Challenges in Opt-Out Design and Children’s Privacy Highlighted by Sling TV’s Settlement with California AG

The California AG reached a settlement with Sling TV and its affiliate Dish Media Sales (collectively, Sling TV), fining the company $530,000 for failing to offer customers an easy method to stop the sale of their personal data and for not providing sufficient privacy protections for children. Finnegan partner Lynn Parker Dupree was interviewed by the Cybersecurity Law Report for her thoughts on the settlement.

The settlement requires Sling TV to make it easy for users to opt out of data sharing. If someone is logged into their account, they should be able to do this with a simple switch or button, without filling out forms or giving extra details. For people who aren’t logged in or don’t have an account, Sling TV must explain that they might need to log in or provide some personal info for the opt-out to work fully. If they choose not to do that, Sling TV still must treat their choice as an opt-out request.

Lynn said, “The differing requirements for logged-in and logged-out users reflect the fact that authentication has already been completed for users who are logged in. This signals that the AG intends for businesses to prioritize consumer ease and accessibility in exercising their choices.” She added that regulatory guidance “emphasizes the importance of parity and ease in choice architecture.”

Sling TV must also offer an easy opt-out option directly within its app without needing a second device. The app should include clear links for opting out on mobile and TV platforms. If a simple in-app toggle isn’t possible, Sling TV should make the process as easy as possible, such as by providing a QR code.

Lynn said a significant takeaway from the Settlement “is that businesses should be using a broader perspective when thinking about apps. While apps are typically associated with mobile devices, businesses should be thinking about the design functionality of applications on stationary devices to ensure they are built with adequate compliance features.”

She noted that the challenge with providing proper opt-out links in apps as opposed to websites is a practical one: “The amount of screen space for text varies by device.” For instance, “websites viewed on a computer typically have more space than an app accessed on a mobile phone,” she said. To that end, businesses “should design apps so that links are easily accessible on different devices, which may involve extra adjustments for smaller screens,” she suggested.

The settlement also requires Sling TV to improve privacy protections for children. Parents can create a “kids” profile with privacy settings turned on by default, blocking the sale or sharing of personal data and targeted ads. Channels for children cannot show ads based on personal or household information.

“Children’s privacy is a significant regulatory concern both within California and in other states,” Lynn said. A primary lesson from the Sling TV matter “is that companies cannot claim their services are not intended for children while neglecting to determine whether they are interacting with child users.”

The Complaint alleges “that Sling TV stated that its service was not intended for individuals under 18,” Lynn said, but “there were indicators suggesting potential interaction with children, including the ability for parents to implement parental controls and Sling TV’s licensing of programming aimed at children.” Despite those facts, Sling TV “neither provided parents with the option to designate any profile as a child’s profile nor adhered to parental consent and opt-in requirements for cross-contextual advertising,” she noted.

“When a business is aware or becomes aware that children are engaging with its services, it is obligated to ensure compliance with all applicable children’s privacy requirements,” Lynn said.

Read “Challenges in Opt-Out Design and Children’s Privacy Highlighted by Sling TV’s Settlement with California AG”