Important Winery Compliance Information: Wine Club Renewals & California Consumer Privacy Act

In light of recent legal action related to wine club renewals and the impending California Consumer Privacy Act, Wine Institute is sharing the following information on the scope and application of these requirements.

CALIFORNIA’S AUTOMATIC RENEWAL LAW APPLIES TO WINE CLUBS

A California winery was named in a class action lawsuit for alleged violations of California’s Automatic Renewal Law (ARL). The claims arose out of its wine club recurring subscription program.

ARL is a strict liability statute, meaning that there is no intent or fault required to be found liable. If a winery is found to be in violation of the law, it is liable under the statute. The ARL is particularly relevant to wine clubs and other subscription programs in the wine industry.

The ARL establishes a number of very detailed, clear-cut requirements for the manner in which recurring subscriptions or automatic renewal subscriptions must be disclosed, authorized by the consumer, and confirmed by the merchant. These requirements include, but are not limited to:

• “Clear and conspicuous” disclosure of the auto-renewal terms of a consumer contract, which is defined as being in more prominent text (either larger font or set off by color, type or other markings).
• The disclosure must include the price, frequency and renewal terms of the subscription before, and in visual proximity to, the purchase button.
• The consumer must give affirmative consent, which government agencies interpret to be an affirmative check box. At the very least, the affirmative consent must be in an active voice and express language close to the price and subscription terms and before the purchase button.
• The consumer must be given a readily-available method of cancellation, which must include an electronic option in the case of internet sales.
• The consumer must receive a confirmation letter or email that repeats the above information in a manner that may be preserved by the consumer.
• Importantly, the ARL states that “goods, wares, merchandise or products” sold to a consumer that do not comply with the above requirements “shall for all purposes be deemed an unconditional gift to the consumer” with no obligation to the consumer for their use, return or cost.

In recent years, the ARL has become a favorite plaintiff’s class action subject. The ARL may be enforced by private plaintiffs and the Office of the California Attorney General, and there is a very active group of California District Attorneys who do so.

Member Resources: Counsel at DLA Piper, LLP

Wine Institute is working with Paul Hall and Amanda Morgan, Partners at DLA Piper, LLP, and Mandy Chan, Associate at DLA Piper, LLP, to produce a webinar on best practices for compliance with California ARL.

CALIFORNIA CONSUMER PRIVACY ACT IMPOSES NEW BUSINESS OBLIGATIONS

California Consumer Privacy Act (CCPA) provides California consumers greater privacy rights and control over personal information that businesses collect from them.

The CCPA applies to for-profit companies that do business in California and meet one or more of the following three criteria:

1. have more than $25 million in annual gross revenue;
2. buy, receive, sell or share the personal information of 50,000 or more consumers or devices; or
3. derive 50 percent or more of their annual revenue from selling consumers’ personal information.

The CCPA imposes new business obligations such as:

• providing notice to consumers at or before collection of information;
• establishing procedures to respond to consumer opt-out requests (i.e. responding to such requests and verifying the identity of consumers who make such requests); and
• maintaining records of requests and how the business has responded for a 24-month period.
• Further, businesses must disclose the financial incentives offered in exchange for retention of information.

It is important to recognize that the CCPA and the European Union’s General Data Protection Regulation (GDPR) are separate legal frameworks with different scopes, definitions, and requirements. A business that complies with GDPR and is subject to CCPA may have additional obligations under CCPA.

The CCPA will become effective on Jan. 1, 2020, however enforcement by the California Attorney General will likely not begin until July 2020.

These regulations are not yet finalized, but members should be aware of the upcoming implications of this Act. On Dec. 6, 2019, Wine Institute filed a comment to the drafted legislation expressing concern over ambiguities in the language of the text.

Member Resources: Counsel at Reed Smith, LLP

Wine Institute has been working with Gerry Stegmaier, Partner at Reed Smith LLP, to create a CCPA compliance webinar for winery members.