Contract analysis

I. Purpose and Scope of Memorandum This memorandum provides a comprehensive summary of Cascade Retail Holdings Inc.'s ("Cascade" or the "Company") two prior regulatory interactions with (1) the Federal Trade Commission (the "FTC") and (2) the Office of the California Attorney General (the "California AG"), and analyzes the implications of those interactions for the design and implementation of the comprehensive US st

II. Summary of FTC Civil Investigative Demand (File No. 232-0147) A. Background and Timeline On September 14, 2023, Cascade received a Civil Investigative Demand ("CID") from the Federal Trade Commission, assigned File No. 232-0147. The CID was personally served on Cascade's registered agent in the State of Delaware, Pemberton Industries, and a copy was simultaneously transmitted via certified mail to Meredith Tanaka

III. Summary of California Attorney General Informal Inquiry A. Background and Timeline On February 6, 2024, the Office of the California Attorney General sent an informal inquiry letter to Cascade requesting information about Cascade's practices regarding the sale and sharing of consumer personal information and the associated disclosures made to California consumers. The letter was addressed to Meredith Tanaka and

2. Service-Provider and Contractor Agreements. The AG requested information regarding Cascade's contractual arrangements with third-party vendors and advertising partners, specifically whether those agreements contained the contractual provisions required under CCPA/CPRA to qualify the data recipients as "service providers" (Cal. Civ. Code § 1798.140(ag)) or "contractors" (Cal. Civ. Code § 1798.140(j)), as opposed to

IV. Current Status of Deficiencies Identified in Regulatory Interactions This section provides a detailed assessment of the current status of the specific compliance deficiencies highlighted by the FTC and California AG interactions, as informed by Calderwood & Harkness's preliminary review and the Fieldhaven data-mapping report. A. Deficiencies Highlighted by the FTC Inquiry Dark-Pattern Remediation — Mobile App. As

2. Service-Provider and Contractor Agreements As of May 2025, 23 of Cascade's 47 third-party advertising and analytics partners lack executed data-processing agreements ("DPAs") containing the contractual provisions required under CCPA/CPRA to qualify the data recipient as a "service provider" or "contractor." Specifically, the agreements currently in place with these 23 partners — which consist of standard insertion

3. Privacy Policy Staleness Cascade's current online privacy policy, published on cascade.com, was last updated in March 2022. This policy predates the effective date of the CPRA amendments to CCPA (January 1, 2023, with enforcement commencing July 1, 2023) and predates the enactment or effective date of 14 of the 19 state privacy statutes applicable to Cascade. The March 2022 privacy policy does not contain disclosu

V. Implications for Current Compliance Program Design A. Regulatory Posture and Enforcement Risk Although both the FTC and California AG matters were resolved (in the case of the FTC) or effectively concluded (in the case of the AG) without formal enforcement action, Cascade's regulatory history creates a heightened enforcement-risk profile that must inform the design and prioritization of the compliance program. The

1. GPC/Universal Opt-Out Mechanism. Implement recognition and honoring of Global Privacy Control signals across cascade.com and the Cascade mobile app. This remediation item is both a mandatory regulatory requirement under CCPA/CPRA (11 CCR § 7025(c)) and directly responsive to the California AG's inquiry about the effectiveness of Cascade's opt-out mechanism. Implementation is tied to the OnPoint CMP deployment mile

2. DPA Coverage for All Third-Party Partners. Execute compliant DPAs with all 47 advertising and analytics partners, prioritizing the 23 partners that currently lack any form of data-processing agreement. For each partner, Calderwood & Harkness will conduct a classification analysis to determine whether the partner functions as a service provider, contractor, or third party under CCPA/CPRA and analogous state statute

3. Thornbridge Media Corp. Data-Sharing Agreement Restructuring. The relationship between Cascade and Thornbridge Media Corp. ("Thornbridge") represents the highest-volume data-sharing arrangement in Cascade's advertising ecosystem. During FY2024, Cascade's advertising spend with Thornbridge totaled $18.4 million, encompassing programmatic advertising, audience targeting, cross-device identity resolution, and lookali

4. Comprehensive Privacy Policy Update. Replace the outdated March 2022 privacy policy with the new omnibus privacy policy covering all 19 applicable state privacy statutes. The new policy will include clear and conspicuous disclosures regarding the categories of personal information collected, the purposes of collection and processing, the categories of third parties with which personal information is sold or shared

5. DSR Portal Enhancements. Cascade's current data-subject-request portal (accessible at cascade.com/privacy-requests) requires significant enhancements to meet the requirements of CCPA/CPRA and other applicable state privacy statutes. The current portal lacks identity-verification functionality that meets the CCPA/CPRA standard for verifying the identity of a consumer making a request (11 CCR § 7060 et seq.), and it

6. Sensitive Personal Information Consent Flow. Cascade's mobile app collects precise geolocation data from consumers who enable location services on their mobile devices. This data is used for store-locator functionality, location-based promotional notifications, and geofencing analytics conducted by Peakview. Under CCPA/CPRA, precise geolocation data is classified as "sensitive personal information" (Cal. Civ. Code

VI. Recommendations Based on the analysis set forth in this memorandum, I make the following recommendations for discussion with the client and for incorporation into the Phase 1 compliance work plan:

1. Prioritize California AG Remediation Items. The two specific deficiencies flagged by the California AG's February 2024 inquiry — (i) the effectiveness of the "Do Not Sell or Share" link and opt-out mechanism (including GPC signal honoring) and (ii) the adequacy of service-provider and contractor DPA coverage — should be designated as the highest-priority remediation items in the Phase 1 work plan. These items carr

2. Design Consumer-Facing Interfaces in Compliance with FTC Dark-Pattern Guidance. All new consumer-facing opt-out and consent interfaces — including the OnPoint CMP deployment, the DSR portal enhancements, and the mobile-app consent flows — must be designed in compliance with the FTC's published guidance on dark patterns and tested for usability before deployment. Testing should include user-experience testing with

3. Document Remedial Actions. Cascade should maintain a comprehensive and contemporaneous record of all remedial actions taken in response to the deficiencies identified in both regulatory interactions. This documentation should include design specifications, implementation timelines, testing results, legal-review memoranda, and post-deployment verification records. In the event of any future regulatory inquiry, this

4. Coordinate on SEC Disclosure. Calderwood & Harkness should coordinate with Whitfield Greaves LLP (Carolyn J. Marsden) regarding the appropriate SEC disclosure treatment of Cascade's regulatory history and the ongoing compliance-program expenditures. The aggregate expenditures associated with the Phase 1 compliance program are significant: Calderwood & Harkness's Phase 1 engagement carries a fee cap of $2,600,000;

5. Review Insurance Coverage. Cascade should consult with Ridgepoint Insurance Brokers Inc. (Nathan Gilroy) and review the terms of the Northcastle Indemnity Company cyber/privacy-liability policy (policy period July 1, 2025 – June 30, 2026; $25M per-occurrence / $50M aggregate; annual premium $1,340,000) regarding (i) any obligation to provide notice to the carrier of the regulatory history and ongoing compliance de

6. Include Regulatory History in Phase 1 Certification. A summary of Cascade's regulatory history with the FTC and California AG, together with a detailed accounting of the remediation status of all identified deficiencies, should be included in the Phase 1 Compliance-Readiness Certification Memorandum targeted for delivery on December 31, 2025. The certification memorandum will serve as the primary deliverable docum

VII. Document Retention Note All materials related to the FTC Civil Investigative Demand (File No. 232-0147) and the California Attorney General informal inquiry described in this memorandum should be maintained under legal hold and preserved in accordance with Cascade's document-retention policies, the litigation-hold notice issued by Meredith Tanaka on September 15, 2023 (in connection with the FTC CID), and Calder