The Privacy Enforcement Podcast

Christopher Smith

Hello, my name is Christopher Smith and welcome to the Privacy Enforcement Podcast! I will discuss major data privacy enforcement cases brought by government agencies. My goal is to provide a summary of the facts, violations and penalties for each enforcement action. Occasionally I might give my personal opinion about whether I agree with the compliant. Hopefully each episode will be more joyful than reading each case. I hope you enjoy! Christopher Smith, JD FIP, CIPP/E, CIPP/US, CIPM

  1. 12/20/2025

    Texas vs. Sony - Privacy concerns with ACR Technology

    This podcast episode discusses the Texas Attorney General's lawsuit against Sony regarding the use of Automated Content Recognition (ACR) technology. It highlights issues of informed consent, transparency in data collection, and the legal implications of deceptive trade practices. The conversation emphasizes the importance of clear communication with consumers about data usage and the necessity for businesses to adhere to privacy laws.

    20 min

  2. 12/13/2025

    California v. Sling TV - Why Opt-Out Implementation Matters

    In this episode of the Privacy Enforcement Podcast, host Christopher Smith breaks down a recent California Attorney General enforcement action against Sling TV and explains why cookie banners alone do not satisfy CCPA opt-out requirements. Using People of the State of California v. Sling TV as a case study, this episode explores how opt-out rights apply far beyond cookies, how interface design choices can become enforcement risks, and why businesses—especially app-based and ad-supported platforms—must rethink how they operationalize consumer privacy rights. If you work in privacy, legal, compliance, marketing, or product, this episode offers practical insights into how regulators evaluate opt-out mechanisms in the real world.

    24 min

  3. 11/25/2025

    In the Matter of The Hartford (2025) - Webforms and Agent Portals

    In this episode, we break down how something as simple as an auto-fill feature on online quote forms can trigger an accidental data leak—and why strong MFA requirements on agent portals are essential for every insurance carrier. Link to Case: https://www.dfs.ny.gov/system/files/documents/2025/10/ea20251014-co-hartford-fire-ins-company.pdf

    15 min

  4. 11/12/2024

    FTC v. Marriott (2024)

    In this episode, I dive into the FTC's enforcement action against Marriott, issued on October 9, 2024. (Link to case) Below are my key takeaways from this enforcement action: Due Diligence for Mergers: Ensure thorough due diligence on data security when acquiring a new company. Implement Reasonable Data Security Policies: Companies should adopt security measures addressing common vulnerabilities across their assets. Start with a security framework or hire a third-party assessor if budget allows to evaluate internal systems for vulnerabilities. Flag systems storing sensitive information to enforce and maintain robust security protocols. Accurate Privacy Policy Representation: Make sure your privacy policy aligns with actual security practices. Avoid using absolute terms like “industry standard” or “the best.” Instead, provide a realistic overview of security practices without overpromising.

    21 min

  5. 09/17/2024

    FTC v. Verkada (2024)

    In this episode, I discuss the FTC's enforcement action against Verkada, announced on August 30, 2024. The FTC charged Verkada with violations of Section 5(a) and the CAN-SPAM Act. Key takeaways from this case include: Businesses are required to include their postal address in commercial emails. Employees and investors must disclose their affiliations when posting reviews about the company's products and services. Companies should promptly address vulnerabilities identified by third-party security assessors. For any questions about this enforcement action, feel free to email me at csmith@csassociatespc.com. Link to Case

    23 min

  6. 06/24/2024

    Privacy Bolo: Third-Party Vendor "Terms of Service"

    In this episode, we'll discuss why companies should be on the lookout when agreeing to third-party vendor’s Terms of Service agreements. **Opinions expressed in this episode are my own and do not express the views of others**

    13 min

  7. 06/08/2024

    Privacy Bolo: Custom Event Data

    In this episode, I’m going to discuss how companies how companies’ attempt to retain their customer and obtain new customers could indirectly result in disclosing their customers’ sensitive information to third parties. For this episode, I’m going to reference the recent the FTC complaint filed in federal court against Monument.

    15 min

  8. 06/08/2024

    Introducing the Privacy Bolo Series!

    Today, I have the pleasure of introducing you to a brand new video series I’m creating called "BOLO" – that's right, "Be on the Lookout!" In this series, I will identify key activities that companies need to monitor closely, as they are attracting the attention of privacy regulators. These activities include, labeling Custom Events may lead to disclosing sensitive data to third parties to instances of companies not enforcing contract provisions when sharing personal data with third parties. With each episode, I’ll draw upon real-world cases in order to provide concrete enforcement examples that highlight each activity.

    1 min
See All (13)

About

Hello, my name is Christopher Smith and welcome to the Privacy Enforcement Podcast! I will discuss major data privacy enforcement cases brought by government agencies. My goal is to provide a summary of the facts, violations and penalties for each enforcement action. Occasionally I might give my personal opinion about whether I agree with the compliant. Hopefully each episode will be more joyful than reading each case. I hope you enjoy! Christopher Smith, JD FIP, CIPP/E, CIPP/US, CIPM

Information