PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT This memorandum is protected by the attorney-client privilege and the work-product doctrine. It is intended solely for the use of Calderwood & Harkness LLP attorneys and the client, Cascade Retail Holdings Inc. Do not distribute, copy, or disclose without the express authorization of the supervising attorney.
MEMORANDUM
TO: Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP
FROM: Sara Hendricks, Associate, Privacy & Data Security, Calderwood & Harkness LLP
DATE: July 21, 2025
RE: Children's Privacy & Age-Gating Analysis — Cascade Retail Holdings Inc.
MATTER NO.: 1038-00010
CLIENT: Cascade Retail Holdings Inc.
I. Executive Summary
The purpose of this memorandum is to assess the applicability of the Children's Online Privacy Protection Act ("COPPA") and state-law age-gating obligations — including, most significantly, the California Age-Appropriate Design Code Act (the "AADC") and emerging analogous state statutes — to the e-commerce platform operated by Cascade Retail Holdings Inc. ("Cascade" or the "Company"). The analysis covers cascade.com, including the third-party marketplace located at cascade.com/marketplace operated by Cascade Digital Marketplace LLC ("Cascade Marketplace"), as well as the Cascade mobile application (collectively, the "Cascade Platform").
Principal conclusion. Cascade does not operate a website or online service "directed to children" under the age of thirteen within the meaning of COPPA, 15 U.S.C. §§ 6501–6506, and does not have "actual knowledge" of collecting personal information from children under thirteen. Accordingly, COPPA's notice-and-consent requirements are not directly triggered at this time. However, Cascade faces meaningful and imminent obligations under the California AADC (Cal. Civ. Code §§ 1798.99.28–1798.99.40), which became effective on July 1, 2024, with enforcement by the California Attorney General commencing on July 1, 2025. The AADC applies to online services that are "likely to be accessed by" children under the age of eighteen — a standard that, given the scale and nature of the Cascade Platform, almost certainly encompasses cascade.com and the Cascade mobile application. In addition, a growing number of state comprehensive privacy statutes impose heightened protections for the personal data of minors, including requirements for affirmative opt-in consent before the sale, sharing, or processing for targeted advertising of the personal information of consumers known to be under sixteen or, in certain states, under eighteen.
Recommendation. We recommend that Cascade implement age-gate mechanisms on cascade.com and the Cascade mobile application to (a) establish a reasonable and defensible compliance posture under the AADC and analogous state laws, (b) serve as a prophylactic safeguard against inadvertent exposure to COPPA obligations by preventing the acquisition of "actual knowledge" that a user is under thirteen, and (c) support Cascade's representations in its forthcoming updated omnibus privacy policy (draft delivery target: September 12, 2025) that it does not knowingly collect personal information from children. The age-gate mechanism should be integrated into the consent-management platform ("CMP") being deployed by OnPoint Data Solutions Inc. ("OnPoint"), with a coordinated deployment target of December 15, 2025.
This memorandum is part of the broader United States state-privacy compliance program engagement opened on June 2, 2025, under Matter No. 1038-00010, and should be read in conjunction with the comprehensive gap-analysis report currently in preparation (delivery target: August 15, 2025) and the Multi-State Privacy Law Applicability Matrix prepared June 30, 2025.
II. Scope and Methodology
A. Scope of Analysis
The scope of this memorandum covers the following components of Cascade's digital ecosystem:
• cascade.com, including all subdomains and the third-party marketplace operated at cascade.com/marketplace by Cascade Digital Marketplace LLC, which hosts approximately 3,800 third-party sellers offering products across a range consumer categories;
• The Cascade mobile application, available on iOS and Android, which provides e-commerce, loyalty-program, and personalization features; and
• In-store digital experiences, including digital kiosks located in Cascade's 186 retail locations across 31 states and the Wi-Fi sign-in portals available to customers in those locations.
B. Materials Reviewed and Interviews Conducted
In preparing this analysis, the following materials were reviewed and the following personnel were consulted:
1. Fieldhaven Consulting Group LLC Data-Mapping Report (May 19, 2025). Prepared under the direction of Marcus Ellerby, engagement lead, this report mapped the data flows across Cascade's digital properties and identified twelve (12) categories of cookies and tracking technologies deployed on cascade.com, including first-party analytics cookies, third-party advertising pixels, session-management cookies, and cross-device tracking identifiers.
2. Peakview Analytics Inc. Data Processing Summary. Peakview Analytics Inc. ("Peakview") processes approximately 2.1 billion consumer-event data records per month on behalf of Cascade for the purposes of ad targeting, audience segmentation, and content personalization. These data records include behavioral data (page views, click-through events, purchase history, search queries, and product-interaction signals) that are shared with forty-seven (47) third-party advertising and analytics partners.
3. Cascade Rewards Loyalty Program Materials. The Cascade Rewards loyalty program, operated by Cascade Rewards Corp., has approximately 41.2 million registered members. We reviewed the registration flow, terms of use, and privacy disclosures applicable to the loyalty program, including the requirement that users represent they are at least eighteen (18) years of age at the time of registration.
4. FTC Civil Investigative Demand (File No. 232-0147). As background relevant to the FTC's awareness of and attention to Cascade's digital-design practices, we reviewed the Civil Investigative Demand ("CID") issued by the Federal Trade Commission on September 14, 2023, regarding allegations that the unsubscribe flow within the Cascade mobile application employed "dark patterns" in violation of Section 5 of the FTC Act. This matter was closed on April 3, 2024, with no enforcement action taken. Nonetheless, the CID is relevant because it demonstrates that the FTC has scrutinized Cascade's user-interface design choices, and any future complaints regarding children's-privacy practices could be evaluated against this backdrop.
5. Interviews and Coordination. We conducted interviews and coordinated with the following Cascade personnel:
• Gregory Farris, Chief Information Security Officer (CISO): Consulted regarding the technical feasibility of implementing age-gate mechanisms within the existing technology stack, including integration points with the Cascade Platform's account-registration flow, the CMP, and the data-subject-request ("DSR") automation workflows.
• Priya Nandakumar, Vice President, Data & Analytics: Consulted regarding audience demographics for cascade.com and the Cascade mobile application, including available data on the age distribution of users and customers. Ms. Nandakumar confirmed that Cascade does not currently collect date of birth or age information from users at registration or at any other point in the user journey, and that audience demographic data is inferred through third-party data enrichment tools rather than directly collected.
• Jason Leclaire, Vice President, Marketing & Customer Engagement: Consulted regarding marketing campaigns, advertising content, and promotional strategies that are directed at or may be potentially attractive to minors. Mr. Leclaire confirmed that Cascade's marketing materials and advertising campaigns are targeted at adult consumers aged eighteen and older, and that Cascade does not knowingly place advertisements on platforms, channels, or media properties directed at children under thirteen.
6. Multi-State Privacy Law Applicability Matrix (June 30, 2025). Prepared by this firm as part of the broader compliance engagement, this matrix identifies the nineteen (19) state comprehensive privacy statutes currently applicable to Cascade based on its operational footprint, revenue, and data-processing volumes, and flags the specific provisions within each statute that impose heightened obligations with respect to the personal data of minors.
III. COPPA Analysis
A. Overview of COPPA Requirements
The Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and the implementing regulations promulgated by the Federal Trade Commission at 16 C.F.R. Part 312 (the "COPPA Rule"), establish a comprehensive framework governing the online collection, use, and disclosure of personal information from children under the age of thirteen. COPPA was originally enacted in 1998 and has been the subject of multiple rulemakings by the FTC, most recently the amendments finalized in January 2013 that expanded the definition of "personal information" and updated the mechanisms for obtaining verifiable parental consent.
COPPA applies to two categories of online operators:
(1) Operators of websites or online services "directed to children" under thirteen. A website or online service is "directed to children" if it is targeted to children as an audience, taking into account factors such as the subject matter, visual content, use of animated characters or child-oriented activities, music or other audio content, the age of models, the presence of child celebrities or celebrities who appeal to children, language or other characteristics of the website or online service, and whether advertising appearing on the site is directed to children. 16 C.F.R. § 312.2.
(2) Operators of general-audience websites or online services that have "actual knowledge" that they are collecting personal information from children under thirteen. The "actual knowledge" standard is narrower than a constructive-knowledge standard but has been interpreted with increasing breadth by the FTC in recent enforcement actions.
When COPPA is triggered, operators are subject to the following principal obligations:
• Verifiable Parental Consent ("VPC"). Before collecting, using, or disclosing personal information from a child under thirteen, the operator must obtain verifiable consent from the child's parent. The COPPA Rule identifies several acceptable methods of VPC, including signed consent forms, credit-card transactions, video-conference verification, and knowledge-based authentication.
• Direct Notice to Parents. The operator must provide direct notice to parents regarding the information collected, the purposes of collection, and the parent's rights.
• Privacy-Policy Disclosures. The operator must post a clear, prominent, and complete privacy policy describing its information practices with respect to children.
• Data Minimization. The operator may not condition a child's participation in a game, prize offer, or other activity on the child's disclosure of more personal information than is reasonably necessary to participate.
• Data Security. The operator must establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children.
• Data Deletion. Upon request from a parent, the operator must delete the child's personal information.
Enforcement of COPPA rests primarily with the FTC, which has brought dozens of enforcement actions against operators ranging from major social-media platforms to mobile-application developers. There is no private right of action under COPPA, but state attorneys general are authorized under 15 U.S.C. § 6504 to bring civil actions on behalf of their residents for violations of the COPPA Rule. In practice, the FTC has been the dominant enforcement body, and penalties for COPPA violations have been substantial — most notably the $170 million penalty against Calderon Corporation and Sterling Reach Corporation in 2019, the $520 million penalty against Brightmoor Enterprises in 2022, and the $275 million penalty against Fortnite-related practices.
B. "Directed to Children" Analysis — Cascade
Applying the FTC's multi-factor test for determining whether an online service is "directed to children" under thirteen, we conclude that the Cascade Platform is a general-audience online service and is not directed to children. The analysis of each relevant factor follows.
Subject matter. Cascade is an omnichannel retailer with fiscal year 2024 ("FY2024") revenue of approximately $3.87 billion, selling general consumer merchandise across a broad range of product categories. The principal categories offered on cascade.com and through the Cascade mobile application include home goods, electronics and consumer technology, apparel, footwear, beauty and personal care, kitchen and dining, and outdoor and sporting goods. While these categories have broad appeal, none of them is primarily targeted at children under thirteen. The merchandise is curated and marketed for adult consumers, and the pricing, product descriptions, and editorial content on the platform reflect an adult audience.
Visual content and design. The visual design of cascade.com and the Cascade mobile application employs a modern, minimalist aesthetic consistent with a general-audience retail platform. The platform does not feature animated characters, cartoon imagery, child-oriented themes, bright or juvenile color palettes, or other visual elements that would signal a child-directed service. Product photography, lifestyle imagery, and editorial content depict adult models in adult settings.
Child-oriented advertising. A review of Cascade's advertising materials, conducted in coordination with Jason Leclaire, VP of Marketing & Customer Engagement, confirmed that Cascade does not place child-directed advertising on cascade.com or the Cascade mobile application. Cascade's advertising campaigns across digital, print, and broadcast media are targeted at adults aged eighteen and older, and Cascade's media-buying strategy does not include placements on children's media properties or children's gaming platforms.
Language and other characteristics. The language used on cascade.com and the Cascade mobile application — including product descriptions, customer reviews, editorial content, and transactional messaging — is written for an adult audience. The platform does not employ simplified language, child-friendly navigation, or other characteristics suggestive of a child-directed service.
Cascade Rewards loyalty program. The Cascade Rewards loyalty program, which is deeply integrated into the cascade.com and mobile-app experience, requires all registrants to affirmatively represent that they are at least eighteen years of age. This age restriction, while implemented as a click-through acknowledgment rather than a verified age check, is consistent with an intent to serve an adult audience and supports the conclusion that the platform is not directed to children.
Third-party marketplace. Cascade Digital Marketplace LLC hosts approximately 3,800 third-party sellers on the cascade.com/marketplace subdomain. Some of these sellers may offer products that are designed for or marketed to children, including toys, children's apparel, children's books, and similar items. However, the marketplace itself is a general-audience platform that hosts sellers across all product categories, and the presence of some children's products among thousands of general-audience products does not transform the marketplace into a service "directed to children." The FTC has recognized that a general-audience platform does not become child-directed merely because some content or products on the platform may appeal to children. See FTC, Complying with COPPA: Frequently Asked Questions, FAQ D.2 (2020).
Conclusion. Based on the foregoing analysis, cascade.com and the Cascade mobile application are general-audience online services and are not "directed to children" under the age of thirteen within the meaning of COPPA and the COPPA Rule. Accordingly, Cascade is not subject to COPPA's full suite of obligations as an operator of a child-directed service.
C. "Actual Knowledge" Exposure
Because the Cascade Platform is a general-audience service, COPPA would be triggered only if Cascade obtains "actual knowledge" that it is collecting personal information from a child under thirteen. We assess the current risk of such actual knowledge as follows.
No date-of-birth collection. Cascade does not require date of birth, age, or any other age-identifying information at account registration, at checkout as a guest, or at any other point in the standard user journey on cascade.com or the Cascade mobile application. Consequently, Cascade has no systematic mechanism by which it would obtain actual knowledge that a particular user is under thirteen.
Cascade Rewards age representation. The Cascade Rewards loyalty-program registration flow requires the user to check a box affirming that they are at least eighteen years of age. While this click-through acknowledgment is not a robust age-verification mechanism, it serves as a contractual representation that the user is an adult and reduces the likelihood that a child under thirteen would complete the registration process for the loyalty program specifically. However, this representation applies only to the approximately 41.2 million loyalty-program members and does not apply to users who browse, search, or make purchases on cascade.com or the mobile app without creating a Cascade Rewards account.
Peakview Analytics data processing. Peakview Analytics processes approximately 2.1 billion consumer-event data records per month on behalf of Cascade for ad-targeting and personalization purposes. This processing is based on behavioral signals (page views, click events, purchase history, search queries) and does not include the collection or inference of user age. Peakview does not maintain age-demographic data as part of its standard data model for Cascade. Accordingly, Peakview's data processing does not, standing alone, create a pathway for the acquisition of actual knowledge regarding the age of users.
Residual risk of inadvertent actual knowledge. Despite the absence of systematic age-collection mechanisms, there remains a residual risk that Cascade could inadvertently obtain actual knowledge that a user is under thirteen. This could occur if, for example:
• A child provides their age in a free-text field, such as a customer-service live-chat interaction, a product review, a question submitted through the "Ask a Question" feature, or a response to a post-purchase survey;
• A parent contacts Cascade's customer-service team to request deletion of an account created by their child, thereby alerting Cascade to the child's age;
• A third-party data-enrichment tool or data broker inadvertently flags a user profile as belonging to a minor; or
• A social-media interaction, public complaint, or regulatory inquiry reveals that Cascade has collected data from a child under thirteen.
The FTC has taken increasingly expansive interpretations of the "actual knowledge" standard in recent enforcement actions. In particular, the FTC's enforcement actions against Penmark Holdings (Alexa) and Tidewater Systems Games (Fortnite) in 2022–2023 suggest that the Commission may look unfavorably upon operators that structure their data-collection practices to avoid acquiring age information when the operator has reason to believe that children are among its users. While the "actual knowledge" standard remains distinct from a constructive-knowledge or should-have-known standard, the practical distance between these standards is narrowing as the FTC signals a willingness to find actual knowledge in circumstances where an operator has received credible reports or indicators that children are using its service.
Given this evolving enforcement landscape, it is prudent for Cascade to implement prophylactic measures — specifically, an age-gate mechanism — to reduce the risk of inadvertently acquiring actual knowledge and to demonstrate good-faith efforts to prevent the collection of personal information from children under thirteen.
D. COPPA Compliance Recommendations
Based on the foregoing analysis, Cascade is not currently subject to COPPA's consent and notice requirements. We nonetheless recommend the following measures to maintain this posture and to mitigate the residual risk of inadvertent COPPA exposure:
1. Implement an age gate at account registration. Cascade should implement a neutral age-gate mechanism — such as a date-of-birth entry screen or an age-range selection question — at the point of account registration on cascade.com and the Cascade mobile application. The age gate should be presented prior to the collection of any personal information (including name, email address, and device identifiers) so that if a user indicates they are under thirteen, no personal information has yet been collected.
2. Implement age gates at secondary data-collection points. In addition to account registration, age-gate screens should be implemented at other points where personal information is collected from users who may not have registered accounts, including newsletter sign-up, product-review submission, "Ask a Question" features, and customer-service chat initiation.
3. Block collection from users under thirteen. If a user indicates through the age gate that they are under thirteen, the system should block account creation, suppress all personal-data collection (including cookies and tracking technologies), and present a clear, age-appropriate message explaining that the service is not available to users under thirteen. The system should not retain the age information entered by the user beyond the duration of the session; retaining such data could itself create COPPA obligations.
4. Integrate with consent-management platform. These age-gate mechanisms should be incorporated into the CMP being deployed by OnPoint Data Solutions Inc., in coordination with Fieldhaven Consulting Group LLC (Marcus Ellerby, engagement lead), to ensure that age-differentiated consent flows are managed consistently across the Cascade Platform. The target deployment date for the CMP is December 15, 2025, and the age-gate mechanism should be included in that deployment.
5. Train customer-service representatives. Cascade's customer-service team should be trained to recognize indicators that a user may be under thirteen (e.g., a caller who sounds like a young child, a chat user who states their age) and to follow escalation procedures that include immediately ceasing the collection of personal information and documenting the interaction for compliance review.
IV. California Age-Appropriate Design Code Act (AADC) Analysis
A. Overview of the AADC
The California Age-Appropriate Design Code Act, Assembly Bill 2273, was signed into law on September 15, 2022, and is codified at California Civil Code Sections 1798.99.28 through 1798.99.40. The AADC became effective on July 1, 2024, and enforcement by the California Attorney General is set to commence on July 1, 2025 — the date on which this memorandum is being finalized.
The AADC was modeled on the United Kingdom's Age Appropriate Design Code (also known as the Children's Code), which was adopted by the UK Information Commissioner's Office in 2020 and has driven significant changes in how major technology companies configure default privacy settings for minors. The California statute represents the first enactment of a comprehensive age-appropriate-design framework in the United States and has been closely watched by other state legislatures, several of which have enacted or are considering similar legislation.
Litigation history. The AADC was the subject of a legal challenge brought by Harborline Group, a technology-industry trade association, which argued that the statute violated the First Amendment by imposing content-based restrictions on speech and by requiring businesses to engage in age estimation that would chill the speech of adults. In Harborline Group v. Bonta, No. 5:22-cv-08861 (N.D. Cal.), the district court issued a preliminary injunction blocking enforcement of the AADC in September 2023. On appeal, the Ninth Circuit Court of Appeals partially vacated the preliminary injunction and remanded the case for further proceedings, holding that NetChoice had not demonstrated a likelihood of success on all of its claims and that several provisions of the AADC were likely to survive First Amendment scrutiny. As of the date of this memorandum, the AADC is expected to be enforceable, and the California Attorney General has publicly indicated an intent to begin enforcement. Given the current state of the litigation, Cascade should plan for full compliance with the AADC.
Scope of the AADC. The AADC applies to businesses that provide an "online service, product, or feature" that is "likely to be accessed by children" under the age of eighteen. Cal. Civ. Code § 1798.99.30(a). The statute defines "likely to be accessed by children" broadly, and provides that an online service is covered if it meets any of the following criteria:
(a) The online service is directed to children, as determined by the FTC's guidelines under COPPA;
(b) The online service is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children;
(c) The online service includes advertisements marketed to children;
(d) The online service is substantially similar to or the same as an online service described in subdivision (a) through (c);
(e) The online service has design elements that are known to be of interest to children, including but not limited to games, cartoons, music, and celebrities who appeal to children; or
(f) The online service is determined by any other substantial evidence to be likely to be accessed by children.
This multi-factor, disjunctive test sets a notably low threshold for applicability. A business need not operate a service that is "directed to" or "targeted at" children — it need only operate a service that is "likely to be accessed by" children based on any of the factors listed above. The California Attorney General's office has indicated in public statements and guidance that general-audience services with large user bases should generally assume they are subject to the AADC.
B. Applicability to Cascade
We conclude that the Cascade Platform — including cascade.com and the Cascade mobile application — is "likely to be accessed by children" under the AADC's broad standard, and that Cascade should treat itself as subject to the statute. The basis for this conclusion is as follows:
Scale of the platform. Cascade.com and the Cascade mobile application collectively facilitate approximately 94 million annual online transactions and serve approximately 41.2 million Cascade Rewards loyalty-program members. Given this scale, it is statistically near-certain that a meaningful number of users are under the age of eighteen. Even if the vast majority of Cascade's users are adults, the sheer volume of traffic makes it inevitable that children and adolescents access the platform — whether independently, in connection with family shopping, or through shared household devices.
Product categories attractive to minors. Although Cascade's product catalog is curated for a general audience, several product categories are likely to be of interest to minors under eighteen, including:
• Electronics and gaming accessories (gaming controllers, headsets, mobile-phone accessories, gaming chairs);
• Certain apparel categories (athleisure, graphic tees, sneakers, backpacks);
• Cosmetics and beauty products (which are increasingly popular among teenagers and pre-teens);
• Books, media, and entertainment products; and
• Toys and children's products offered by third-party sellers on the Cascade Marketplace.
The presence of these product categories increases the likelihood that children will access cascade.com and the Cascade mobile application, either directly or through shared devices.
In-store digital experiences. Cascade operates 186 retail locations across 31 states. These locations feature in-store digital kiosks that allow customers to browse the full cascade.com catalog, check product availability, and complete purchases. In addition, Cascade offers free Wi-Fi access in its stores, with a sign-in portal that collects a user's email address and requires acceptance of terms of use. Minors accompanying adult shoppers may use these in-store digital experiences, which are not currently subject to any age-gating mechanism.
Absence of age-gating. Because Cascade does not currently employ an age-gate mechanism on cascade.com or the mobile application (except for the age representation in the Cascade Rewards registration flow, which applies only to loyalty-program members), there is no barrier to children under eighteen accessing the full Cascade Platform and being subject to the same data-collection and tracking practices applied to adult users.
Conclusion. Based on the foregoing, the Cascade Platform is "likely to be accessed by children" under the AADC, and Cascade should plan for full compliance with the statute. This conclusion is consistent with the approach being taken by comparable large-scale e-commerce platforms, which have generally assumed applicability of the AADC given the breadth of the statutory standard.
C. Key AADC Obligations
The AADC imposes the following principal obligations on businesses that provide online services likely to be accessed by children. Each obligation is analyzed below with specific reference to its impact on Cascade's current practices.
1. Data Protection Impact Assessment (DPIA).
Under Section 1798.99.31(a), Cascade must complete a Data Protection Impact Assessment for any online service, product, or feature likely to be accessed by children before offering that service, or for existing services, within the compliance timeline established by the statute. The DPIA must identify, at a minimum:
(i) The purpose of the online service, product, or feature;
(ii) How the online service uses children's personal information, including whether it collects, sells, shares, or retains children's personal information;
(iii) The risk of material detriment to children that arises from the data management practices of the business;
(iv) Whether the design of the online service could lead to children experiencing harmful or potentially harmful contacts, conduct, or content;
(v) Whether algorithms used by the online service could harm children; and
(vi) Steps the business has taken or will take to mitigate the identified risks.
The DPIA must be maintained by the business and made available to the California Attorney General upon request. Failure to complete or maintain a DPIA is itself a violation of the AADC, independent of any substantive privacy violation.
Impact on Cascade: Calderwood & Harkness LLP is separately developing a Privacy Impact Assessment ("PIA") framework and template for Cascade, with a delivery target of October 2025. The PIA framework should be designed to incorporate the AADC's specific DPIA requirements so that a single assessment process satisfies both the general PIA obligations under applicable state privacy statutes and the AADC's child-specific DPIA requirements. We recommend completing an AADC-specific DPIA for cascade.com and the Cascade mobile application as a priority item, given that enforcement begins on July 1, 2025.
2. Privacy by Default for Children.
Under Section 1798.99.31(b)(1), Cascade must configure all default privacy settings to offer a "high level of privacy" to child users unless it can demonstrate a compelling reason that a different default setting is in the best interests of children. This obligation requires Cascade to evaluate and, where necessary, reconfigure the default settings for the twelve categories of cookies and tracking technologies identified in the Fieldhaven data-mapping report, as well as the default settings governing Peakview Analytics' behavioral-data processing and data sharing with third-party advertising partners.
Impact on Cascade: Currently, cascade.com deploys all twelve categories of cookies — including third-party advertising pixels, cross-device tracking identifiers, and behavioral analytics tags — by default for all users. The Cascade mobile application similarly collects device identifiers, precise geolocation data, and behavioral signals by default. For users identified or reasonably estimated to be under eighteen, these defaults would need to be reconfigured to disable non-essential tracking and data collection.
3. Prohibition on Profiling by Default.
Under Section 1798.99.31(b)(4), Cascade may not profile a child by default unless it can demonstrate a compelling reason that profiling is in the best interest of children. "Profiling" is defined under the AADC, consistent with the CCPA/CPRA definition, as any form of automated processing of personal information to evaluate certain personal aspects relating to a natural person, including analyzing or predicting aspects concerning that person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
Impact on Cascade: Peakview Analytics' processing of approximately 2.1 billion consumer-event data records per month for the purposes of ad targeting, audience segmentation, and content personalization constitutes "profiling" within the meaning of the AADC. This profiling must be disabled by default for users who are identified or reasonably estimated to be under eighteen. This is a significant operational requirement, as it will require changes to the data pipeline between Cascade and Peakview to enable the suppression of profiling for flagged user accounts.
4. Data Minimization.
Under Section 1798.99.31(b)(2), the collection of children's personal information must be limited to what is "reasonably necessary" to provide the online service requested by the child. Cascade may not collect personal information beyond what is necessary and must not retain children's personal information for longer than reasonably necessary to provide the requested service.
Impact on Cascade: This obligation requires a review of all data-collection touchpoints on the Cascade Platform to determine whether any personal information collected from users under eighteen exceeds what is reasonably necessary to provide the requested service (e.g., product browsing, purchase completion, customer-service interactions). In particular, the collection of behavioral data for advertising purposes — which is not necessary to provide the requested retail service — may need to be curtailed for minor users.
5. Age Estimation / Age-Appropriate Application.
Under Section 1798.99.35, Cascade must "estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business" or, alternatively, apply the AADC's protections to all users regardless of age. The statute does not prescribe a specific age-estimation methodology, and the California Attorney General's office has not yet issued regulations or guidance specifying what constitutes a "reasonable level of certainty." Possible age-estimation methods include:
• Neutral age screens (date-of-birth entry) at account registration or prior to data-intensive features;
• Self-declaration of age range;
• Age-inference technologies based on behavioral signals, typing patterns, or device characteristics;
• Third-party age-estimation services using facial analysis or document verification; and
• Application of AADC protections universally, without age estimation, as a compliance-by-default approach.
Impact on Cascade: We recommend a neutral age-screen approach (date-of-birth entry or age-range selection) as the most proportionate and defensible age-estimation mechanism for Cascade. This approach avoids the privacy and accuracy concerns associated with facial-analysis technologies and is consistent with the age-gating mechanisms employed by comparable e-commerce platforms. The alternative approach — applying AADC protections to all users — would effectively disable behavioral advertising and profiling for Cascade's entire user base and would have significant adverse commercial implications, including reduced advertising revenue and diminished personalization capabilities.
6. No Dark Patterns.
Under Section 1798.99.31(b)(6), Cascade may not use any "dark pattern" to lead or encourage children to provide personal information beyond what is reasonably necessary to provide the online service, to forego privacy protections, or to take any action that the child would not otherwise take. A "dark pattern" is defined as a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice.
Impact on Cascade: This obligation is particularly noteworthy in light of the FTC's 2023 Civil Investigative Demand (File No. 232-0147), which specifically addressed dark-pattern allegations in Cascade's mobile-app unsubscribe flow. Although that matter was closed without enforcement action, the CID demonstrates that Cascade's UI design practices have been the subject of regulatory scrutiny. The AADC's dark-pattern prohibition requires Cascade to review the UI/UX of all flows in which minors may be asked to provide personal information, consent to data processing, or make privacy-related decisions, including account creation, Cascade Rewards enrollment, newsletter sign-up, mobile-app permission prompts, and cookie-consent banners.
7. Prominent and Accessible Privacy Information.
Under Section 1798.99.31(b)(3), privacy information provided to children must be "concise, prominent, and using clear language suited to the age of children likely to access the online service." This requires Cascade to develop age-appropriate versions of its privacy disclosures — or, at minimum, to present its existing privacy disclosures in a manner that is accessible and comprehensible to minors.
Impact on Cascade: The forthcoming updated omnibus privacy policy (draft delivery target: September 12, 2025) should include a dedicated children's-privacy section, written in plain language accessible to minors, that describes Cascade's practices with respect to the personal information of users under eighteen.
8. Tools for Children to Exercise Privacy Rights.
Under Section 1798.99.31(b)(7), Cascade must provide "prominent, accessible, and responsive tools" that enable children to exercise their privacy rights and to report concerns about their privacy. These tools must be designed to be usable by children without adult assistance.
Impact on Cascade: Cascade's existing DSR portal (accessible via the "Privacy" link in the footer of cascade.com) and the mobile-app privacy settings should be reviewed to ensure they are accessible and usable by minors. This may require the development of a simplified privacy-rights interface for users identified as under eighteen.
D. Recommended AADC Compliance Measures
Based on the foregoing analysis, we recommend the following measures to establish compliance with the AADC:
1. Implement an age-estimation mechanism. Deploy a neutral age screen (date-of-birth entry or age-range selection) at account registration and prior to data-intensive features (personalized recommendations, ad targeting, product reviews, newsletter sign-up) on cascade.com and the Cascade mobile application. The age screen should be designed to avoid suggesting a "correct" answer (i.e., it should not indicate that selecting an age under eighteen will result in restricted access), consistent with the AADC's dark-pattern prohibition.
2. Configure privacy-by-default settings for minors. For users estimated to be under eighteen, configure default settings so that:
(a) Third-party tracking cookies and behavioral-advertising technologies are disabled by default;
(b) Peakview Analytics profiling, audience segmentation, and behavioral-data processing are turned off;
(c) Precise geolocation data collection via the Cascade mobile application is disabled, with only approximate location used for store-locator and delivery-estimation functionality;
(d) Data sharing with Thornbridge Media Corp. and the other forty-six third-party advertising and analytics partners is suppressed; and
(e) Push-notification permissions, contact-list access, and camera/microphone permissions on the mobile application are set to "off" by default.
3. Complete an AADC-specific DPIA. Prepare and finalize a Data Protection Impact Assessment for cascade.com and the Cascade mobile application addressing each of the elements required under Section 1798.99.31(a). Integrate the AADC DPIA requirements into the broader PIA framework and template being developed by Calderwood & Harkness LLP for delivery in October 2025.
4. Review UI/UX for dark-pattern risks. Engage a UX-review process to evaluate the account-creation flow, Cascade Rewards enrollment, newsletter sign-up, mobile-app permission prompts, and cookie-consent interfaces for dark patterns that could lead or encourage minors to provide personal information, forgo privacy protections, or take actions they would not otherwise take. This review should be informed by the lessons learned from the FTC CID (File No. 232-0147) and should be documented for regulatory-defense purposes.
5. Develop age-appropriate privacy disclosures. Prepare a children's-privacy section for the updated omnibus privacy policy that is written in clear, age-appropriate language and that describes Cascade's practices with respect to the personal information of users under eighteen.
6. Coordinate technical implementation. Work with Fieldhaven Consulting Group LLC (Marcus Ellerby, engagement lead) and OnPoint Data Solutions Inc. to implement age-gate technical controls as part of the CMP deployment, with a target date of December 15, 2025. The technical implementation should include integration with Peakview Analytics' data pipeline to enable the suppression of profiling and data sharing for minor users, as well as integration with the DSR-automation workflows to enable the processing of deletion requests from minors or their parents.
V. Other State Age-Related Privacy Laws
A. Survey of Emerging State Requirements
In addition to COPPA and the California AADC, Cascade is subject to a growing patchwork of state comprehensive privacy statutes that impose heightened protections for the personal data of minors. The Multi-State Privacy Law Applicability Matrix prepared on June 30, 2025 identifies nineteen (19) state comprehensive privacy statutes currently applicable to Cascade based on its operational footprint, revenue thresholds, and data-processing volumes. Many of these statutes include specific provisions addressing the personal information of consumers known to be under certain age thresholds. The most significant of these provisions are summarized below.
California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA). The CCPA, as amended by the CPRA and implementing regulations, requires businesses to obtain affirmative opt-in consent before the "sale" or "sharing" of the personal information of consumers known to be under sixteen years of age. Cal. Civ. Code § 1798.120(c). For consumers known to be under thirteen, consent must be provided by the consumer's parent or guardian. Cascade's current "Do Not Sell or Share My Personal Information" flow, accessible via a link in the footer of cascade.com and within the Cascade mobile application's privacy settings, provides an opt-out mechanism for adult consumers but does not include an opt-in consent mechanism for known minors. This has been identified as a compliance gap. Without an age-gating mechanism that identifies users who are under sixteen, Cascade has no basis on which to apply the opt-in consent requirement; however, if Cascade implements an age gate and identifies users as under sixteen, it must then implement an opt-in consent flow before selling or sharing those users' personal information.
Connecticut Data Privacy Act (CTDPA). The CTDPA, effective July 1, 2023, prohibits the sale of personal data of consumers known to be between thirteen and fifteen years of age without the consumer's consent. Conn. Gen. Stat. § 42-520(b). The CTDPA also prohibits the processing of personal data of consumers known to be under sixteen for the purpose of targeted advertising without the consumer's consent. Cascade operates retail locations in Connecticut and processes personal data of Connecticut residents, making these provisions applicable.
Colorado Privacy Act (CPA). The Colorado Privacy Act, as amended, includes provisions requiring controllers to obtain consent before processing the personal data of known children between thirteen and seventeen years of age for targeted advertising or sale. Colo. Rev. Stat. § 6-1-1308(7). Colorado's provisions are notable for extending the consent requirement to consumers up to the age of seventeen, rather than limiting it to those under sixteen.
Virginia Consumer Data Protection Act (VCDPA). The VCDPA requires controllers to obtain parental consent before processing the personal data of known children under thirteen, consistent with COPPA. Va. Code Ann. § 59.1-578(A)(5). In addition, the VCDPA requires opt-in consent before the sale of personal data or the processing for targeted advertising of personal data of consumers known to be between thirteen and fifteen years of age.
Texas Data Privacy and Security Act (TDPSA). The TDPSA, effective July 1, 2024, includes broad provisions requiring controllers to obtain opt-in consent before the sale of personal data of consumers known to be under eighteen years of age. Tex. Bus. & Com. Code § 541.101(b)(4). Texas's approach is notably more protective than most other states, as it extends the consent requirement to all consumers under eighteen rather than only those under sixteen.
Oregon Consumer Privacy Act (OCPA). The OCPA prohibits the sale of personal data of consumers known to be between thirteen and fifteen years of age without the consumer's affirmative consent. Or. Rev. Stat. § 646A.576. The OCPA also prohibits the processing of such data for targeted advertising without consent.
Maryland Online Data Privacy Act (MODPA). Maryland's recently enacted privacy statute includes particularly broad restrictions on the processing of personal data of consumers under eighteen for targeted advertising. The MODPA's prohibition is not limited to consumers "known" to be under eighteen but extends to circumstances where the controller "should have known" the consumer's age — an approach that diverges from the actual-knowledge standard used in most other states and that may impose a heightened obligation on Cascade to determine the age of its users.
Other states. Additional states with minor-specific provisions include, among others, Utah, Montana, Indiana, Iowa, Tennessee, Florida, and New Hampshire. The specific requirements of each state are detailed in the Multi-State Privacy Law Applicability Matrix (June 30, 2025), which should be consulted for the full landscape of obligations. The landscape is evolving rapidly; additional states may enact or strengthen minor-data protections in the 2025 and 2026 legislative sessions.
B. Common Themes and Recommendations
Across the nineteen applicable state statutes, several common themes emerge:
Trend toward opt-in consent for minors. There is a clear and accelerating trend toward requiring affirmative opt-in consent before selling, sharing, or processing for targeted advertising the personal data of consumers known to be under sixteen, and in some states (notably Texas and Maryland) under eighteen. This trend is directionally consistent with the AADC's approach and reflects a bipartisan consensus that minors' data requires heightened protection.
Age thresholds vary by state. The specific age thresholds and consent requirements vary by state: some statutes apply heightened protections to consumers under thirteen (consistent with COPPA), others to consumers under sixteen, and still others to consumers under eighteen. This patchwork creates compliance complexity and argues in favor of a unified, graduated approach.
"Known" vs. "should have known" standards. Most state statutes apply their minor-data protections only to consumers "known" to be under the applicable age threshold, which is consistent with the actual-knowledge standard under COPPA. However, Maryland's "should have known" standard and the AADC's "likely to be accessed by children" standard may require Cascade to take proactive steps to determine user age, rather than relying on the absence of age information.
Unified age-gate recommendation. To address the requirements of COPPA, the AADC, the CCPA/CPRA, and the other applicable state statutes in a coordinated and efficient manner, we recommend implementing a single age-gate mechanism that captures age at account registration and at other data-collection touchpoints, and that applies graduated protections based on the user's indicated age:
• Under 13: Block account creation and personal-data collection entirely. Do not retain age information beyond the session. This approach prevents the acquisition of COPPA "actual knowledge" and satisfies the heightened protections required by COPPA, the VCDPA, and other statutes.
• Ages 13–15: Permit account creation and basic service use, but require affirmative opt-in consent before the sale, sharing, or processing for targeted advertising of the user's personal information, consistent with the CCPA/CPRA, CTDPA, CPA, VCDPA, OCPA, and similar statutes.
• Ages 16–17: Apply AADC heightened default privacy settings, including profiling off by default, tracking cookies disabled by default, and data sharing with advertising partners suppressed by default. In states with consent requirements extending to consumers under eighteen (e.g., Texas, Maryland), require opt-in consent for sale and targeted advertising.
• 18 and older: Apply standard consent and opt-out flows consistent with the applicable state privacy statutes.
Neutral design. The age-gate must be designed as a "neutral" age screen that does not suggest or imply a "correct" answer, does not incentivize the user to select a particular age, and does not penalize the user for selecting an age under eighteen (other than by applying the required privacy protections). A date-of-birth entry field is generally preferable to an age-range dropdown or a simple "Are you over 18?" yes/no question, as it is more difficult for a minor to circumvent and is less likely to be characterized as a dark pattern.
VI. Impact on Cascade Data Practices and Third-Party Relationships
The implementation of age-gating mechanisms and graduated privacy protections for minors will have significant operational implications for Cascade's data practices and its relationships with key third-party service providers and business partners. This section addresses the most significant impacts.
A. Peakview Analytics Inc.
Peakview Analytics processes approximately 2.1 billion consumer-event data records per month on behalf of Cascade for the purposes of ad targeting, audience segmentation, behavioral analytics, and content personalization. Under the AADC and analogous state statutes, if an age gate identifies a user as under eighteen, Peakview must suppress profiling, behavioral advertising, and the sharing of that user's data with third parties for advertising purposes.
This requirement will necessitate modifications to the data pipeline between Cascade and Peakview, including:
• The creation of an "age flag" or "minor user" designation within Cascade's user-account database that is passed to Peakview at the point of data ingestion;
• Configuration of Peakview's processing logic to suppress profiling, behavioral-advertising signals, and data-sharing workflows for records associated with flagged user accounts;
• Suppression of audience-segment inclusion for flagged users, so that these users are not included in behavioral segments shared with third-party advertising partners; and
• Logging and audit-trail mechanisms to demonstrate compliance with suppression requirements.
Coordination with Priya Nandakumar (VP, Data & Analytics) will be required to define the technical specifications for these modifications and to establish a project timeline aligned with the CMP deployment target of December 15, 2025.
B. Thornbridge Media Corp. and Other Advertising Partners
Cascade shares consumer behavioral data with forty-seven (47) third-party advertising and analytics partners, including Thornbridge Media Corp. ("Thornbridge"), which is Cascade's largest advertising partner by spend (FY2024 advertising expenditure: $18.4 million). The data shared with these partners includes behavioral signals, device identifiers, and audience-segment membership derived from Peakview's profiling activities.
Under the AADC and applicable state statutes, Cascade must suppress the sharing of personal data of users identified as under eighteen (or under sixteen, for CCPA opt-in purposes) with these third-party partners. This has two principal implications:
Contractual provisions. The restructured data-sharing agreement with Thornbridge Media Corp. — currently under negotiation with Victor Sandoval of Kellner Park & Associates LLP, with a target execution date of October 31, 2025 — should include provisions that:
(i) Prohibit Thornbridge from receiving, processing, or using data of users identified by Cascade as under eighteen (or under sixteen, as applicable);
(ii) Require Thornbridge to promptly delete or suppress any data received for users subsequently identified as under the applicable age threshold;
(iii) Include representations and warranties by Thornbridge regarding compliance with COPPA, the AADC, and applicable state children's-data requirements; and
(iv) Provide Cascade with audit rights to verify Thornbridge's compliance with these provisions.
Vendor DPA templates. The third-party vendor data processing agreement ("DPA") templates — both the service-provider template and the contractor template — currently under development as part of the broader compliance engagement should include standard representations regarding compliance with children's-data restrictions. These representations should be incorporated into the DPA rollout to the twenty-three (23) of the forty-seven advertising and analytics partners that currently lack executed DPAs with Cascade. The DPA rollout is being coordinated by this firm and Fieldhaven Consulting Group LLC.
C. Cascade Digital Marketplace LLC
The third-party marketplace operated by Cascade Digital Marketplace LLC at cascade.com/marketplace hosts approximately 3,800 third-party sellers. Some of these sellers offer products designed for or marketed to children, including toys, children's apparel, children's books, and children's educational materials. While the marketplace itself is a general-audience platform, the presence of children's products raises the possibility that children may interact directly with marketplace features — such as product reviews, "Ask a Question" tools, or seller-operated chat functions — that could result in the collection of personal information from minors.
Marketplace Seller Data-Use Terms. The Marketplace Seller Data-Use Terms should be updated to require third-party sellers to:
(i) Comply with COPPA, the AADC, and applicable state children's-data requirements if they collect personal information directly from minors through marketplace features;
(ii) Refrain from knowingly collecting personal information from children under thirteen without verifiable parental consent;
(iii) Represent and warrant that their product listings, marketing materials, and data-collection practices comply with all applicable children's-privacy laws; and
(iv) Indemnify Cascade for any claims, fines, or penalties arising from the seller's failure to comply with children's-privacy laws.
Data commingling issue. The gap analysis conducted as part of the broader compliance engagement identified a significant data-governance concern (designated as Gap #3): marketplace seller data is currently commingled with first-party customer data in a single data lake without adequate role-based access controls or data-segregation mechanisms. This commingling exacerbates the children's-data risk, because personal information that a child might provide to a third-party seller through a marketplace feature could be mixed with Cascade's first-party customer data and processed by Peakview or shared with advertising partners without appropriate safeguards. Resolution of Gap #3 — which involves implementing data-segregation controls and role-based access mechanisms within the data lake — is directly relevant to the children's-privacy compliance program and should be prioritized accordingly.
D. Cascade Rewards Corp.
The Cascade Rewards loyalty program, operated by Cascade Rewards Corp., has approximately 41.2 million registered members. The program's registration flow requires users to affirmatively represent that they are at least eighteen years of age. This contractual age restriction serves as a meaningful mitigant against AADC and state-law exposure with respect to loyalty-program data specifically, because it provides a basis for Cascade to treat all loyalty-program members as adults for purposes of applying privacy protections.