PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
MEMORANDUM
June 20, 2025
PRIVILEGE LEGEND: This memorandum constitutes attorney work product prepared in anticipation of litigation and in connection with the provision of legal advice to Cascade Retail Holdings Inc. It is protected by the attorney-client privilege and the work-product doctrine. This memorandum reflects the mental impressions, conclusions, opinions, and legal theories of counsel. It is intended solely for the use of the addressees identified above and authorized personnel within Calderwood & Harkness LLP. Do not distribute, copy, or forward this memorandum in whole or in part without the prior written approval of the responsible partner, Kevin Ostrowski.
I. Purpose and Scope of Memorandum
This memorandum provides a comprehensive summary of Cascade Retail Holdings Inc.'s ("Cascade" or the "Company") two prior regulatory interactions with (1) the Federal Trade Commission (the "FTC") and (2) the Office of the California Attorney General (the "California AG"), and analyzes the implications of those interactions for the design and implementation of the comprehensive US state-privacy compliance program currently being developed by Calderwood & Harkness LLP for the Company.
Calderwood & Harkness LLP was formally engaged by Cascade on June 2, 2025, pursuant to an executed engagement letter of the same date, to design and implement a comprehensive US state-privacy compliance program covering the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and eighteen additional state privacy statutes, for a total of nineteen applicable state privacy statutes currently in effect or scheduled to take effect within the program's implementation horizon. The scope of the engagement encompasses policy development, vendor and data-sharing agreement restructuring, consent-management platform deployment, data-subject-request workflow design, governance framework development, and employee training, organized across a phased implementation timeline with a Phase 1 completion target of December 31, 2025.
This memorandum is being prepared concurrently with Calderwood & Harkness's broader gap analysis, which is targeted for delivery to the Company on August 15, 2025. In preparing this memorandum, I have drawn upon the following primary sources:
(a) The data-mapping report dated May 19, 2025, prepared by Fieldhaven Consulting Group LLC ("Fieldhaven"), which catalogues Cascade's data-collection practices, data flows, third-party data-sharing arrangements, and identified compliance gaps across applicable state privacy statutes;
(b) Materials provided by Cascade's General Counsel, Meredith Tanaka, including internal correspondence, regulatory response files, vendor agreements, and corporate records relating to the FTC and California AG matters;
(c) Materials provided by Cascade's Associate General Counsel, Diana Polk, who currently serves as interim Chief Privacy Officer ("CPO"), including the Company's current online privacy policy, consumer data-subject-request logs, and internal policy documents; and
(d) Publicly available regulatory guidance, enforcement actions, and policy statements from the FTC and the California AG's office relevant to the issues discussed herein.
As background, Cascade Retail Holdings Inc. is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol CSRD, with its principal executive offices located at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119. For the fiscal year ended January 31, 2025 ("FY2024"), Cascade reported consolidated revenues of approximately $3.87 billion. The Company employs approximately 22,500 individuals across 186 retail store locations in 31 US states, in addition to three e-commerce fulfillment centers located in Reno, Nevada; Columbus, Ohio; and Greer, South Carolina. Cascade operates a consumer loyalty program branded "Cascade Rewards," which, as of the date of this memorandum, has approximately 41.2 million registered members. Cascade's e-commerce platform, accessible at cascade.com and through the Cascade mobile application (available on iOS and Android), processed approximately 94 million online transactions during FY2024. These operational characteristics — including the scale of consumer data collection, the geographic footprint spanning 31 states, the breadth of the loyalty program, and the volume of e-commerce transactions — are directly relevant to the scope and complexity of the compliance program under development and inform the regulatory risk analysis set forth below.
II. Summary of FTC Civil Investigative Demand (File No. 232-0147)
A. Background and Timeline
On September 14, 2023, Cascade received a Civil Investigative Demand ("CID") from the Federal Trade Commission, assigned File No. 232-0147. The CID was personally served on Cascade's registered agent in the State of Delaware, Pemberton Industries, and a copy was simultaneously transmitted via certified mail to Meredith Tanaka at Cascade's Seattle headquarters.
The CID was issued in connection with an FTC investigation into alleged "dark pattern" practices in Cascade's mobile application (the "Cascade App"), specifically the user-interface flow used by consumers attempting to opt out of marketing communications and promotional notifications. The investigation appears to have been initiated following a series of consumer complaints submitted to the FTC's Consumer Sentinel Network database during the period of approximately March 2023 through August 2023. Based on our review of the complaint data referenced in the CID, the FTC received at least 247 consumer complaints during this period alleging that the Cascade App made it difficult, confusing, or effectively impossible to unsubscribe from promotional push notifications and marketing emails.
The CID contained two categories of compulsory process requests:
(i) Document Requests: The CID identified fourteen categories of documents to be produced, including internal design documents, product-management memoranda, user-experience ("UX") wireframes, A/B testing reports, user-flow analytics, consumer complaint logs, customer-service call transcripts and chat logs relating to unsubscribe requests, and communications between Cascade's product-development team and its third-party mobile-application development vendor (Ridgeview Digital LLC). The document requests called for production of all responsive materials created or maintained during the period from January 1, 2021, through the date of the CID.
(ii) Interrogatories: The CID included eight interrogatories requiring Cascade to provide written responses describing the design and implementation process for the unsubscribe flow, the number of consumer complaints received, the metrics used to evaluate user engagement with the unsubscribe flow, and the identities of all individuals involved in the design and approval of the relevant user-interface elements.
The CID set a compliance deadline of thirty calendar days from service, i.e., October 14, 2023, subject to the standard provisions for requesting an extension.
B. Substance of the FTC's Concerns
The FTC's inquiry focused on allegations that Cascade's mobile-app interface employed deceptive design practices — commonly referred to in regulatory parlance as "dark patterns" — that made it unreasonably difficult for consumers to unsubscribe from marketing communications. The FTC's concerns, as articulated in the CID's accompanying specifications and as further elaborated in telephone conferences between FTC staff attorneys and Cascade's legal team, centered on the following specific design elements:
Multi-Step Unsubscribe Process. The Cascade App's unsubscribe flow required consumers to navigate through a minimum of five sequential screens before successfully opting out of promotional communications. Each screen presented intermediate options (e.g., "Reduce Frequency," "Pause for 30 Days," "Customize Preferences") that did not effectuate a complete opt-out, and the final "Unsubscribe" option was positioned as the last item on a scrollable list on the fifth screen.
Confusing User-Interface Elements. The FTC identified specific UI design choices that it characterized as deceptive or manipulative. Most notably, on the third screen of the unsubscribe flow, a button labeled "Confirm" did not confirm the user's intent to unsubscribe but instead re-subscribed the user to the full suite of marketing communications. The actual opt-out action was associated with a smaller, less visually prominent link displayed in gray text below the "Confirm" button. FTC staff characterized this design as a "confirmshaming" dark pattern intended to trick consumers into reversing their opt-out selection.
Absence of a Single-Click Opt-Out. The FTC noted that the Cascade App did not provide a straightforward, single-click mechanism for consumers to opt out of all marketing communications, notwithstanding the availability of such a mechanism in Cascade's email marketing messages (which included a standard one-click unsubscribe link in the email footer pursuant to the CAN-SPAM Act).
The investigation was conducted under the FTC's general authority to investigate unfair or deceptive acts or practices in or affecting commerce under Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a). The CID did not reference any specific rule or regulation beyond Section 5 and the FTC's general investigatory authority under 15 U.S.C. § 57b-1. However, the FTC's inquiry was consistent with the Commission's published enforcement policy statement on negative-option marketing and its September 2022 report, Bringing Dark Patterns to Light, which outlined the Commission's views on deceptive design practices in digital interfaces.
C. Cascade's Response and Voluntary Remediation
Cascade, through its internal legal team led by General Counsel Meredith Tanaka, cooperated fully with the FTC's CID. Cascade obtained a single thirty-day extension of the compliance deadline, extending the initial response date to November 13, 2023, and submitted a substantive response on November 10, 2023. The response included production of approximately 14,500 pages of responsive documents and narrative answers to all eight interrogatories. No privilege log disputes arose during the production, and no motions to quash or limit the CID were filed.
During the course of the investigation, and following an initial substantive meeting with FTC staff attorneys on December 7, 2023, Cascade made voluntary remedial changes to the mobile-app unsubscribe flow. These changes were designed and implemented by Cascade's internal product-development team in coordination with Ridgeview Digital LLC and were deployed to production on January 22, 2024, in version 7.4.1 of the Cascade App. The key remedial changes included:
(a) Simplified Opt-Out Flow: The five-screen unsubscribe process was replaced with a two-screen flow. On the first screen, consumers are presented with a clear and prominently displayed "Unsubscribe from All Marketing" button. On the second screen, consumers confirm their selection via a single "Confirm Unsubscribe" button. No intermediate options (e.g., "Reduce Frequency" or "Pause") are presented prior to the opt-out confirmation.
(b) Elimination of Confusing UI Elements: The misleading "Confirm" button that re-subscribed users was removed. All button labels and link text were revised to clearly and accurately describe the action associated with each interactive element.
(c) Persistent "Manage Preferences" Link: A "Manage Preferences" link was added to the Cascade App's main settings menu, providing consumers with persistent, direct access to their communication-preference settings without requiring navigation through intermediate screens.
(d) Unsubscribe Confirmation: Upon successful opt-out, consumers receive an in-app confirmation message and a confirmation email within five minutes, explicitly stating that they have been unsubscribed from all marketing communications and providing a link to re-subscribe if desired.
Cascade communicated these remedial changes to FTC staff in a letter dated February 5, 2024, accompanied by screenshots and a demonstration video of the revised user-interface flow.
D. Resolution.  On April 3, 2024, the Federal Trade Commission issued a closing letter to Cascade advising that the Commission had concluded its investigation and had determined not to recommend any enforcement action at that time. The closing letter was addressed to Meredith Tanaka and was signed by Margaret D. Calloway, Assistant Director, Division of Advertising Practices, Bureau of Consumer Protection.
No consent decree, consent order, or settlement agreement was entered in connection with the investigation. No monetary penalty, civil fine, or disgorgement was assessed. The FTC did not require Cascade to submit to any ongoing monitoring, reporting, or compliance-verification obligations.
Importantly, the closing letter included the following standard qualification: the decision not to pursue enforcement was based on the specific facts and circumstances presented and did not constitute a formal determination that Cascade's practices complied with the law. The letter further stated that the FTC reserved the right to reopen its investigation or take other action as the public interest may warrant. This qualification is standard in FTC closing letters but is nevertheless significant in the context of assessing Cascade's ongoing regulatory risk, as discussed further in Section V below.
E. Records and Documentation
All CID correspondence, production logs, interrogatory responses, internal response memoranda, attorney-client communications relating to the FTC investigation, and copies of the voluntary remediation materials are maintained by Cascade's legal department under the supervision of Meredith Tanaka. These materials are organized in a dedicated matter file within Cascade's document-management system (Tidewater Systems) under the internal matter designation CRH-REG-2023-001.
Calderwood & Harkness has reviewed the relevant files as part of the current engagement, including the CID itself, Cascade's November 10, 2023 response, the February 5, 2024 remediation letter, and the April 3, 2024 closing letter. Our review also encompassed internal product-development documents relating to the design of the original unsubscribe flow and the subsequent remedial redesign, as well as the consumer complaint data referenced in the CID.
III. Summary of California Attorney General Informal Inquiry
A. Background and Timeline
On February 6, 2024, the Office of the California Attorney General sent an informal inquiry letter to Cascade requesting information about Cascade's practices regarding the sale and sharing of consumer personal information and the associated disclosures made to California consumers. The letter was addressed to Meredith Tanaka and was signed by James A. Nguyen, Deputy Attorney General, Privacy Enforcement and Protection Unit, California Department of Justice.
The inquiry did not take the form of a formal investigative subpoena or Civil Investigative Demand. It was not issued pursuant to the AG's formal investigative authority under California Civil Code § 1798.199.60 or California Government Code § 11181. Rather, the inquiry was characterized in its introductory paragraph as "a request for voluntary information" made in connection with the AG's "ongoing efforts to ensure compliance with the California Consumer Privacy Act, as amended by the California Privacy Rights Act." The letter stated that the AG's office was conducting a review of the privacy practices of "major retail companies operating in California" and invited Cascade to provide responsive information on a voluntary basis.
Despite the informal and voluntary nature of the inquiry, the letter signaled that failure to respond could prompt the AG to pursue formal investigative process. Specifically, the letter stated that the AG's office "reserves the right to utilize formal investigative tools, including investigative subpoenas, should voluntary cooperation not be forthcoming." This language, while not unusual in AG inquiry letters, underscored the seriousness with which the AG's office approached the matter.
The letter requested that Cascade provide its response within thirty calendar days, i.e., by March 8, 2024.
B. Substance of the AG's Concerns
The California AG's inquiry focused on two principal areas, each of which was described in a separate numbered section of the inquiry letter:
1. "Do Not Sell or Share My Personal Information" Link. The AG questioned whether Cascade's website (cascade.com) provided a conspicuous and functional "Do Not Sell or Share My Personal Information" link as required by California Civil Code § 1798.120(a) and the implementing regulations promulgated by the California Privacy Protection Agency ("CPPA") at 11 CCR § 7025. Specifically, the AG's inquiry posed the following questions:
(a) Whether the "Do Not Sell or Share" link was displayed on every page of cascade.com in a manner that was "clear and conspicuous" to a reasonable consumer;
(b) Whether, upon a consumer's exercise of the opt-out right through the link, Cascade effectively ceased the sale and sharing of that consumer's personal information with all third-party advertising and analytics partners;
(c) Whether Cascade honored Global Privacy Control ("GPC") browser signals as a valid opt-out request, as required by 11 CCR § 7025(c); and
(d) The average time between a consumer's submission of an opt-out request and the cessation of the sale or sharing of that consumer's personal information.
2. Service-Provider and Contractor Agreements. The AG requested information regarding Cascade's contractual arrangements with third-party vendors and advertising partners, specifically whether those agreements contained the contractual provisions required under CCPA/CPRA to qualify the data recipients as "service providers" (Cal. Civ. Code § 1798.140(ag)) or "contractors" (Cal. Civ. Code § 1798.140(j)), as opposed to "third parties" (Cal. Civ. Code § 1798.140(ai)) to whom personal information is "sold" (Cal. Civ. Code § 1798.140(ad)) or "shared" (Cal. Civ. Code § 1798.140(ah)). The AG specifically requested:
(a) A list of all third-party entities with which Cascade shared California consumers' personal information during calendar year 2023;
(b) A description of the categories of personal information shared with each such entity;
(c) Copies of representative contractual agreements governing each such data-sharing arrangement; and
(d) An explanation of Cascade's process for determining whether each data recipient was classified as a "service provider," "contractor," or "third party" under CCPA/CPRA.
C. Cascade's Response
Cascade responded to the California AG's inquiry on March 8, 2024, the final day of the thirty-day response period. The response was transmitted via certified mail and email to Deputy Attorney General Nguyen and consisted of a ten-page narrative letter, accompanied by the following exhibits:
(a) Cascade's then-current online privacy policy (the version published on cascade.com, last updated March 2022);
(b) A list of 42 third-party entities with which Cascade had shared California consumers' personal information during calendar year 2023 (the Company later identified five additional entities, bringing the total to 47 as of the Fieldhaven data-mapping report);
(c) Sample vendor agreements (three agreements were provided as representative examples); and
(d) A narrative description of Cascade's privacy practices, including the placement and functionality of the "Do Not Sell or Share" link on cascade.com and a description of the Company's process for classifying data recipients.
The response was prepared under the supervision of Meredith Tanaka and Diana Polk, with input from Cascade's e-commerce technology team regarding the technical implementation of the "Do Not Sell or Share" link. At the time of the response, Cascade did not retain outside privacy counsel; the response was prepared entirely by in-house legal staff.
Based on our review of the response letter, I note the following observations regarding the substance of Cascade's response. First, the narrative description of the "Do Not Sell or Share" link acknowledged that the link was implemented as a toggle on a dedicated privacy-preference page accessible from the website footer but did not address whether the toggle effectively ceased all sharing of personal information with third-party partners. Second, the response did not address GPC signal honoring, despite the AG's specific question on this point. Third, the three sample vendor agreements provided as exhibits did not contain the contractual provisions required under CCPA/CPRA for service-provider or contractor classification — specifically, they lacked contractual prohibitions on selling or sharing personal information received from Cascade, contractual restrictions on use of personal information beyond the business purposes specified in the agreement, and certification and audit-right provisions. The response did not acknowledge these deficiencies.
D. Resolution.  No formal enforcement action was taken by the California AG following Cascade's March 8, 2024 response. The AG's office did not issue a notice of violation, file a complaint, or initiate a formal enforcement proceeding against Cascade in connection with the inquiry.
However, unlike the FTC matter, the AG's inquiry did not result in a formal clearance letter, closing determination, or any written communication from the AG's office indicating that the matter had been resolved or closed. Following Cascade's March 8, 2024 response, the AG's office did not communicate any further correspondence to Cascade — neither to request additional information nor to indicate satisfaction with Cascade's response. As of the date of this memorandum, more than fifteen months have elapsed since Cascade's response, and the matter remains in an indeterminate status.
The absence of a formal closure is significant for two reasons. First, the AG retains the authority to reopen or formalize the inquiry at any time, including by issuing a formal investigative subpoena. Second, and more importantly for purposes of the current engagement, the substantive deficiencies highlighted by the AG's inquiry — specifically regarding the "Do Not Sell or Share" link functionality, the failure to honor GPC signals, and the inadequacy of service-provider and contractor agreements — remain substantially unremediated as of the opening of the current engagement on June 2, 2025. As detailed in Section IV below, these deficiencies have been independently confirmed by the Fieldhaven data-mapping report and are among the highest-priority items in the compliance program under development.
IV. Current Status of Deficiencies Identified in Regulatory Interactions
This section provides a detailed assessment of the current status of the specific compliance deficiencies highlighted by the FTC and California AG interactions, as informed by Calderwood & Harkness's preliminary review and the Fieldhaven data-mapping report.
A. Deficiencies Highlighted by the FTC Inquiry
Dark-Pattern Remediation — Mobile App. As described in Section II.C above, Cascade implemented voluntary changes to its mobile-app unsubscribe flow during the FTC investigation. Based on our review of the remediated user-interface flow in Cascade App version 7.4.1 (and subsequent versions through the current version 8.2.0), those changes appear to have addressed the specific concerns raised in the CID with respect to the marketing-communication opt-out process. The current unsubscribe flow is straightforward, provides clear labeling, and does not employ the deceptive design elements identified by the FTC.
However, the scope of the FTC's inquiry was limited to the marketing-communication unsubscribe flow. Calderwood & Harkness will evaluate whether additional dark-pattern risks exist in the mobile app and website user interfaces more broadly as part of the compliance program. In particular, we intend to scrutinize the following consumer-facing interfaces for dark-pattern risks:
(a) Opt-out-of-sale/sharing flows: The process by which consumers exercise their CCPA/CPRA right to opt out of the sale or sharing of their personal information, including both the website-based "Do Not Sell or Share" mechanism and any equivalent functionality in the Cascade App;
(b) Cookie-consent mechanisms: The consent-management platform currently under development (to be deployed via the OnPoint Data Solutions Inc. CMP) and any interim cookie-consent banners or disclosures currently in use on cascade.com;
(c) Data-subject-request ("DSR") submission processes: The consumer-facing portal through which individuals submit access, deletion, correction, and opt-out requests, including the identity-verification flow and the request-confirmation process;
(d) Loyalty-program enrollment and account-creation flows: The Cascade Rewards enrollment interface, which collects personal information including name, email address, phone number, date of birth, and, optionally, precise geolocation data and shopping preferences; and
(e) Privacy-policy presentation: The manner in which the privacy policy is presented to consumers, including font size, readability, use of layered disclosures, and the prominence of key disclosures regarding data sales, sharing, and consumer rights.
The FTC's continued and intensifying focus on dark patterns across the digital economy heightens the importance of this review. The Commission has brought multiple enforcement actions against companies employing dark patterns in subscription cancellation flows, privacy-consent interfaces, and account-deletion processes, including recent consent orders entered in 2024. The FTC's proposed rulemaking on negative-option marketing and its updated enforcement policy statements signal that the Commission views dark-pattern enforcement as a strategic priority. Any new opt-out mechanisms, consent flows, or DSR interfaces deployed as part of Cascade's compliance program must be designed and rigorously tested to ensure they are clear, conspicuous, and free of manipulative or deceptive design elements.
B. Deficiencies Highlighted by the California AG Inquiry (Remaining Open)
The following deficiencies, originally flagged by the California AG's February 2024 inquiry, remain substantially unremediated as of the date of this memorandum. Each represents a significant compliance gap under CCPA/CPRA and, in several instances, under other applicable state privacy statutes.
1. "Do Not Sell or Share" Link and Opt-Out Mechanism
Cascade's current website (cascade.com) includes a "Do Not Sell or Share My Personal Information" link in the website footer, accessible from each page of the site. However, the current implementation of this opt-out mechanism suffers from two critical deficiencies:
Failure to Honor Global Privacy Control (GPC) signals. Cascade's website does not currently recognize or honor Global Privacy Control signals transmitted by consumers' web browsers. GPC is a browser-level signal that communicates a consumer's preference to opt out of the sale and sharing of personal information. Under CCPA/CPRA regulations (11 CCR § 7025(c)), businesses are required to treat a GPC signal as a valid opt-out-of-sale/sharing request. The failure to honor GPC signals was identified as one of the seven known compliance gaps in the Fieldhaven data-mapping report dated May 19, 2025, and was referenced in Calderwood & Harkness's preliminary gap assessment communicated to the client on June 12, 2025. Additionally, several other applicable state privacy statutes — including those enacted in Colorado, Connecticut, Montana, and Texas — require or will require businesses to honor universal opt-out mechanisms, of which GPC is the most widely adopted.
Ineffective Cessation of Data Sharing. Even when a consumer submits an opt-out request through the "Do Not Sell or Share" link on cascade.com, the request does not effectively cease all sharing of that consumer's personal information with third-party advertising and analytics partners. As documented in the Fieldhaven report, Cascade currently shares consumer personal information — including device identifiers, browsing behavior, purchase history, and loyalty-program data — with 47 third-party advertising and analytics partners through a combination of pixel-based tracking, API integrations, server-to-server data transfers, and offline data-match processes. Many of these data-sharing mechanisms are not controlled by the existing opt-out toggle and continue to transmit consumer data to third parties even after a consumer has submitted an opt-out request.
The scale of the data sharing is substantial. Peakview Analytics Inc. ("Peakview"), Cascade's wholly-owned in-house adtech subsidiary, processes approximately 2.1 billion consumer-event data records per month for purposes of ad targeting, personalization, audience segmentation, and cross-device identity resolution. Peakview operates as both a first-party data platform and a data-sharing intermediary, transmitting consumer data to external advertising partners and demand-side platforms. The data flowing through Peakview represents one of the most significant sources of regulatory risk under CCPA/CPRA, as much of this data transmission likely constitutes "sharing" of personal information for cross-context behavioral advertising, triggering the opt-out rights of California consumers.
These deficiencies will be addressed through two principal remediation workstreams:
(a) Consent-Management Platform Deployment. Calderwood & Harkness is overseeing the deployment of OnPoint Data Solutions Inc.'s ("OnPoint") consent-management platform ("CMP") across cascade.com and the Cascade App. The CMP will provide centralized management of consumer consent and opt-out preferences, including the processing of GPC signals as valid opt-out-of-sale/sharing requests. The CMP will be integrated with Cascade's tag-management system and Peakview's data-ingestion pipeline to ensure that opt-out preferences are propagated to all downstream data-sharing mechanisms. The CMP deployment is targeted for completion on December 15, 2025, pursuant to the OnPoint implementation timeline established in the Statement of Work executed on June 9, 2025.
(b) Restructuring of Data-Sharing Arrangements. Concurrently with the CMP deployment, Calderwood & Harkness is leading the restructuring of Cascade's data-sharing arrangements with its 47 advertising and analytics partners to ensure that each arrangement is governed by contractual terms that are compliant with CCPA/CPRA and other applicable state privacy statutes. The highest-priority data-sharing arrangement is the Thornbridge Media Corp. relationship, discussed separately below.
2. Service-Provider and Contractor Agreements
As of May 2025, 23 of Cascade's 47 third-party advertising and analytics partners lack executed data-processing agreements ("DPAs") containing the contractual provisions required under CCPA/CPRA to qualify the data recipient as a "service provider" or "contractor." Specifically, the agreements currently in place with these 23 partners — which consist of standard insertion orders, media-buying agreements, or terms-of-service acceptances — do not include:
(a) A contractual prohibition on selling or sharing the personal information received from Cascade;
(b) A contractual prohibition on retaining, using, or disclosing the personal information for any purpose other than the specific business purpose identified in the agreement;
(c) A contractual prohibition on combining personal information received from Cascade with personal information obtained from other sources or collected independently;
(d) A certification by the data recipient that it understands and will comply with the restrictions imposed by the agreement and applicable law; and
(e) A grant to Cascade of the right to take reasonable and appropriate steps — including ongoing monitoring, assessments, and audits — to ensure the data recipient's compliance with the contractual restrictions.
The absence of these required contractual provisions has a direct and significant legal consequence: without adequate DPAs, data transfers to these 23 partners likely constitute "sales" or "sharing" of personal information under CCPA/CPRA, rather than permissible disclosures to service providers or contractors. This classification, in turn, triggers consumer opt-out rights under California Civil Code § 1798.120 and disclosure obligations under California Civil Code §§ 1798.100 and 1798.115 that Cascade is not currently meeting. Similar contractual requirements exist under other applicable state privacy statutes, including those in Virginia, Colorado, Connecticut, Indiana, Iowa, Tennessee, Montana, and Oregon, among others.
To address this deficiency, Calderwood & Harkness is developing two master DPA templates — one for engagements in which the data recipient functions as a "service provider" and one for engagements in which the data recipient functions as a "contractor" — tailored to the requirements of CCPA/CPRA and harmonized with the analogous requirements of other applicable state privacy statutes. These templates are targeted for finalization by September 30, 2025. Following finalization, Calderwood & Harkness will implement a vendor DPA rollout plan to execute DPAs with all 23 currently uncovered partners, with a target completion date of December 31, 2025. The rollout plan will prioritize partners by volume of data shared, sensitivity of data categories, and criticality to Cascade's advertising operations.
3. Privacy Policy Staleness
Cascade's current online privacy policy, published on cascade.com, was last updated in March 2022. This policy predates the effective date of the CPRA amendments to CCPA (January 1, 2023, with enforcement commencing July 1, 2023) and predates the enactment or effective date of 14 of the 19 state privacy statutes applicable to Cascade. The March 2022 privacy policy does not contain disclosures required under any of the following state statutes: the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Indiana Consumer Data Protection Act, the Iowa Consumer Data Protection Act, the Tennessee Information Protection Act, the Montana Consumer Data Privacy Act, the Oregon Consumer Privacy Act, the Texas Data Privacy and Security Act, the Delaware Personal Data Privacy Act, the New Hampshire Privacy Act, the New Jersey Data Privacy Act, or the Nebraska Data Privacy Act. The policy also fails to include several CPRA-specific disclosures that were not required under the original CCPA, including disclosures regarding the collection and processing of sensitive personal information, the retention periods for each category of personal information collected, and the specific right to correct inaccurate personal information.
Notably, the privacy policy that Cascade provided to the California AG in its March 2024 response was the same March 2022 version. The staleness of this policy was not specifically commented upon by the AG's office, but it is reasonable to infer that the AG would view the continued publication of a materially outdated privacy policy as a compliance deficiency.
Calderwood & Harkness is drafting a comprehensive omnibus privacy policy that will address the disclosure requirements of all 19 applicable state privacy statutes. The draft policy is targeted for delivery to the client for review by September 12, 2025, with a planned publication date of October 15, 2025, following client review and approval. The omnibus policy will be supplemented by a California-specific disclosures addendum containing the detailed disclosures required under CCPA/CPRA, including annual data-subject-request metrics.
V. Implications for Current Compliance Program Design
A. Regulatory Posture and Enforcement Risk
Although both the FTC and California AG matters were resolved (in the case of the FTC) or effectively concluded (in the case of the AG) without formal enforcement action, Cascade's regulatory history creates a heightened enforcement-risk profile that must inform the design and prioritization of the compliance program. The following considerations are particularly relevant:
Repeat-Target Risk. Federal and state regulators who have previously investigated a company may prioritize that company for future review, particularly where earlier-identified deficiencies remain unremediated. The FTC and the California AG's office both maintain internal tracking systems that flag companies with prior investigation histories. While the FTC's closing letter in the dark-patterns matter technically concludes that particular investigation, the institutional awareness of Cascade within the FTC's Bureau of Consumer Protection — and specifically within the Division of Advertising Practices — increases the likelihood that Cascade will be identified for review in connection with future FTC enforcement sweeps or industry-wide investigations. Similarly, the California AG's Privacy Enforcement and Protection Unit maintains records of prior inquiries and is likely to reference Cascade's February 2024 inquiry when evaluating potential enforcement targets.
Unremediated Deficiencies from the California AG Inquiry. The California AG's inquiry specifically flagged the sale/sharing opt-out and DPA deficiencies that remain substantially open as of June 2025. If the AG were to revisit Cascade's practices — whether through a targeted investigation prompted by consumer complaints, a follow-up inquiry building on the February 2024 matter, or a broader industry sweep of retail-sector privacy practices — the failure to remediate these issues in the more than fifteen months since the AG's inquiry would be highly problematic. The AG could reasonably characterize the unremediated deficiencies as evidence of willful noncompliance, a deliberate failure to implement corrective measures, or a lack of good faith in complying with CCPA/CPRA. Such a characterization could support the imposition of elevated penalties. Under CCPA/CPRA, each intentional violation is subject to a civil penalty of up to $7,500, while each unintentional violation is subject to a penalty of up to $2,500. Cal. Civ. Code § 1798.155(b). Given the volume of California consumers in Cascade's database — the Fieldhaven report estimates approximately 8.3 million California Cascade Rewards members — the potential penalty exposure for systemic violations affecting a large consumer population is substantial.
FTC Dark-Pattern Enforcement Trajectory. The FTC's ongoing and expanding focus on dark patterns means that any new consumer-facing opt-out mechanisms, consent flows, or DSR interfaces deployed as part of the compliance program must be designed and tested with heightened care. The FTC has made clear, through both formal enforcement actions and public statements by individual Commissioners, that it views dark patterns as a top enforcement priority. Any interface that employs confusing language, manipulative design elements, unnecessary friction, or asymmetric choice architecture — even if not intentionally deceptive — could attract regulatory scrutiny. The fact that Cascade was previously investigated for dark-pattern practices means that the FTC would likely apply a higher level of scrutiny to any future complaint or referral involving Cascade's digital interfaces.
Multi-State Enforcement Coordination. The expansion of state privacy statutes has been accompanied by increased coordination among state attorneys general on privacy enforcement. The California AG's office has participated in multi-state enforcement actions and information-sharing arrangements with other state regulators. Cascade's prior interaction with the California AG could result in information about Cascade's practices being shared with regulators in other states where Cascade operates, potentially triggering inquiries or investigations under those states' privacy statutes.
B. Priority Remediation Items Informed by Regulatory History
Based on the regulatory history summarized in this memorandum, I recommend that the following items be designated as priority remediation items within the Phase 1 compliance work plan, with implementation timelines aligned to the milestones specified below:
1. GPC/Universal Opt-Out Mechanism. Implement recognition and honoring of Global Privacy Control signals across cascade.com and the Cascade mobile app. This remediation item is both a mandatory regulatory requirement under CCPA/CPRA (11 CCR § 7025(c)) and directly responsive to the California AG's inquiry about the effectiveness of Cascade's opt-out mechanism. Implementation is tied to the OnPoint CMP deployment milestone, with a target go-live date of December 15, 2025. Upon deployment, the CMP must be configured to detect GPC signals in real time, apply the opt-out preference to all downstream data-sharing mechanisms, and generate a record of each GPC-triggered opt-out for compliance-verification purposes.
2. DPA Coverage for All Third-Party Partners. Execute compliant DPAs with all 47 advertising and analytics partners, prioritizing the 23 partners that currently lack any form of data-processing agreement. For each partner, Calderwood & Harkness will conduct a classification analysis to determine whether the partner functions as a service provider, contractor, or third party under CCPA/CPRA and analogous state statutes, and will ensure that the contractual terms of the DPA match the applicable classification. Vendor DPA rollout target: December 31, 2025. The rollout will proceed in three tranches: (i) the 10 highest-volume partners by data records shared (target: October 31, 2025); (ii) the next 13 uncovered partners (target: December 15, 2025); and (iii) the remaining 24 partners with existing but non-compliant agreements (target: December 31, 2025).
3. Thornbridge Media Corp. Data-Sharing Agreement Restructuring. The relationship between Cascade and Thornbridge Media Corp. ("Thornbridge") represents the highest-volume data-sharing arrangement in Cascade's advertising ecosystem. During FY2024, Cascade's advertising spend with Thornbridge totaled $18.4 million, encompassing programmatic advertising, audience targeting, cross-device identity resolution, and lookalike-audience modeling. The current contractual arrangement between Cascade and Thornbridge — governed by a Master Services Agreement dated August 12, 2021, and a series of insertion orders — does not contain the CCPA/CPRA-required provisions for service-provider or contractor classification and likely constitutes "sharing" of personal information for cross-context behavioral advertising under Cal. Civ. Code § 1798.140(ah). Calderwood & Harkness is negotiating a restructured data-sharing agreement with Victor Sandoval of Kellner Park & Associates LLP, Thornbridge's outside counsel, and Leah Voss, Thornbridge's General Counsel. The restructured agreement will address the classification of the data-sharing relationship, the scope of permissible data use, consumer opt-out obligations, data-retention and deletion requirements, and audit rights. Target execution date: October 31, 2025.
4. Comprehensive Privacy Policy Update. Replace the outdated March 2022 privacy policy with the new omnibus privacy policy covering all 19 applicable state privacy statutes. The new policy will include clear and conspicuous disclosures regarding the categories of personal information collected, the purposes of collection and processing, the categories of third parties with which personal information is sold or shared, the consumer rights available under each applicable state statute, and the methods for exercising those rights. Target delivery of draft policy to client: September 12, 2025. The omnibus policy will be accompanied by a California-specific disclosures addendum containing (i) the categories of personal information collected during the preceding 12 months; (ii) the categories of sources from which personal information was collected; (iii) the business or commercial purposes for collecting, selling, or sharing personal information; (iv) the categories of third parties to which personal information was sold or shared; and (v) the annual data-subject-request metrics for FY2024, which, based on Cascade's internal records, are as follows: approximately 38,400 total DSRs received, comprising approximately 12,800 access requests, approximately 19,100 deletion requests, and approximately 6,500 opt-out-of-sale/sharing requests.
5. DSR Portal Enhancements. Cascade's current data-subject-request portal (accessible at cascade.com/privacy-requests) requires significant enhancements to meet the requirements of CCPA/CPRA and other applicable state privacy statutes. The current portal lacks identity-verification functionality that meets the CCPA/CPRA standard for verifying the identity of a consumer making a request (11 CCR § 7060 et seq.), and it does not provide the appeal-process functionality required by the Virginia Consumer Data Protection Act (Va. Code § 59.1-577(A)(5)), the Colorado Privacy Act (Colo. Rev. Stat. § 6-1-1306(4)(a)), the Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-520(a)(5)), and several other state statutes that grant consumers the right to appeal a controller's decision on a DSR. Additionally, Cascade's average DSR response time during FY2024 was 27 calendar days. While this falls within the 45-calendar-day CCPA/CPRA response period, it is not competitive with industry benchmarks and does not provide adequate margin for complex requests requiring extensions. The target average response time under the new compliance program is 15 business days or fewer. The enhanced DSR portal and associated internal workflow are targeted for go-live on December 1, 2025.
6. Sensitive Personal Information Consent Flow. Cascade's mobile app collects precise geolocation data from consumers who enable location services on their mobile devices. This data is used for store-locator functionality, location-based promotional notifications, and geofencing analytics conducted by Peakview. Under CCPA/CPRA, precise geolocation data is classified as "sensitive personal information" (Cal. Civ. Code § 1798.140(ae)(1)(G)), and consumers have the right to limit the use and disclosure of their sensitive personal information to purposes that are "necessary to perform the services or provide the goods reasonably expected by an average consumer" (Cal. Civ. Code § 1798.121(a)). Cascade's current mobile-app implementation does not provide a separate opt-in consent mechanism for the collection and use of precise geolocation data as sensitive personal information, nor does it provide the "Limit the Use of My Sensitive Personal Information" link or equivalent alternative opt-out mechanism contemplated by the statute. While this issue was not specifically raised in either the FTC or California AG interaction, it is a high-risk compliance gap that would likely be scrutinized in any future enforcement action or investigation. This remediation item should be addressed as part of the CMP deployment and mobile-app consent-flow redesign workstreams.
C. Coordination with Whitfield Greaves LLP
Cascade's existing securities and corporate governance counsel, Whitfield Greaves LLP (lead partner: Carolyn J. Marsden), should be informed of the regulatory history summarized in this memorandum to the extent relevant to Cascade's SEC disclosure obligations. As a publicly traded company, Cascade is required to disclose material risk factors in its periodic filings on Forms 10-K and 10-Q, as well as material legal proceedings under Item 103 of Regulation S-K. While neither the FTC nor California AG matter resulted in a formal enforcement action, the following disclosure considerations arise:
(a) Risk-Factor Disclosure: Cascade's existing risk-factor disclosures regarding data-privacy and cybersecurity risks should be reviewed and, if necessary, updated to reflect the Company's regulatory history and the ongoing compliance-program development. The risk factors should accurately describe the regulatory environment, the Company's prior interactions with regulators, and the potential consequences of non-compliance, including the risk of enforcement actions, penalties, and reputational harm.
(b) Legal-Proceedings Disclosure: While no pending legal proceeding exists as of the date of this memorandum, the indeterminate status of the California AG inquiry — which has not been formally closed — warrants a determination as to whether disclosure under Item 103 of Regulation S-K is required or advisable.
(c) Compliance-Program Expenditures: The aggregate expenditures associated with the compliance program (including Calderwood & Harkness's Phase 1 fees, the Fieldhaven engagement, and the OnPoint CMP contract) may be material in the context of Cascade's financial statements and may warrant disclosure in management's discussion and analysis or in the notes to the financial statements.
A Common-Interest Agreement between Calderwood & Harkness LLP and Whitfield Greaves LLP was executed on June 10, 2025, to facilitate the sharing of privileged and work-product-protected communications between the two firms on matters relating to SEC disclosure, corporate governance, and privacy-compliance issues. Under the Common-Interest Agreement, communications shared between the firms remain protected by the attorney-client privilege and work-product doctrine and do not constitute a waiver of either privilege. Any communications with Whitfield Greaves regarding the matters described in this memorandum should be made in accordance with the terms of the Common-Interest Agreement.
D. Insurance Considerations
Cascade maintains a cyber and privacy-liability insurance policy underwritten by Northcastle Indemnity Company, policy number NIC-CPL-2025-14782, brokered by Ridgepoint Insurance Brokers Inc. (account executive: Nathan Gilroy). The policy covers the period from July 1, 2025, through June 30, 2026, and provides coverage with a limit of liability of $25 million per occurrence and $50 million in the aggregate for the annual policy period. The annual premium for the current policy period is $1,340,000.
The regulatory history summarized in this memorandum, together with the ongoing compliance gaps identified in the current engagement, raise several insurance-related considerations:
(a) Notice Obligations. The Northcastle policy may contain notice-of-circumstances provisions requiring Cascade to notify the carrier of facts or circumstances that may reasonably be expected to give rise to a claim or regulatory proceeding. The indeterminate status of the California AG inquiry and the unremediated compliance deficiencies may constitute such circumstances. Calderwood & Harkness recommends that Cascade, in coordination with Ridgepoint Insurance Brokers (Nathan Gilroy), review the specific notice provisions of the Northcastle policy and determine whether a notice-of-circumstances submission is warranted.
(b) Coverage Scope. The policy should be reviewed to confirm that it provides coverage for regulatory defense costs, civil penalties and fines (to the extent insurable under applicable law), and investigation expenses associated with state attorney general inquiries and FTC investigations. The applicability of any exclusions — including prior-knowledge exclusions, prior-acts exclusions, or conduct exclusions — should be evaluated in light of Cascade's regulatory history.
(c) Renewal Considerations. The regulatory history and compliance gaps may affect the terms, conditions, and pricing of Cascade's cyber/privacy-liability coverage at the next renewal. Cascade should proactively engage Ridgepoint and Northcastle to discuss the compliance-program remediation timeline and the steps being taken to address identified deficiencies, which may support favorable renewal terms.
E. Board and Governance Implications
The regulatory history and its implications for Cascade's compliance posture should be communicated to Cascade's Board of Directors through the Audit & Risk Committee. The following governance-related actions are recommended:
Board Reporting. The Audit & Risk Committee, chaired by Director Ellen Marchetti, should be apprised of the regulatory history summarized in this memorandum and its implications for the design and implementation of the compliance program. I recommend that this information be included in the privacy-program status presentation scheduled for the November 13, 2025 Board of Directors meeting. A separate Board Presentation Memorandum will be prepared by Calderwood & Harkness for that meeting, summarizing the regulatory history, the status of remediation efforts, and the overall compliance-program timeline and milestones.
Privacy Governance Charter. The proposed Privacy Governance Charter that Calderwood & Harkness is drafting for adoption at the November 13, 2025 Board meeting should include, among other provisions, the establishment of a regulatory-response protocol. This protocol, informed by the lessons learned from the FTC and California AG interactions, should define (i) the internal escalation process for receipt of regulatory inquiries, CIDs, and investigative subpoenas; (ii) the roles and responsibilities of the General Counsel, CPO, and outside counsel in managing regulatory interactions; (iii) document-preservation and privilege-management protocols triggered by receipt of a regulatory inquiry; and (iv) Board notification requirements for regulatory matters of specified materiality thresholds.
Chief Privacy Officer Appointment. The hiring of a full-time Chief Privacy Officer is recommended to occur by Q4 2025 to ensure dedicated executive leadership of the compliance program and of regulatory interactions going forward. Diana Polk, who currently serves as interim CPO in addition to her responsibilities as Associate General Counsel, has been effective in managing the transition, but the scope and complexity of the compliance program — and the need to maintain ongoing regulatory readiness — require a dedicated senior leader. The CPO role should report functionally to the General Counsel and provide regular updates to the Audit & Risk Committee. Calderwood & Harkness can provide guidance on the position description and candidate evaluation criteria if requested.
VI. Recommendations
Based on the analysis set forth in this memorandum, I make the following recommendations for discussion with the client and for incorporation into the Phase 1 compliance work plan:
1.  Prioritize California AG Remediation Items. The two specific deficiencies flagged by the California AG's February 2024 inquiry — (i) the effectiveness of the "Do Not Sell or Share" link and opt-out mechanism (including GPC signal honoring) and (ii) the adequacy of service-provider and contractor DPA coverage — should be designated as the highest-priority remediation items in the Phase 1 work plan. These items carry the greatest enforcement risk due to the prior regulatory interaction and the extended period during which they have remained unremediated.
2.  Design Consumer-Facing Interfaces in Compliance with FTC Dark-Pattern Guidance. All new consumer-facing opt-out and consent interfaces — including the OnPoint CMP deployment, the DSR portal enhancements, and the mobile-app consent flows — must be designed in compliance with the FTC's published guidance on dark patterns and tested for usability before deployment. Testing should include user-experience testing with representative consumer populations, A/B testing to verify the clarity and effectiveness of interface elements, and legal review of all consumer-facing language and design elements. Calderwood & Harkness should review and approve the final interface designs before go-live.
3.  Document Remedial Actions. Cascade should maintain a comprehensive and contemporaneous record of all remedial actions taken in response to the deficiencies identified in both regulatory interactions. This documentation should include design specifications, implementation timelines, testing results, legal-review memoranda, and post-deployment verification records. In the event of any future regulatory inquiry, this documentation will serve as evidence of good faith, proactive compliance efforts, and the Company's commitment to remediation.
4.  Coordinate on SEC Disclosure. Calderwood & Harkness should coordinate with Whitfield Greaves LLP (Carolyn J. Marsden) regarding the appropriate SEC disclosure treatment of Cascade's regulatory history and the ongoing compliance-program expenditures. The aggregate expenditures associated with the Phase 1 compliance program are significant: Calderwood & Harkness's Phase 1 engagement carries a fee cap of $2,600,000; the Fieldhaven Consulting Group LLC Statement of Work is valued at $3,150,000; and the OnPoint Data Solutions Inc. CMP contract is valued at $1,440,000. These expenditures, together with internal costs, may warrant disclosure consideration in upcoming periodic filings.
5.  Review Insurance Coverage. Cascade should consult with Ridgepoint Insurance Brokers Inc. (Nathan Gilroy) and review the terms of the Northcastle Indemnity Company cyber/privacy-liability policy (policy period July 1, 2025 – June 30, 2026; $25M per-occurrence / $50M aggregate; annual premium $1,340,000) regarding (i) any obligation to provide notice to the carrier of the regulatory history and ongoing compliance deficiencies; (ii) the scope of coverage for regulatory defense costs and civil penalties; and (iii) the potential impact of the regulatory history on policy renewal terms and conditions.
6.  Include Regulatory History in Phase 1 Certification. A summary of Cascade's regulatory history with the FTC and California AG, together with a detailed accounting of the remediation status of all identified deficiencies, should be included in the Phase 1 Compliance-Readiness Certification Memorandum targeted for delivery on December 31, 2025. The certification memorandum will serve as the primary deliverable documenting the completion of Phase 1 remediation activities and the Company's compliance posture as of the certification date.
VII. Document Retention Note
All materials related to the FTC Civil Investigative Demand (File No. 232-0147) and the California Attorney General informal inquiry described in this memorandum should be maintained under legal hold and preserved in accordance with Cascade's document-retention policies, the litigation-hold notice issued by Meredith Tanaka on September 15, 2023 (in connection with the FTC CID), and Calderwood & Harkness's engagement-specific retention protocols established pursuant to the June 2, 2025 engagement letter.
These materials include, without limitation, the CID and all attachments, Cascade's document production and interrogatory responses, the FTC closing letter, the California AG inquiry letter, Cascade's March 8, 2024 response to the AG, internal memoranda and communications relating to both matters, remediation documentation, and all correspondence between Cascade and the FTC or AG's office.
No materials subject to the legal hold or the retention protocols described above should be destroyed, altered, disposed of, or removed from Cascade's document-management system without the prior written approval of the responsible partner, Kevin Ostrowski, or his designee.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________