It’s 2023 and many cannabis businesses are still missing one critical operating document: a privacy policy. I’ve been writing and talking about this issue for years. And things are not getting better. So let’s talk about it once more.
To start, California has required privacy policies for a very long time (well, “long” at least in terms of the Internet). Under California law, operators of commercial websites that collect “personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site” need a privacy policy. That’s a lot to digest. In English, website owners must have a privacy policy if California consumers use or visit their website.
Any cannabis business that operates in California and has a website is clearly subject to this requirement. But what about an Iowa-based cannabis company? Well, so long as California residents use or visit it, the requirement applies. And unless the cannabis business can definitively say that its website has no California users/visitors, it’s best practice to just get a privacy policy. If you read the above law, the requirements are relatively manageable and not too intense. But that’s not the end of the story.
In
Read full article on HarrisBricken
