiple confirmation steps before opting out of sharing their data on the Dish-owned streaming service. Sometimes, Schesser said, the platform was “combining cookie preferences with the CCPA opt-out,” even though deactivating cookies doesn't truly opt out consumers from data sharing.

There were also situations where consumers had to re-identify themselves to opt-out, even though Sling TV knew their identity, Schesser said.

Additionally, Sling TV lacks an option for creating kids' profiles, which, the settlement said, makes it hard to limit targeted advertising for minors, as well as to obtain authorization or consent, as the CCPA requires for those younger than 16.

Filed in the California Superior Court in Los Angeles, the settlement stemmed from an investigative sweep of streaming services announced in January 2024 (see 2401290055). As part of enforcement, Schesser said her office sometimes looks at "a specific area of the law” for compliance. Streaming platforms were chosen because people use them at the browser level, with mobile apps and through living room devices.

“We're not just relying on typical mobile devices anymore,” but instead “looking at how mobile applications are also implemented on living room devices,” and how the data collected when watching TV can be used “for targeted advertising” as well as for potentially “profiling individuals."

“Californians have critical privacy rights,” said Attorney General Bonta (D) in a press release, adding that the investigative sweep considered different ways streaming consumers should be able to stop the sale of their data.

The office also filed a proposed judgment. In addition to the monetary penalty, it said Sling TV must: provide an opt-out mechanism on living room devices so downloading a mobile app isn't required; ensure that consumers seeking to opt-out aren't rerouted to cookie preferences; and allow creation of kids' profiles, among other things.

The changes aim to “ensure the CCPA opt-out is easy for consumers to execute, requires minimal steps, and considers the way the business interacts with consumers,” said the release.

“We take privacy rights seriously and Sling TV was not providing consumers an easy way to opt-out of the sale of their personal data as required,” Bonta added. “My office is committed to the continued enforcement of the CCPA -- every Californian has the right to their online privacy, especially in the comfort of their living room.”

In an emailed statement to Privacy Daily, a Sling spokesperson said the company was “pleased to reach [a] resolution" with California, and has "implemented privacy enhancements to address the DOJ's concerns.”

“While we disagree with certain characterizations, Sling remains committed to respecting the privacy rights of its customers,” the spokesperson added.

The Electronic Frontier Foundation is encouraged to see the AG "continue to use his power to enforce" the CCPA, said Hayley Tsukayama, EFF state affairs director, in an emailed statement. "Companies must face real consequences if they don’t respect consumer choice."

Consumer Reports also applauded. "Opting out should be easy," said CR Policy Analyst Matt Schwartz: The consumer group hopes the action "will spur other companies to take a closer look at their opt-out processes as well."