CALDERWOOD & HARKNESS LLP
Privacy & Data Security Practice Group
600 Lexington Avenue, 28th Floor New York, New York 10022
COMPREHENSIVE GAP-ANALYSIS REPORT
US STATE PRIVACY COMPLIANCE PROGRAM
Privileged and Confidential — Attorney-Client Communication / Attorney Work Product
Prepared For:
Cascade Retail Holdings Inc.
Attention: Meredith Tanaka, General Counsel
Diana Polk, Associate General Counsel (Interim Chief Privacy Officer) 4100 Elliott Avenue West, Suite 1200 Seattle, Washington 98119
Prepared By:
Calderwood & Harkness LLP Privacy & Data Security Practice Group 600 Lexington Avenue, 28th Floor New York, New York 10022
Authors:
Alan Burke, Senior Associate Sara Hendricks, Associate
Under the supervision of Kevin Ostrowski, Partner
Date: August 15, 2025 Matter Number: 1038-00010
CONFIDENTIALITY LEGEND. This memorandum is a privileged and confidential attorney-client communication and attorney work product. It is prepared solely for the use of Cascade Retail Holdings Inc. and its authorized representatives in connection with legal advice regarding US state privacy compliance. The contents reflect the mental impressions, conclusions, opinions, and legal theories of counsel and are protected from disclosure under the attorney-client privilege and the work-product doctrine. Do not distribute, copy, forward, or disclose this memorandum, or any portion of it, without the prior written consent of Calderwood & Harkness LLP. Inadvertent disclosure shall not constitute a waiver of any applicable privilege or protection.
I. Executive Summary
Calderwood & Harkness LLP ("C&H" or "Firm") submits this Comprehensive Gap-Analysis Report (the "Report") as the primary Phase 1A deliverable under the engagement letter dated June 2, 2025 (the "Engagement Letter") between the Firm and Cascade Retail Holdings Inc. ("Cascade" or the "Company"). The Report presents the Firm's assessment of Cascade's current compliance posture against each of the nineteen (19) US state comprehensive privacy statutes applicable to the Company as of the engagement opening date, identifies material compliance gaps, assigns a risk rating to each gap, and sets forth a remediation roadmap aligned with the Phase 1 milestones through December 31, 2025.
Engagement context. The Firm was retained by Cascade on June 2, 2025. The Phase 1 kickoff meeting and data-mapping workshop were conducted on June 16, 2025 at Cascade's Seattle headquarters, with representatives of Cascade, Fieldhaven Consulting Group LLC ("Fieldhaven"), and the Firm in attendance. This Report is due on August 15, 2025 pursuant to Section 3.2(a) of the Engagement Letter and constitutes the foundational document from which all subsequent Phase 1 workstreams derive.
Scope of assessment. The Report covers Cascade's direct-to-consumer retail operations (186 stores across 31 states); its e-commerce platform at cascade.com (approximately 94 million annual online transactions in FY2024); its third-party marketplace operated through Cascade Digital Marketplace LLC (approximately 3,800 sellers); its loyalty program operated through Cascade Rewards Corp. (approximately 41.2 million registered members across all 50 states); its in-house advertising-technology and customer-analytics subsidiary, Peakview Analytics Inc. (processing approximately 2.1 billion consumer-event records per month); and the data practices of key vendors and service providers that receive personal information from Cascade or its affiliates.
Methodology in brief. The Firm's analysis proceeded through: (i) legal review and classification of the data-mapping report delivered by Fieldhaven on May 19, 2025 (engagement lead: Marcus Ellerby); (ii) structured interviews with key Cascade stakeholders, including Diana Polk (Interim CPO), Gregory Farris (CISO), Priya Nandakumar (VP, Data & Analytics), and Jason Leclaire (VP, Marketing & Customer Engagement); (iii) document review of Cascade's existing online privacy policy (last updated March 2022), vendor agreements, DSR intake procedures, cookie and tracking-technology implementations, loyalty-program terms, and prior regulatory correspondence; and (iv) statute-by-statute gap analysis against the requirements of each of the nineteen applicable state privacy statutes.
Summary of findings. The Firm has identified seven (7) primary compliance gaps and a number of secondary findings warranting remediation. Of the seven primary gaps, five are rated HIGH risk (Gaps 1, 2, 3, 4, and 7) and two are rated MEDIUM risk (Gaps 5 and 6). No primary gap is rated LOW; the gaps identified are, in the Firm's view, of a nature and severity that materially exposes Cascade to enforcement action, private litigation risk (where applicable), reputational harm, or operational disruption absent remediation within the Phase 1 timeline.
Remediation feasibility. Each of the identified gaps is remediable within Phase 1 (completion December 31, 2025), provided that the milestones described in Section VII of this Report are adhered to and that the resource commitments identified in the Engagement Letter, the Fieldhaven statement of work dated May 12, 2025, and the OnPoint Data Solutions Inc. ("OnPoint") consent-management platform ("CMP") SaaS agreement are maintained.
Continuity with prior regulatory interactions. The findings in this Report are consistent with, and directly responsive to, the deficiencies flagged in the California Attorney General's informal inquiry letter dated February 6, 2024 (to which Cascade responded on March 8, 2024) and the lessons drawn from the Federal Trade Commission Civil Investigative Demand (File No. 232-0147) issued September 14, 2023 and closed without action on April 3, 2024. In particular, Gaps 1 (privacy-notice deficiencies), 2 (non-functional "Do Not Sell" link and absence of universal opt-out honoring), and 4 (deficient service-provider agreements) all correspond to items expressly identified in the California AG's February 2024 correspondence and, in the Firm's view, warrant priority attention.
II. Scope and Methodology
A. Engagement Scope
Pursuant to the Engagement Letter, C&H has been retained to design, build, and implement a comprehensive US state privacy-compliance program on behalf of Cascade. Phase 1 of the engagement, which runs from June 2, 2025 through December 31, 2025, encompasses gap analysis, program design, policy drafting, vendor-agreement remediation, DSR-workflow implementation, CMP deployment, and board-level governance work. Phase 2, running from January 1 through June 30, 2026, will address ongoing monitoring, training, and regulatory response.
The following legal entities are within the scope of this engagement (collectively, the "Cascade Entities"):
1. Cascade Retail Holdings Inc., a Delaware corporation (Nasdaq: CSRD), EIN 84-3192057;
2. Cascade Digital Marketplace LLC, a Delaware limited liability company, EIN 85-4107638;
3. Ridgeline Fulfillment Services Inc., a Washington corporation, EIN 91-1647823;
4. Peakview Analytics Inc., a Delaware corporation, EIN 87-2250194; and
5. Cascade Rewards Corp., a Delaware corporation, EIN 86-3381729.
The following individuals are the key business and legal stakeholders for the engagement:
• Thomas R. Cavanaugh, Chief Executive Officer (executive sponsor);
• Meredith Tanaka, General Counsel (primary client contact);
• Diana Polk, Associate General Counsel and Interim Chief Privacy Officer (day-to-day engagement lead);
• Gregory Farris, Chief Information Security Officer;
• Priya Nandakumar, Vice President, Data & Analytics; and
• Jason Leclaire, Vice President, Marketing & Customer Engagement.
B. Applicable State Privacy Statutes
As of the engagement opening date, the Firm has identified nineteen (19) US state comprehensive privacy statutes that are applicable, or that will become applicable within the Phase 1 horizon, to one or more of the Cascade Entities based on Cascade's revenue, the volume of personal information processed, the presence of consumers resident in each state, and the derivation of revenue from the sale or sharing of personal information. The applicable statutes are:
1. California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA");
2. Virginia Consumer Data Protection Act ("VCDPA");
3. Colorado Privacy Act ("CPA");
4. Connecticut Data Privacy Act ("CTDPA");
5. Utah Consumer Privacy Act ("UCPA");
6. Iowa Consumer Data Protection Act ("ICDPA");
7. Indiana Consumer Data Protection Act ("INCDPA");
8. Tennessee Information Protection Act ("TIPA");
9. Montana Consumer Data Privacy Act ("MCDPA");
10. Texas Data Privacy and Security Act ("TDPSA");
11. Oregon Consumer Privacy Act ("OCPA");
12. Delaware Personal Data Privacy Act ("DPDPA");
13. New Jersey Data Privacy Act ("NJDPA");
14. New Hampshire Data Privacy Act ("NHDPA");
15. Nebraska Data Privacy Act ("NDPA");
16. Minnesota Consumer Data Privacy Act ("Minnesota CDPA");
17. Maryland Online Data Privacy Act ("MODPA");
18. Kentucky Consumer Data Protection Act ("KYDPA"); and
19. Additional statutes effective or enacted through the 2025–2026 legislative cycles, as further described in the Multi-State Privacy Law Applicability Matrix.
A statute-by-statute analysis of applicability thresholds, effective dates, and substantive requirements is set forth in the Firm's Multi-State Privacy Law Applicability Matrix, prepared by Sara Hendricks and Alan Burke and dated June 30, 2025 (the "Applicability Matrix"). A summary of the Applicability Matrix is included at Appendix A to this Report; users of this Report should consult the standalone Applicability Matrix for the definitive statute-level analysis.
C. Methodology. The Firm's assessment proceeded in six sequential steps:
Step 1 — Review of Fieldhaven data-mapping report. The Firm reviewed the data-mapping report delivered by Fieldhaven on May 19, 2025 (Fieldhaven engagement lead: Marcus Ellerby), which cataloged all identified data flows, personal-information categories, processing activities, and third-party sharing relationships across the Cascade Entities. Where the Firm identified inconsistencies or gaps in the Fieldhaven catalog, the Firm consulted directly with Mr. Ellerby's team to reconcile.
Step 2 — Legal classification of data flows. The Firm classified each identified data flow under CCPA/CPRA and, where relevant, under each applicable state statute, as: (i) a "sale" of personal information; (ii) "sharing" for cross-context behavioral advertising purposes; (iii) service-provider processing; (iv) contractor processing; or (v) third-party processing outside any service-provider or contractor relationship. This classification exercise is central to Gap 4 (DPA coverage) and Gap 2 (universal opt-out).
Step 3 — Stakeholder interviews. The Firm conducted structured interviews between June 19, 2025 and July 24, 2025 with Diana Polk, Gregory Farris, Priya Nandakumar, Jason Leclaire, and designated representatives from each subsidiary. Interview memoranda are retained in the matter file and are protected as attorney work product.
Step 4 — Document review. The Firm reviewed Cascade's existing online privacy policy (last updated March 2022); a representative sample of vendor and service-provider contracts; the current DSR portal workflow documentation; cookie and tracking-technology implementation records for cascade.com and the Cascade mobile app; and the loyalty-program terms governing Cascade Rewards.
Step 5 — Regulatory-history review. The Firm reviewed the materials produced in connection with the FTC CID (File No. 232-0147) and Cascade's March 8, 2024 response to the California AG's February 6, 2024 informal inquiry letter, as well as related internal correspondence and remediation records.
Step 6 — Statutory gap analysis. For each applicable statute and each material data-processing activity, the Firm identified points of non-compliance, assigned a risk rating in accordance with the methodology set forth in Section II.D, and formulated a remediation recommendation.
D. Risk-Rating Methodology
The Firm has applied the following three-tier risk-rating methodology to each identified gap:
HIGH. Non-compliance creates material risk of enforcement action by a state attorney general, the California Privacy Protection Agency ("CPPA"), the Federal Trade Commission, or another regulator; substantial monetary penalties; and/or private litigation (including class-action exposure under CCPA § 1798.150 in the case of a data breach). Immediate remediation is required.
MEDIUM. Non-compliance creates moderate risk of regulatory inquiry, cure-period notice, or reputational harm, but is not, as of the date of this Report, the immediate target of active enforcement or well-established plaintiffs'-bar litigation. Remediation is required within the Phase 1 timeline.
LOW. Technical non-compliance or best-practice gap with limited near-term enforcement or litigation risk. Remediation is recommended but may be prioritized behind higher-rated items.
III. Company Profile and Data-Processing Overview
A. Business Operations
Cascade Retail Holdings Inc. is a publicly traded omnichannel retailer and e-commerce platform, listed on the Nasdaq Global Select Market under the ticker "CSRD." For fiscal year 2024, Cascade reported consolidated revenue of approximately $3.87 billion, and the Company employed approximately 22,500 individuals at year-end.
Cascade operates 186 retail locations across 31 US states, with regional concentration in the Pacific Northwest, Mountain West, and Midwest. E-commerce orders placed through cascade.com are shipped to all 50 states and the District of Columbia.
Cascade Digital Marketplace LLC operates the third-party seller marketplace at cascade.com/marketplace, hosting approximately 3,800 active sellers as of the engagement opening date. Ridgeline Fulfillment Services Inc. provides warehousing, order fulfillment, and last-mile logistics services to Cascade and its affiliates. Cascade Rewards Corp. administers the Company's loyalty and stored-value card program, with approximately 41.2 million registered members across all 50 states. Peakview Analytics Inc. functions as Cascade's in-house advertising-technology and customer-analytics platform, providing personalization, ad targeting, and marketing analytics services across the Cascade ecosystem.
B. Personal Information Categories Collected
Based on the Fieldhaven data map and the Firm's stakeholder interviews, Cascade collects, uses, and discloses the following categories of personal information ("PI"):
1. Identifiers — name, email address, postal address, telephone number, account credentials, customer identification number;
2. Commercial information — purchase history, transaction records, returns and exchanges, product preferences, wish lists, and gift-registry information;
3. Internet and network activity — browsing history on cascade.com, search queries, clickstream data, device identifiers, IP addresses, and referral sources;
4. Geolocation data — precise geolocation collected from the Cascade mobile application when the user grants operating-system-level location permission;
5. Inferences — consumer profiles, propensity scores, interest segments, and other inferences drawn from the categories above and used by Peakview Analytics for personalization and targeting; and
6. Sensitive personal information — payment-card data (subject to PCI-DSS controls), precise geolocation, and account login credentials.
C. Data Volumes and Flows
The Fieldhaven data map identifies the following volumes and flows, which the Firm has verified through independent stakeholder interviews to the extent practicable:
• Peakview Analytics processes approximately 2.1 billion consumer-event records per month in support of ad targeting, personalization, and analytics use cases;
• Cascade shares consumer PI with 47 third-party advertising and analytics partners identified in the May 2025 data map;
• 12 categories of cookies and tracking technologies are deployed on cascade.com;
• Cascade processed approximately 94 million online transactions in FY2024;
• Cascade received approximately 38,400 data-subject requests in FY2024, comprising approximately 12,800 access requests, 19,100 deletion requests, and 6,500 opt-out-of-sale/sharing requests; and
• The average DSR response time in FY2024 was 27 calendar days.
IV. Gap Analysis Findings
Gap 1 — Privacy Policy: Outdated and Incomplete Disclosures
A. Finding. Cascade's consumer-facing online privacy policy at cascade.com/privacy was last updated in March 2022. The policy substantially predates the operative effective dates of the CPRA amendments and each of the eighteen (18) non-California statutes now within scope. The policy does not address the specific consumer-rights and transparency requirements of 14 of the 19 applicable statutes, and it contains only generic references to California (framed against the pre-CPRA CCPA text) and to general US privacy principles.
Specifically, the current policy contains no state-specific consumer-rights disclosures for Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota, Maryland, or Kentucky. It also omits the following CCPA/CPRA-required disclosures: (i) the categories of personal information sold or shared, disaggregated by recipient category; (ii) retention periods (or criteria for determining retention periods) for each category of PI; (iii) the consumer right to correct inaccurate PI; (iv) the consumer right to limit the use and disclosure of sensitive PI; and (v) the annual metrics disclosures required by 11 CCR § 7102 for businesses that meet the applicable threshold.
In addition, Cascade has not published: (a) a separate financial-incentive notice for the Cascade Rewards loyalty program, as required by Cal. Civ. Code § 1798.125(b) and 11 CCR § 7016; (b) an employee or job-applicant privacy notice, notwithstanding the expiration of the CCPA employee-data exemption and the extension of full consumer rights to California employees under the CPRA; or (c) a marketplace-seller privacy notice governing the processing of PI in connection with the Cascade Digital Marketplace business.
B. Risk Rating: **HIGH**. Deficient privacy notices remain a primary enforcement target for the California AG, the CPPA, the FTC, and emerging state AGs. The California AG's February 6, 2024 informal inquiry specifically flagged deficiencies in Cascade's sale/sharing disclosures. Those deficiencies remain unremediated as of the date of this Report. Several of the newer state statutes contemplate cure-period notices as a prerequisite to enforcement, but the substantive obligation to publish a compliant notice attaches on the applicable effective date regardless of any subsequent cure opportunity.
C. Statutes Implicated.
• CCPA/CPRA, Cal. Civ. Code §§ 1798.100, 1798.110, 1798.115, 1798.121, 1798.125, and 1798.130, together with implementing regulations at 11 CCR §§ 7010–7016.
• VCDPA § 59.1-578(C); CPA § 6-1-1308(1); CTDPA § 42-520(a)(3); UCPA § 13-61-302; and analogous notice-and-transparency provisions in each of the other applicable state statutes.
D. Remediation Recommendation. The Firm recommends drafting and publishing a comprehensive privacy-notice suite comprising:
1. an omnibus consumer privacy policy covering all 19 applicable state statutes and constructed on a state-neutral core with state-specific supplemental disclosures;
2. a California-specific disclosures addendum capturing all CCPA/CPRA-required elements not appearing in the omnibus policy;
3. a state-specific consumer-rights supplement for each of the remaining 18 statutes;
4. a Cascade Rewards financial-incentive notice meeting the requirements of Cal. Civ. Code § 1798.125(b);
5. an employee and job-applicant privacy notice;
6. a marketplace-seller privacy notice; and
7. a cookie and tracking-technology notice aligned with the OnPoint CMP deployment (see Gap 2).
Target delivery date for all drafts: September 12, 2025. The Firm will coordinate with Whitfield Greaves LLP (Carolyn J. Marsden) regarding any SEC-disclosure implications, including the treatment of privacy-related risk factors in Cascade's next Form 10-K and any relevant Regulation S-K Item 106 cybersecurity disclosures.
Gap 2 — No Universal Opt-Out Mechanism; Global Privacy Control (GPC) Not Honored
A. Finding. Cascade does not currently honor the Global Privacy Control ("GPC") signal, as implemented via the GPC signal specification or any equivalent universal opt-out mechanism, on either cascade.com or the Cascade mobile application. The existing "Do Not Sell My Personal Information" link on cascade.com, prominently displayed in the site footer, is non-functional: clicking the link directs the user to an email address (privacyrequests-legacy@cascade.com) that has not been actively monitored since Q2 2023. The Firm has verified this behavior directly.
No mechanism currently exists within Cascade's technical architecture to propagate opt-out signals downstream to Peakview Analytics or to any of the 47 third-party advertising and analytics partners identified in the Fieldhaven data map. Even if a consumer's opt-out were successfully captured at the cascade.com layer, that signal would not be honored by downstream recipients of the consumer's PI.
B. Risk Rating: **HIGH**. CCPA/CPRA and its implementing regulations require covered businesses to treat GPC signals as valid opt-out-of-sale/sharing requests. Cal. Civ. Code § 1798.135(b); 11 CCR § 7025. The obligation to honor an opt-out preference signal is now a stated enforcement priority of both the California AG and the CPPA. The CPA, CTDPA, TDPSA, MCDPA, OCPA, DPDPA, NJDPA, and additional statutes contain analogous universal opt-out obligations, several of which took effect on staggered dates through 2025 and 2026.
The California AG's first published CCPA enforcement settlement, together with subsequent enforcement advisories, established that failure to honor GPC is treated as a per se violation rather than as a technical or discretionary matter. The precedent is clear.
Furthermore, the California AG's February 2024 inquiry expressly identified the deficient "Do Not Sell" link as a concern. The passage of more than eighteen months without remediation compounds Cascade's exposure.
C. Statutes Implicated.
• CCPA/CPRA § 1798.135(b) and 11 CCR § 7025;
• CPA § 6-1-1306(1)(a)(IV) and the Colorado AG's universal opt-out regulations;
• CTDPA § 42-518(e); TDPSA § 541.055(e); MCDPA § 30-14-2811; OCPA § 646A.578; DPDPA § 12D-105; NJDPA and other statutes recognizing universal opt-out mechanisms.
D. Remediation Recommendation. The Firm recommends implementation of GPC detection and honoring across cascade.com and the Cascade mobile application through the OnPoint Data Solutions Inc. CMP, and further recommends that Cascade establish downstream propagation of opt-out signals to Peakview Analytics and to each of the 47 identified third-party partners. Specifically, Cascade should:
(a) deploy the OnPoint CMP configured to detect the GPC header and other recognized universal opt-out signals on the first HTTP request from the consumer's browser or device;
(b) fix or replace the current non-functional "Do Not Sell or Share My Personal Information" link with a functional opt-out mechanism, including a state-appropriate variant of the "Your Privacy Choices" icon and link;
(c) implement server-side signal propagation to Peakview Analytics and, via API or contractual notification mechanism, to each of the 47 downstream partners; and
(d) update the underlying contracts with those partners (see Gap 4) to obligate them to honor propagated opt-out signals.
Target CMP deployment date: December 15, 2025 (aligned with Fieldhaven Milestone 2). OnPoint's SaaS agreement provides for a three-year term at $480,000 per year (total contract value $1,440,000); a data-processing-agreement rider to that SaaS agreement is currently under negotiation.
Gap 3 — Commingled Marketplace Seller and First-Party Customer Data
A. Finding. Third-party seller data associated with the Cascade Digital Marketplace LLC business is stored in the same enterprise data lake, hosted by Peakview Analytics Inc., in which Cascade's first-party customer data resides. Storage-layer and access-control mechanisms do not meaningfully differentiate seller data from customer data. Role-based access controls are undifferentiated between marketplace-operations personnel and first-party marketing personnel, and shared reporting dashboards may expose marketplace sellers, in certain reporting contexts, to first-party customer PI that Cascade collected in its own capacity as a controller.
Approximately 3,800 marketplace sellers are affected by the current architecture. The commingling creates a substantive legal ambiguity regarding the controller/processor characterization of the parties as to particular data elements, and, in the Firm's view, undermines Cascade's ability to demonstrate that it is providing reasonable and appropriate security safeguards for the PI in question.
B. Risk Rating: **HIGH**. Data commingling of this character materially increases the risk of unauthorized disclosure and creates significant operational difficulty for consumer-rights response — Cascade cannot reliably segregate seller-originated PI from Cascade-originated PI when responding to access, deletion, or correction requests. This is particularly acute in the deletion context, where an inability to identify the source of the record risks both under-deletion (leaving records in place that should be deleted) and over-deletion (removing records that Cascade is contractually or legally required to retain on behalf of a marketplace seller).
The commingling further undermines Cascade's ability to characterize marketplace data-processing arrangements as service-provider or controller relationships in a legally defensible manner. In the Firm's view, the current architecture is inconsistent with the reasonable-security obligation under CCPA/CPRA and creates cognizable exposure under FTC Act Section 5 unfairness and deception principles.
C. Statutes Implicated.
• CCPA/CPRA service-provider and contractor requirements at §§ 1798.140(ag) and 1798.140(j); reasonable-security obligations at § 1798.150(a);
• Data-minimization and reasonable-security provisions of VCDPA, CPA, CTDPA, TDPSA, OCPA, and each other applicable state statute; and
• Potential FTC Act § 5 exposure under unfairness and deception theories, consistent with recent FTC data-security consent orders.
D. Remediation Recommendation. The Firm recommends the following remediation program:
1. Implement a data-segregation architecture, within Peakview's enterprise data lake, that logically and, to the extent practicable, physically separates marketplace seller data from first-party customer data.
2. Deploy role-based access controls restricting marketplace-seller access to aggregated, pseudonymized, or de-identified data only, and eliminate any reporting-dashboard construct that would expose first-party customer PI to marketplace sellers.
3. Coordinate with Fieldhaven (Marcus Ellerby) on technical implementation as part of the data-mapping tool and DSR-automation workstream; segregation will be a prerequisite to reliable DSR fulfillment.
4. Update the Cascade Digital Marketplace seller terms of service via a Marketplace Seller Data-Use Terms addendum that memorializes the revised data-handling regime and clarifies controller/processor allocations.
Target completion: aligned with Fieldhaven Milestone 1 (data mapping complete), triggering the $945,000 milestone payment under the Fieldhaven statement of work.
Gap 4 — Data-Processing Agreements: 23 of 47 Advertising/Analytics Partners Lack Executed DPAs
A. Finding. Of the 47 third-party advertising and analytics partners identified in the Fieldhaven data-mapping report dated May 19, 2025, twenty-three (23) lack any executed data-processing agreement with Cascade or the relevant Cascade Entity. The remaining twenty-four (24) partners have some form of executed agreement in place, but these agreements are highly inconsistent in form and substance; many predate the CPRA amendments (which took operational effect on January 1, 2023) and lack the contractual terms now required to establish a service-provider or contractor relationship, including use limitations, sub-processor restrictions, compliance certifications, audit rights, and end-of-processing deletion/return obligations.
Absent qualifying DPAs, transfers of PI to these partners will, in most cases, be classified as "sales" or "sharing" under CCPA/CPRA (and as analogous transfers to third parties under the other applicable statutes), thereby triggering consumer-facing disclosure obligations, opt-out rights, and downstream honoring obligations that Cascade is not presently positioned to meet.
The Firm has identified the Thornbridge Media Corp. relationship (FY2024 spend: $18.4 million) as the highest-priority data-sharing relationship within this portfolio. The current arrangement between Cascade and Thornbridge Media does not qualify as a service-provider or contractor relationship under CCPA/CPRA and is not documented by an agreement containing the substantive terms required by § 1798.140(ag) or § 1798.140(j). Thornbridge Media (CEO Robert Shin, General Counsel Leah Voss) is represented in the current renegotiation by Kellner Park & Associates LLP, with Victor Sandoval as lead attorney.
B. Risk Rating: **HIGH**. CCPA/CPRA conditions the service-provider/contractor exemption from "sale" or "sharing" classification on the presence of specified contractual terms; absence of those terms means that the underlying transfers of PI are, as a matter of statutory construction, classified as sales or sharing and are therefore subject to the full complement of consumer-facing disclosure, opt-out, and downstream-honoring obligations. VCDPA, CPA, CTDPA, TDPSA, OCPA, and each other applicable state statute impose analogous processor-agreement requirements.
The California AG's February 2024 inquiry specifically flagged deficient service-provider agreements as an area of concern. The scale of the Thornbridge relationship alone, at $18.4 million in FY2024 spend, would attract regulatory attention if made known.
C. Statutes Implicated.
• CCPA/CPRA §§ 1798.140(ag) (service provider), 1798.140(j) (contractor), 1798.100(d) (contractual requirements for service providers, contractors, and third parties);
• VCDPA § 59.1-579; CPA § 6-1-1305; CTDPA § 42-520; TDPSA § 541.104; OCPA § 646A.582;
• Analogous provisions in each other applicable state statute.
D. Remediation Recommendation.
1. Finalize C&H's master DPA templates, in service-provider and contractor variants respectively, together with a multi-state addendum, by September 30, 2025.
2. Prioritize restructuring of the Thornbridge Media Corp. data-sharing agreement; target execution by October 31, 2025.
3. Develop and execute a third-party vendor DPA rollout plan for the remaining 23 partners lacking executed DPAs, prioritized by data volume and risk tier; target completion by December 31, 2025.
4. Review and update the existing 24 partner agreements to align with current statutory requirements, incorporating amendment or replacement instruments as appropriate.
5. Finalize the OnPoint Data Solutions DPA rider/amendment to the CMP SaaS agreement in parallel with CMP deployment.
Gap 5 — Sensitive Personal Information: Precise Geolocation Processed Without Required Opt-In Consent
A. Finding. The Cascade mobile application collects precise geolocation data from users without obtaining a separate, affirmative opt-in consent for the processing of that data as sensitive personal information. Precise geolocation is classified as "sensitive personal information" under Cal. Civ. Code § 1798.140(ae) and as "sensitive data" under the VCDPA, CPA, CTDPA, OCPA, and other applicable state statutes.
CCPA/CPRA grants consumers the right to limit the use and disclosure of sensitive PI to purposes necessary to perform the services or provide the goods reasonably expected by an average consumer. Cal. Civ. Code § 1798.121. Cascade currently provides no mechanism through which consumers may exercise that right, and it does not display the "Limit the Use of My Sensitive Personal Information" link required by § 1798.135(a)(3) on either cascade.com or the mobile app.
Additional sensitive PI categories processed by Cascade include payment-card data (subject to PCI-DSS controls) and account login credentials (subject to encryption at rest and in transit). While these categories present their own compliance considerations, the primary sensitive-PI gap identified in this Report relates to precise geolocation.
Precise geolocation data is used by Peakview Analytics for location-based ad targeting and by Mr. Leclaire's marketing team for in-store proximity campaigns and geo-fenced push notifications. The commercial value of that data flow is meaningful; however, the current implementation is not legally defensible under the newer state statutes that require opt-in consent for the processing of sensitive data.
B. Risk Rating: **MEDIUM**. Enforcement focus on sensitive-PI consent remains emerging in most states, but California's implementing regulations are specific about both the right to limit use of sensitive PI and the requirement for a conspicuous "Limit the Use of My Sensitive Personal Information" link where sensitive PI is used for purposes beyond those enumerated in § 1798.121(a). The CPA and CTDPA require opt-in consent for processing of sensitive data. The Firm rates the aggregate risk as MEDIUM rather than HIGH primarily because mobile-OS-level location permissions provide a partial (though legally insufficient) layer of user awareness and control.
C. Statutes Implicated.
• CCPA/CPRA §§ 1798.121, 1798.135(a)(3);
• VCDPA § 59.1-574(A)(5) (opt-in consent for processing of sensitive data);
• CPA § 6-1-1308(7); CTDPA § 42-517(a)(5); OCPA § 646A.578(2)(a); TDPSA § 541.101(b)(4); and other analogous provisions.
D. Remediation Recommendation.
1. Implement a separate consent flow within the Cascade mobile application for the collection of precise geolocation data, providing plain-language notice of purpose and a clear right to decline;
2. Deploy the "Limit the Use of My Sensitive Personal Information" link on cascade.com and the mobile application;
3. Coordinate with Fieldhaven and OnPoint on CMP configuration to manage sensitive-PI consent preferences persistently across sessions and devices; and
4. Review and, where appropriate, limit the downstream sharing of geolocation data with Peakview and third-party partners.
Target implementation: aligned with CMP deployment on December 15, 2025.
Gap 6 — No Documented Data-Retention Schedule
A. Finding. Cascade has no documented, written data-retention schedule for any category of personal information. This is true for customer-transaction data, loyalty-program data, employee and job-applicant data, marketing and advertising data, marketplace-seller data, and website-analytics data. CCPA/CPRA requires disclosure of retention periods (or, in the alternative, of the criteria used to determine those periods) in the privacy notice. Cal. Civ. Code § 1798.100(a)(3). Multiple other statutes impose data-minimization requirements that presuppose a documented retention framework.
In practice, based on the Firm's interviews with Ms. Nandakumar and Mr. Farris, Cascade retains customer-transaction data indefinitely in its data warehouse; retains loyalty-program data for the life of the account plus an undefined post-closure period; and applies no expiration or deletion policy to marketing cookies and behavioral data. These practices are inconsistent with the data-minimization principles that inform the newer state statutes and are increasingly disfavored by the FTC.
B. Risk Rating: **MEDIUM**. Indefinite retention of PI amplifies the potential impact of any data breach and may itself be characterized as a failure of data minimization under CCPA/CPRA and analogous state statutes. The absence of retention periods in the current privacy notice constitutes a disclosure deficiency independently addressed in Gap 1. Regulatory scrutiny of retention practices is increasing, and the FTC has emphasized data minimization in a series of recent consent orders. The Firm rates the risk as MEDIUM rather than HIGH because enforcement of retention-specific requirements remains uncommon as a standalone matter.
C. Statutes Implicated.
• CCPA/CPRA § 1798.100(a)(3);
• Data-minimization obligations under CPA § 6-1-1308(3), CTDPA § 42-520(a)(1), VCDPA § 59.1-578(A)(1), OCPA § 646A.578(1), and other analogous provisions.
D. Remediation Recommendation.
1. Develop a comprehensive data-retention and disposal schedule covering all categories of PI, with retention periods justified by documented business need and legal requirements;
2. Define legal-hold triggers, secure-disposal methods (including cryptographic deletion, anonymization, and physical destruction where applicable), and responsible business units for each retention category;
3. Incorporate the resulting retention periods into the omnibus privacy policy and the California-specific disclosures addendum; and
4. Coordinate with Mr. Farris on the technical implementation of automated retention/disposal controls in the underlying data-warehouse and marketing-technology environments.
Target completion: October 2025.
Gap 7 — DSR Portal: Deficient Identity Verification and Missing Appeal-Process Functionality
A. Finding. Cascade's existing consumer-rights intake portal (the "DSR portal") does not verify consumer identity to CCPA standards. The current process relies solely on email-address matching without incorporating any reasonable verification steps of the kind contemplated by 11 CCR §§ 7060–7062.
Cascade further has no appeal-process functionality — a per se requirement of the VCDPA, CPA, CTDPA, and multiple other state statutes whenever a consumer-rights request is denied in whole or in part.
The average DSR response time in FY2024 was 27 calendar days. That figure exceeds the internal 15-business-day target that will be established under the program, and it approaches the 45-calendar-day CCPA deadline, creating meaningful operational risk of deadline breaches as DSR volumes grow. FY2024 DSR volumes are summarized in Section III.C and Appendix D.
There is no centralized DSR tracking system. Requests are routed via email to various business units and processed with material inconsistency across those units. The Firm's interviews indicate that opt-out-of-sale/sharing requests, in particular, are frequently mishandled or lost.
B. Risk Rating: **HIGH** (aggregate). Identity-verification failures create bilateral risk: on one hand, over-disclosure (responding to fraudulent requests with another consumer's PI, which itself gives rise to breach exposure); on the other, under-response (rejecting legitimate requests, which gives rise to enforcement and reputational exposure). Absence of an appeal process is a per se violation of VCDPA § 59.1-577(A), CPA § 6-1-1306(4), CTDPA § 42-519, and analogous provisions. The 27-day average response time indicates systemic capacity constraints that will worsen as additional state statutes take effect and as consumer awareness continues to drive DSR-volume growth.
C. Statutes Implicated.
• CCPA/CPRA §§ 1798.130, 1798.185; 11 CCR §§ 7060–7063 (verification);
• VCDPA § 59.1-577(A); CPA § 6-1-1306(4); CTDPA § 42-519; TDPSA § 541.053; OCPA § 646A.574; and analogous provisions in each other applicable state statute.
D. Remediation Recommendation.