E-commerce marketing · Industry brief

California privacy regulators are escalating enforcement against data brokers under the CCPA and Delete Act, with the California Privacy Protection Agency (CalPrivacy) announcing two enforcement actions in August 2024. In the LocateSmarter case, CalPrivacy found violations of data minimization principles when the company required unnecessary information like Social Security number digits to process opt-out requests. The Cybba action is particularly relevant to ecommerce, as the company sold geolocation data, internet activity data, and behavioral inferences used for targeted advertising and identifying repeat purchasers—practices common in the digital advertising ecosystem that many online retailers depend on. For ecommerce businesses, the key compliance lesson is to conduct vendor diligence beyond registration status. Companies should understand what their advertising, analytics, and marketing partners actually do with consumer data rather than relying on vendor self-descriptions. CalPrivacy's scrutiny extends beyond registration compliance to how companies operationalize consumer privacy rights, and the launch of California's DROP (Delete Request and Opt-Out Platform) on August 1, 2026 will create a centralized system requiring registered data brokers to process deletion requests at scale, making vendor contract review and deletion process preparedness increasingly critical to privacy compliance.

The Philippines' Department of Trade and Industry E-Commerce Bureau has partnered with TikTok Shop through a memorandum of understanding to improve online seller compliance with Republic Act No. 11967 (Internet Transactions Act of 2023). The initiative includes webinars, educational videos, and learning modules focused on seller obligations, consumer protection, and accountability in online transactions. DTI-ECB Director Atty. Eryl Royce Nagtalon emphasized that collaboration with private e-commerce platforms is crucial for enhancing seller skills and awareness of regulatory requirements under the Internet Transactions Act. The partnership officially launched with a webinar on January 28 that drew over 179,000 views for TikTok Shop sellers.

FTC enforcement actions and NAD rulings are increasing scrutiny of health-related claims in beauty and wellness marketing, particularly around substantiation standards. Companies making claims like "clinically proven," "supports immunity," or "weight loss" face the greatest legal risk from FTC enforcement, state consumer protection actions, and class action lawsuits when substantiation is insufficient. The FTC's Competent and Reliable Scientific Evidence standard now applies broadly to structure-function claims and wellness claims relating to energy, mood, and mental state, with single clinical studies often insufficient to support "clinically proven" assertions. Additionally, the rapid growth of influencer marketing in the creator economy is creating compliance challenges, as brands have less control over how marketing messages are distorted through organic influencer content, requiring stronger FTC endorsement rule safeguards and influencer contracts.

On July 29, 2026, the FTC filed a complaint against Hims & Hers Health, Inc. in the Northern District of California, joined by California and Utah's Division of Consumer Protection, alleging the telehealth company misled consumers about subscription charges, cancellation rights, and health data privacy. The FTC specifically targets Hims' use of advertising technology—including pixels, server-side conversion APIs, customer-list uploads, and audience matching tools—deployed on sensitive health-related pages, claiming these practices contradicted the company's privacy assurances that medical records were accessed only by providers and that services were private and secure. The complaint identifies tracking tools used for advertising attribution, retargeting, analytics, and audience engagement as vehicles for sharing sensitive health information with social media and AdTech companies without adequate disclosure, establishing a regulatory enforcement theory that privacy representations must match actual data flows and marketing technology deployment.