Contract analysis

I. Executive Summary The purpose of this memorandum is to assess the applicability of the Children's Online Privacy Protection Act ("COPPA") and state-law age-gating obligations — including, most significantly, the California Age-Appropriate Design Code Act (the "AADC") and emerging analogous state statutes — to the e-commerce platform operated by Cascade Retail Holdings Inc. ("Cascade" or the "Company"). The analysi

II. Scope and Methodology A. Scope of Analysis The scope of this memorandum covers the following components of Cascade's digital ecosystem: • cascade.com, including all subdomains and the third-party marketplace operated at cascade.com/marketplace by Cascade Digital Marketplace LLC, which hosts approximately 3,800 third-party sellers offering products across a range consumer categories; • The Cascade mobile applicati

1. Fieldhaven Consulting Group LLC Data-Mapping Report (May 19, 2025). Prepared under the direction of Marcus Ellerby, engagement lead, this report mapped the data flows across Cascade's digital properties and identified twelve (12) categories of cookies and tracking technologies deployed on cascade.com, including first-party analytics cookies, third-party advertising pixels, session-management cookies, and cross-dev

2. Peakview Analytics Inc. Data Processing Summary. Peakview Analytics Inc. ("Peakview") processes approximately 2.1 billion consumer-event data records per month on behalf of Cascade for the purposes of ad targeting, audience segmentation, and content personalization. These data records include behavioral data (page views, click-through events, purchase history, search queries, and product-interaction signals) that

3. Cascade Rewards Loyalty Program Materials. The Cascade Rewards loyalty program, operated by Cascade Rewards Corp., has approximately 41.2 million registered members. We reviewed the registration flow, terms of use, and privacy disclosures applicable to the loyalty program, including the requirement that users represent they are at least eighteen (18) years of age at the time of registration.

4. FTC Civil Investigative Demand (File No. 232-0147). As background relevant to the FTC's awareness of and attention to Cascade's digital-design practices, we reviewed the Civil Investigative Demand ("CID") issued by the Federal Trade Commission on September 14, 2023, regarding allegations that the unsubscribe flow within the Cascade mobile application employed "dark patterns" in violation of Section 5 of the FTC Ac

5. Interviews and Coordination. We conducted interviews and coordinated with the following Cascade personnel: • Gregory Farris, Chief Information Security Officer (CISO): Consulted regarding the technical feasibility of implementing age-gate mechanisms within the existing technology stack, including integration points with the Cascade Platform's account-registration flow, the CMP, and the data-subject-request ("DSR")

6. Multi-State Privacy Law Applicability Matrix (June 30, 2025). Prepared by this firm as part of the broader compliance engagement, this matrix identifies the nineteen (19) state comprehensive privacy statutes currently applicable to Cascade based on its operational footprint, revenue, and data-processing volumes, and flags the specific provisions within each statute that impose heightened obligations with respect t

III. COPPA Analysis A. Overview of COPPA Requirements The Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and the implementing regulations promulgated by the Federal Trade Commission at 16 C.F.R. Part 312 (the "COPPA Rule"), establish a comprehensive framework governing the online collection, use, and disclosure of personal information from children under the age of thirteen. COPPA was originally en

1. Implement an age gate at account registration. Cascade should implement a neutral age-gate mechanism — such as a date-of-birth entry screen or an age-range selection question — at the point of account registration on cascade.com and the Cascade mobile application. The age gate should be presented prior to the collection of any personal information (including name, email address, and device identifiers) so that if

2. Implement age gates at secondary data-collection points. In addition to account registration, age-gate screens should be implemented at other points where personal information is collected from users who may not have registered accounts, including newsletter sign-up, product-review submission, "Ask a Question" features, and customer-service chat initiation.

3. Block collection from users under thirteen. If a user indicates through the age gate that they are under thirteen, the system should block account creation, suppress all personal-data collection (including cookies and tracking technologies), and present a clear, age-appropriate message explaining that the service is not available to users under thirteen. The system should not retain the age information entered by

4. Integrate with consent-management platform. These age-gate mechanisms should be incorporated into the CMP being deployed by OnPoint Data Solutions Inc., in coordination with Fieldhaven Consulting Group LLC (Marcus Ellerby, engagement lead), to ensure that age-differentiated consent flows are managed consistently across the Cascade Platform. The target deployment date for the CMP is December 15, 2025, and the age-g

5. Train customer-service representatives. Cascade's customer-service team should be trained to recognize indicators that a user may be under thirteen (e.g., a caller who sounds like a young child, a chat user who states their age) and to follow escalation procedures that include immediately ceasing the collection of personal information and documenting the interaction for compliance review.

IV. California Age-Appropriate Design Code Act (AADC) Analysis A. Overview of the AADC The California Age-Appropriate Design Code Act, Assembly Bill 2273, was signed into law on September 15, 2022, and is codified at California Civil Code Sections 1798.99.28 through 1798.99.40. The AADC became effective on July 1, 2024, and enforcement by the California Attorney General is set to commence on July 1, 2025 — the date o

1. Data Protection Impact Assessment (DPIA). Under Section 1798.99.31(a), Cascade must complete a Data Protection Impact Assessment for any online service, product, or feature likely to be accessed by children before offering that service, or for existing services, within the compliance timeline established by the statute. The DPIA must identify, at a minimum: (i) The purpose of the online service, product, or featur

2. Privacy by Default for Children. Under Section 1798.99.31(b)(1), Cascade must configure all default privacy settings to offer a "high level of privacy" to child users unless it can demonstrate a compelling reason that a different default setting is in the best interests of children. This obligation requires Cascade to evaluate and, where necessary, reconfigure the default settings for the twelve categories of cook

3. Prohibition on Profiling by Default. Under Section 1798.99.31(b)(4), Cascade may not profile a child by default unless it can demonstrate a compelling reason that profiling is in the best interest of children. "Profiling" is defined under the AADC, consistent with the CCPA/CPRA definition, as any form of automated processing of personal information to evaluate certain personal aspects relating to a natural person,

4. Data Minimization. Under Section 1798.99.31(b)(2), the collection of children's personal information must be limited to what is "reasonably necessary" to provide the online service requested by the child. Cascade may not collect personal information beyond what is necessary and must not retain children's personal information for longer than reasonably necessary to provide the requested service. Impact on Cascade:

5. Age Estimation / Age-Appropriate Application. Under Section 1798.99.35, Cascade must "estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business" or, alternatively, apply the AADC's protections to all users regardless of age. The statute does not prescribe a specific age-estimation methodology, and the California Attor

6. No Dark Patterns. Under Section 1798.99.31(b)(6), Cascade may not use any "dark pattern" to lead or encourage children to provide personal information beyond what is reasonably necessary to provide the online service, to forego privacy protections, or to take any action that the child would not otherwise take. A "dark pattern" is defined as a user interface designed or manipulated with the substantial effect of su

7. Prominent and Accessible Privacy Information. Under Section 1798.99.31(b)(3), privacy information provided to children must be "concise, prominent, and using clear language suited to the age of children likely to access the online service." This requires Cascade to develop age-appropriate versions of its privacy disclosures — or, at minimum, to present its existing privacy disclosures in a manner that is accessibl

8. Tools for Children to Exercise Privacy Rights. Under Section 1798.99.31(b)(7), Cascade must provide "prominent, accessible, and responsive tools" that enable children to exercise their privacy rights and to report concerns about their privacy. These tools must be designed to be usable by children without adult assistance. Impact on Cascade: Cascade's existing DSR portal (accessible via the "Privacy" link in the fo

1. Implement an age-estimation mechanism. Deploy a neutral age screen (date-of-birth entry or age-range selection) at account registration and prior to data-intensive features (personalized recommendations, ad targeting, product reviews, newsletter sign-up) on cascade.com and the Cascade mobile application. The age screen should be designed to avoid suggesting a "correct" answer (i.e., it should not indicate that sel

2. Configure privacy-by-default settings for minors. For users estimated to be under eighteen, configure default settings so that: (a) Third-party tracking cookies and behavioral-advertising technologies are disabled by default; (b) Peakview Analytics profiling, audience segmentation, and behavioral-data processing are turned off; (c) Precise geolocation data collection via the Cascade mobile application is disabled,

3. Complete an AADC-specific DPIA. Prepare and finalize a Data Protection Impact Assessment for cascade.com and the Cascade mobile application addressing each of the elements required under Section 1798.99.31(a). Integrate the AADC DPIA requirements into the broader PIA framework and template being developed by Calderwood & Harkness LLP for delivery in October 2025.

4. Review UI/UX for dark-pattern risks. Engage a UX-review process to evaluate the account-creation flow, Cascade Rewards enrollment, newsletter sign-up, mobile-app permission prompts, and cookie-consent interfaces for dark patterns that could lead or encourage minors to provide personal information, forgo privacy protections, or take actions they would not otherwise take. This review should be informed by the lesson

5. Develop age-appropriate privacy disclosures. Prepare a children's-privacy section for the updated omnibus privacy policy that is written in clear, age-appropriate language and that describes Cascade's practices with respect to the personal information of users under eighteen.

6. Coordinate technical implementation. Work with Fieldhaven Consulting Group LLC (Marcus Ellerby, engagement lead) and OnPoint Data Solutions Inc. to implement age-gate technical controls as part of the CMP deployment, with a target date of December 15, 2025. The technical implementation should include integration with Peakview Analytics' data pipeline to enable the suppression of profiling and data sharing for mino

V. Other State Age-Related Privacy Laws A. Survey of Emerging State Requirements In addition to COPPA and the California AADC, Cascade is subject to a growing patchwork of state comprehensive privacy statutes that impose heightened protections for the personal data of minors. The Multi-State Privacy Law Applicability Matrix prepared on June 30, 2025 identifies nineteen (19) state comprehensive privacy statutes curren

VI. Impact on Cascade Data Practices and Third-Party Relationships The implementation of age-gating mechanisms and graduated privacy protections for minors will have significant operational implications for Cascade's data practices and its relationships with key third-party service providers and business partners. This section addresses the most significant impacts. A. Peakview Analytics Inc. Peakview Analytics proce