PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 600 Lexington Avenue, 28th Floor New York, NY 10022
Matter No.: 1038-00010
MEMORANDUM
TO: Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP
FROM: Sara Hendricks, Associate, Privacy & Data Security, Calderwood & Harkness LLP
DATE: July 28, 2025
RE: Cascade Retail Holdings Inc. — Analysis of Sensitive Personal Information Processing Under CCPA/CPRA and Multi-State Privacy Statutes
CLIENT: Cascade Retail Holdings Inc. (Nasdaq: CSRD)
MATTER: US State Privacy Compliance Program — Phase 1 Assessment
This memorandum is a privileged and confidential attorney-client communication and attorney work product. It is intended solely for the use of Calderwood & Harkness LLP attorneys working on the above-referenced matter. This memorandum should not be disclosed to any third party without the express written consent of the client and supervising attorneys. Any unauthorized disclosure may result in a waiver of applicable privileges.
I. Executive Summary
This memorandum provides a comprehensive analysis of Cascade Retail Holdings Inc.'s ("Cascade" or the "Company") current processing activities involving sensitive personal information ("Sensitive PI") across the full breadth of its retail, e-commerce, mobile-application, loyalty-program, and advertising-technology operations. The purpose of this analysis is to identify areas where Cascade's data-processing practices implicate the Sensitive PI frameworks established under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), and the remaining applicable state privacy statutes among the nineteen identified in the Multi-State Privacy Law Applicability Matrix dated June 30, 2025 (prepared by Calderwood & Harkness and distributed to Diana Polk on July 2, 2025).
Based on our review of the Fieldhaven Consulting Group LLC ("Fieldhaven") data-mapping report dated May 19, 2025 (the "Fieldhaven Report"), our Data-Mapping Review Memorandum dated July 14, 2025, interviews with key Cascade stakeholders, and an independent analysis of applicable legal requirements, we have identified three principal categories of Sensitive PI that Cascade currently processes and that trigger compliance obligations:
1. Precise geolocation data collected via the Cascade mobile application (iOS and Android), which captures latitude and longitude coordinates within a radius of 1,750 feet or less when location services are enabled by the user;
2. Payment-card data, including credit and debit card numbers, card verification values ("CVVs"), expiration dates, and cardholder names, processed across approximately 94 million annual online transactions conducted through cascade.com and the Cascade mobile app, as well as point-of-sale transactions at 186 retail locations in 31 states; and
3. Account login credentials, specifically email address and password combinations, maintained for approximately 41.2 million registered Cascade Rewards loyalty-program members.
Each of these categories falls squarely within the statutory definition of "sensitive personal information" under CCPA/CPRA (Cal. Civ. Code § 1798.140(ae)), and precise geolocation data further qualifies as "sensitive data" under the VCDPA, Colorado CPA, CTDPA, and the majority of the other applicable state privacy statutes.
Our analysis has identified a critical compliance gap: Cascade currently processes precise geolocation data from its mobile application without obtaining separate, affirmative opt-in consent as required under CCPA/CPRA and without obtaining consumer consent meeting the statutory thresholds prescribed by the VCDPA, Colorado CPA, CTDPA, and analogous statutes in Oregon, Texas, and other jurisdictions. Instead, Cascade relies solely on the device-level operating-system permissions prompt (the standard iOS or Android location-services dialog), which does not provide Cascade-specific disclosures regarding the purposes of geolocation-data collection, the categories of recipients with whom such data is shared, or the consumer's right to limit such processing. This deficiency was initially flagged as Gap No. 5 in the Fieldhaven Report and was confirmed through our independent legal analysis in Calderwood & Harkness's Data-Mapping Review Memorandum dated July 14, 2025.
Compounding this gap, Cascade does not provide consumers with a "Limit the Use of My Sensitive Personal Information" link or mechanism on cascade.com or within the mobile application, as required by CCPA/CPRA § 1798.121, nor does Cascade's existing privacy policy — which was last updated in March 2022 and substantially predates the operative date of the CPRA regulations — disclose the collection and sharing of precise geolocation as Sensitive PI or inform consumers of their right to limit such processing. These omissions are part of a broader pattern: the current privacy policy does not address fourteen of the nineteen applicable state privacy statutes identified in our Multi-State Privacy Law Applicability Matrix.
We recommend that Cascade take the following actions as a matter of priority:
• Implement a separate, affirmative consent flow for precise geolocation collection and use for marketing and advertising purposes in the Cascade mobile application, designed to meet the most stringent applicable consent standard across all nineteen state statutes;
• Deploy the CCPA/CPRA "right to limit use and disclosure of sensitive personal information" mechanism across cascade.com and the Cascade mobile application, integrated with the consent-management platform ("CMP") being implemented by Fieldhaven with OnPoint Data Solutions Inc.'s CMP technology;
• Cease sharing precise geolocation data with third-party advertising and analytics partners until compliant consent mechanisms and data-processing agreements are in place; and
• Ensure that payment-card data and account login credentials are processed only for purposes permitted without additional consent under each applicable statute, and that such processing is properly disclosed in the updated Omnibus Privacy Policy.
The detailed analysis, gap identification, and full set of recommendations are set forth below.
II. Scope and Purpose
A. Engagement Context
Calderwood & Harkness LLP was formally engaged by Cascade Retail Holdings Inc. on June 2, 2025, pursuant to an engagement letter executed by Kevin Ostrowski (Calderwood & Harkness) and Diana Polk (Associate General Counsel and Interim Chief Privacy Officer, Cascade), to design and implement a comprehensive United States state-privacy compliance program. The engagement encompasses the full lifecycle of Cascade's privacy-compliance posture, from data-mapping and gap analysis through policy drafting, consent-mechanism implementation, vendor-management protocols, and governance-framework design. The engagement is structured in three phases, with Phase 1 (data mapping, gap analysis, and initial remediation planning) running through December 31, 2025.
The Phase 1 kickoff and data-mapping workshop took place on June 16, 2025, at Cascade's corporate headquarters in Portland, Oregon, with attendance by Calderwood & Harkness (Kevin Ostrowski, Alan Burke, Sara Hendricks), Fieldhaven Consulting Group LLC (Marcus Ellerby, Engagement Lead; Tara Connors, Senior Privacy Analyst), and Cascade stakeholders including Diana Polk, Gregory Farris (Chief Information Security Officer), Priya Nandakumar (Vice President, Data & Analytics), and Jason Leclaire (Vice President, Marketing & Customer Engagement). During this workshop, the parties reviewed Cascade's existing data-collection practices, system architecture, vendor relationships, and privacy-policy documentation. Following the workshop, Fieldhaven conducted the data-mapping engagement that culminated in its report dated May 19, 2025 (which was based on fieldwork commenced prior to Calderwood & Harkness's engagement and completed in coordination with our team).
The Comprehensive Gap-Analysis Report, which will synthesize all findings from the data-mapping review, this Sensitive PI analysis, and additional workstreams, is due for delivery to Cascade on August 15, 2025.
B. Purpose and Downstream Deliverables
This memorandum serves several purposes within the Phase 1 engagement:
• It provides the definitive legal analysis of Cascade's Sensitive PI processing activities, identifying applicable legal requirements and compliance gaps;
• It feeds directly into the forthcoming Comprehensive Gap-Analysis Report and will be incorporated by reference therein;
• It informs the drafting of the Omnibus Privacy Policy (target completion date: September 12, 2025), including the California-Specific Privacy Disclosures Addendum, by identifying the specific Sensitive PI disclosures required under CCPA/CPRA and other state statutes;
• It provides guidance for the configuration and deployment of the consent-management platform being implemented by Fieldhaven Consulting Group LLC (Marcus Ellerby, Engagement Lead) utilizing OnPoint Data Solutions Inc.'s CMP technology, particularly with respect to the precise-geolocation consent flow and the "right to limit" mechanism; and
• It will inform the negotiation of the restructured data-sharing agreement with Thornbridge Media Corp. and the Third-Party Vendor DPA Rollout Plan.
C. Scope of Analysis
The scope of this analysis encompasses all Sensitive PI processing activities conducted by Cascade Retail Holdings Inc. and its subsidiaries, specifically:
• Cascade Digital Marketplace LLC, the entity that operates the cascade.com e-commerce platform and the Cascade mobile application;
• Peakview Analytics Inc., Cascade's in-house data-analytics subsidiary, which processes consumer-event data (approximately 2.1 billion records per month) for store-visit attribution, audience analytics, and campaign measurement;
• Cascade Rewards Corp. (EIN: 86-3381729), the entity that operates the Cascade Rewards loyalty program and maintains accounts for approximately 41.2 million members; and
• Ridgeline Fulfillment Services Inc., which manages order fulfillment and logistics and processes certain payment-card data in connection with shipping and delivery operations.
The analysis covers Sensitive PI processing across all consumer-facing channels, including the Cascade mobile application (iOS and Android), cascade.com, in-store point-of-sale systems, and the Cascade Rewards loyalty-program platform. Employee and job-applicant sensitive data (including Social Security numbers, background-check data, and similar categories) is being addressed separately in the Employee & Job-Applicant Privacy Notice workstream and is outside the scope of this memorandum.
D. Primary Client Contacts
In preparing this memorandum, we consulted with the following Cascade personnel:
• Diana Polk, Associate General Counsel and Interim Chief Privacy Officer — overall legal oversight of the privacy-compliance program, point of contact for legal-strategy decisions;
• Gregory Farris, Chief Information Security Officer — oversight of payment-card data security, PCI-DSS compliance, tokenization and encryption protocols, credential-storage practices, and MFA implementation;
• Priya Nandakumar, Vice President, Data & Analytics — oversight of Peakview Analytics operations, geolocation data processing and analytics, and data flows to and from third-party advertising and analytics partners; and
• Jason Leclaire, Vice President, Marketing & Customer Engagement — oversight of geo-targeted marketing campaigns, push-notification strategies, advertising-partner relationships, and the Cascade Rewards loyalty program.
Additionally, we reviewed materials provided by Fieldhaven Consulting Group LLC and held working sessions with Marcus Ellerby (Engagement Lead) and Tara Connors (Senior Privacy Analyst) on July 8 and July 21, 2025.
III. Factual Background — Cascade's Sensitive PI Processing Activities
This section describes Cascade's current processing activities for each identified category of Sensitive PI. The factual basis for these descriptions is drawn from the Fieldhaven Report dated May 19, 2025, Calderwood & Harkness's Data-Mapping Review Memorandum dated July 14, 2025, and our interviews with Cascade stakeholders conducted between June 16 and July 25, 2025.
A. Precise Geolocation Data
1. Collection Mechanism
The Cascade mobile application, available on both iOS and Android platforms, collects precise geolocation data when the device's location services are enabled by the user. As documented in the Fieldhaven Report, the application utilizes the GPS, Wi-Fi, and cellular-triangulation capabilities of the user's device to determine the user's latitude and longitude coordinates with a precision of approximately 1,750 feet or less — a level of precision that meets or exceeds the threshold for "precise geolocation" under every applicable state statute that defines the term. The application requests location-services permissions through the standard iOS and Android operating-system permissions dialogs, offering "While Using the App" and "Always" options on iOS, and "While Using the App," "Only This Time," and "Allow All the Time" options on Android.
As of the date of this memorandum, the Cascade mobile application has been downloaded approximately 28.6 million times across both platforms. According to data provided by Priya Nandakumar, approximately 17.3 million active users (defined as users who have opened the application at least once in the prior 90 days) have location services enabled at the "While Using the App" level or higher.
2. Purposes of Use
Cascade utilizes the precise geolocation data collected through the mobile application for three principal purposes:
(i) In-store navigation and product finding. When a user is located within or near one of Cascade's 186 retail locations, the application provides in-store navigation features, including aisle-level product location, store maps, and wayfinding to specific product categories. This functionality is a core feature of the application and was a primary justification for the geolocation-collection functionality when the application was initially developed in 2019.
(ii) Geo-targeted push notifications and promotions. The marketing team, under Jason Leclaire's direction, uses geolocation data to trigger push notifications and promotional offers when users are within a defined geofenced area around Cascade retail locations, competitor locations, or specific geographic zones identified for campaign targeting. Leclaire confirmed in our July 10, 2025 interview that approximately 340 million geo-triggered push notifications were delivered in the twelve months ending June 30, 2025.
(iii) Store-visit attribution analytics. Geolocation data is transmitted to Peakview Analytics Inc. for processing in connection with store-visit attribution modeling. Peakview ingests geolocation data as part of the approximately 2.1 billion consumer-event data records it processes per month across all data categories. The store-visit attribution models are used to measure the effectiveness of Cascade's digital advertising campaigns by correlating ad exposures with subsequent physical visits to Cascade retail locations. Priya Nandakumar confirmed that store-visit attribution is a key performance metric reported to Jason Leclaire's marketing team and to the executive leadership team on a monthly basis.
3. Third-Party Sharing
The Fieldhaven Report identified 47 third-party advertising and analytics partners with whom Cascade shares consumer data. Of these 47 partners, the Fieldhaven Report determined that at least 14 receive precise geolocation data from Cascade, either directly through API integrations or indirectly through the advertising-technology ecosystem (including real-time bidding platforms and data-management platforms). These 14 partners include Cascade's primary programmatic-advertising partner, Thornbridge Media Corp., as well as several demand-side platforms, supply-side platforms, and data-analytics vendors.
The geolocation data shared with these partners is used for audience targeting (identifying consumers who have visited Cascade locations or competitor locations), campaign measurement (measuring the effectiveness of advertising spend by correlating ad exposures with geolocation-confirmed store visits), and lookalike-audience modeling (developing audience profiles based on the behavioral patterns of consumers who have visited Cascade locations).
4. Current Consent and Disclosure Practices
This is the area of most significant concern. As of the date of this memorandum:
• No separate opt-in consent mechanism exists for the collection of precise geolocation data beyond the device-level operating-system permissions prompt. The Cascade mobile application does not present its own consent dialog, does not identify Cascade by name in connection with geolocation data collection (beyond what the OS prompt provides), and does not disclose the specific purposes for which geolocation data will be used or the categories of recipients with whom it will be shared.
• No "right to limit" mechanism is presented to consumers within the application or on cascade.com. There is no "Limit the Use of My Sensitive Personal Information" link on any Cascade digital property.
• Cascade's existing privacy policy (last updated March 2022) does not specifically disclose the collection and sharing of precise geolocation as Sensitive PI. The policy contains a general reference to "location information" in a list of data categories collected, but does not distinguish between precise and imprecise geolocation, does not identify geolocation as Sensitive PI, does not disclose the purposes for which geolocation data is used with specificity, does not identify the categories of third-party recipients, and does not inform consumers of their right to limit the use of Sensitive PI.
This state of affairs was initially flagged as Gap No. 5 in the Fieldhaven Report and was confirmed and further analyzed in Calderwood & Harkness's Data-Mapping Review Memorandum dated July 14, 2025.
B. Payment-Card Data
1. Collection and Processing
Cascade processes payment-card data — specifically, credit and debit card numbers, card verification values (CVVs), expiration dates, and cardholder names — in connection with consumer purchases. The Company processes approximately 94 million online transactions per year through cascade.com and the Cascade mobile application, in addition to point-of-sale transactions at its 186 retail locations across 31 states. Payment-card data is collected at the point of transaction through Cascade's e-commerce checkout flow (powered by an integration with its payment processor) and through payment terminals at physical retail locations.
2. Security Controls
Payment-card data is handled in compliance with Payment Card Industry Data Security Standard ("PCI-DSS") requirements under the oversight of CISO Gregory Farris. Farris confirmed in our June 25, 2025 interview that Cascade maintains PCI-DSS Level 1 compliance, validated through annual audits conducted by its Qualified Security Assessor. Tokenization is employed for all stored card-on-file data: when a consumer saves a payment method in their Cascade Rewards account, the actual card number is replaced with a token, and the primary account number is stored only in the payment processor's secure vault environment. CVVs are never stored after transaction authorization.
3. Limited Sharing and Use
Critically, payment-card data is not shared with advertising or analytics partners. Based on our review of the Fieldhaven Report and confirmation from Gregory Farris, payment-card data processing is limited to the following purposes:
(i) Transaction authorization and settlement with Cascade's payment processor;
(ii) Fraud prevention and detection, including integration with third-party fraud-scoring services;
(iii) Order fulfillment, including transmission of necessary payment information to Ridgeline Fulfillment Services Inc. for order processing; and
(iv) Chargebacks, refunds, and customer-service resolution.
4. Cascade Rewards Stored Payment Instruments
Cascade Rewards Corp. (EIN: 86-3381729) maintains tokenized payment instruments for the approximately 41.2 million loyalty-program members who have opted to save a payment method to their account. As noted above, these stored instruments are tokenized; the actual card numbers are not stored in Cascade Rewards Corp.'s databases. The tokens are used to facilitate one-click checkout and recurring subscription purchases.
C. Account Login Credentials
1. Collection and Storage
Cascade maintains approximately 41.2 million registered Cascade Rewards loyalty-program accounts. Each account is established with email-based login credentials consisting of an email address and a user-created password. Passwords are stored using bcrypt hashing with a work factor of 12, a practice that Gregory Farris confirmed during our June 25, 2025 interview is consistent with current industry best practices.
2. Purposes of Use
Account login credentials are used solely for the following purposes:
(i) Consumer account authentication (login to cascade.com and the Cascade mobile application);
(ii) Security purposes, including account-recovery processes, suspicious-activity detection, and brute-force login-attempt prevention; and
(iii) Communications related to account security (e.g., password-reset requests, security alerts).
Login credentials are not shared with any third parties, are not used for marketing purposes, and are not transmitted to advertising or analytics partners.
3. Multi-Factor Authentication
Multi-factor authentication ("MFA") is available to consumers as an optional security feature but is not currently mandatory for consumer accounts. CISO Gregory Farris has recommended that MFA be made mandatory for all Cascade Rewards accounts, and this recommendation is under consideration by the executive team. As of the date of this memorandum, approximately 6.8 million of the 41.2 million Cascade Rewards accounts (approximately 16.5%) have voluntarily enabled MFA. While the MFA question is primarily a cybersecurity matter, we note that the implementation of mandatory MFA could have collateral privacy implications (e.g., if Cascade begins collecting phone numbers for SMS-based MFA from consumers who have not previously provided them), and we recommend coordinating with Gregory Farris on this point as the decision is finalized.
D. Other Potential Sensitive PI Categories
In addition to the three principal categories identified above, we assessed whether Cascade collects any other categories of information that qualify as Sensitive PI under the various applicable state privacy statutes. Those additional categories include: racial or ethnic origin; religious or philosophical beliefs; health information; sexual orientation; citizenship or immigration status; genetic data; biometric data processed for the purpose of uniquely identifying an individual; personal data of known children under the age of thirteen (or sixteen, depending on the statute); financial account information beyond payment-card data; Social Security numbers; and driver's license or state identification numbers.
1. Findings. Based on our review of the Fieldhaven Report and our interviews with Cascade stakeholders, we determined the following:
• Cascade does not systematically collect racial or ethnic origin, religious beliefs, health information, sexual orientation, citizenship or immigration status, genetic data, or biometric data from consumers in the ordinary course of its retail, e-commerce, or loyalty-program operations.
• Limited demographic information is voluntarily provided by some Cascade Rewards loyalty-program members through optional profile fields. These fields include date of birth, gender, and zip code. Cascade does not currently offer profile fields for race, ethnicity, religion, or sexual orientation. However, we note that Peakview Analytics Inc. generates inferred demographic attributes (including estimated household income, estimated age range, and inferred product-category preferences) based on purchase-history and behavioral data. Under certain state statutes, inferences derived from personal information may themselves constitute personal information, and if such inferences touch upon protected categories, they could potentially be classified as Sensitive PI. This issue warrants further analysis in the Comprehensive Gap-Analysis Report.
• Cascade Rewards stored-value cards involve limited financial account information (stored-value card numbers and balances). These instruments are distinct from the payment-card data discussed in Section III.B above and are issued by Cascade Rewards Corp. The stored-value card program involves a relatively small number of accounts (approximately 3.2 million active stored-value cards as of June 30, 2025) and limited data elements. Financial account information may qualify as Sensitive PI under CCPA/CPRA's definition, and this category should be addressed in the updated privacy disclosures.
• Cascade does not collect Social Security numbers or driver's license numbers from consumers. These data elements are collected in the employee and job-applicant context, which is addressed separately in the Employee & Job-Applicant Privacy Notice workstream.
• Children's data: Cascade does not knowingly collect personal information from children under the age of thirteen. The Cascade mobile application and cascade.com include a minimum-age requirement of thirteen years in the terms of service. However, Cascade does not employ age-verification mechanisms beyond the self-certification at account registration. The question of whether additional age-gating measures are warranted — particularly in light of recent state legislation targeting online platforms' collection of minors' data — is being addressed in a separate workstream and is outside the scope of this memorandum.
2. Employee and Applicant Data
As noted above, Cascade collects various categories of Sensitive PI from employees and job applicants, including Social Security numbers, background-check information, and other categories that fall within Sensitive PI definitions under multiple state statutes. This processing is being addressed in the Employee & Job-Applicant Privacy Notice workstream, with a separate memorandum forthcoming from Alan Burke. The analysis in this memorandum is limited to consumer-facing Sensitive PI processing.
IV. Legal Analysis — CCPA/CPRA (Cal. Civ. Code § 1798.121)
California's CCPA/CPRA framework represents the most comprehensive state-level Sensitive PI regulatory scheme and establishes the baseline for Cascade's compliance obligations. Cascade has substantial nexus with California: the Company operates 27 retail locations in the state, serves millions of California residents through cascade.com and the mobile application, and generates a significant portion of its annual revenue from California-based consumers. There is no question that Cascade meets the CCPA/CPRA applicability thresholds.
A. Definition of Sensitive Personal Information Under CCPA/CPRA
California Civil Code § 1798.140(ae) defines "sensitive personal information" to include the following enumerated categories:
(1) Personal information that reveals a consumer's Social Security number, driver's license number, state identification card number, or passport number;
(2) A consumer's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;
(3) A consumer's precise geolocation;
(4) A consumer's racial or ethnic origin, religious or philosophical beliefs, or union membership;
(5) The contents of a consumer's mail, email, and text messages, unless the business is the intended recipient of the communication;
(6) A consumer's genetic data;
(7) The processing of biometric information for the purpose of uniquely identifying a consumer;
(8) Personal information collected and analyzed concerning a consumer's health; and
(9) Personal information collected and analyzed concerning a consumer's sex life or sexual orientation.
Applying this definition to Cascade's data-processing activities:
• Precise geolocation data collected by the Cascade mobile application falls squarely within category (3). The California Attorney General's office and the California Privacy Protection Agency ("CPPA") have consistently indicated that latitude/longitude coordinates collected with a precision of 1,750 feet or less constitute "precise geolocation" for purposes of this definition.
• Payment-card data falls within category (2), as Cascade collects credit and debit card numbers in combination with CVVs and expiration dates — i.e., "in combination with any required security or access code . . . or credentials allowing access to an account."
• Account login credentials (email address and hashed password) fall within category (2), as they constitute "account log-in . . . in combination with . . . credentials allowing access to an account."
All three principal categories of Sensitive PI identified in this memorandum are therefore subject to the CCPA/CPRA Sensitive PI framework.
B. Right to Limit Use and Disclosure (§ 1798.121)
California Civil Code § 1798.121(a) provides that a consumer has the right to direct a business that collects Sensitive PI to limit its use of the consumer's Sensitive PI to those uses that are "necessary to perform the services or provide the goods reasonably expected by an average consumer who requests such goods or services." Section 1798.121(a) further provides that a business shall restrict its use of Sensitive PI to those necessary purposes, or to uses authorized by subsequent statutory provisions, if the consumer exercises this right.
Under § 1798.121(b), a business that collects Sensitive PI must provide a clear and conspicuous link on its internet homepage titled "Limit the Use of My Sensitive Personal Information" that enables consumers to exercise this right. Alternatively, the business may use a single, combined link titled "Your Privacy Choices" or "Your California Privacy Choices" if that link provides the ability to exercise both the right to opt out of sale/sharing and the right to limit the use of Sensitive PI, and if the link is accompanied by an opt-out preference signal icon.
CPRA regulations adopted by the CPPA further clarify the implementation requirements for the right-to-limit mechanism, including requirements related to the prominence of the link, the response timeframe (fifteen business days), and the prohibition on requiring consumers to create an account to exercise the right.
Current State. Cascade does not provide a "Limit the Use of My Sensitive Personal Information" link on cascade.com, in the Cascade mobile application, or on any other Cascade digital property. The Company also does not provide a "Do Not Sell or Share My Personal Information" link (a separate deficiency identified as Gap No. 2 in the Fieldhaven Report). No combined link is provided. The existing privacy policy (last updated March 2022) does not reference the right to limit or the Sensitive PI framework in any respect.
This is a significant compliance gap. As discussed in Section VIII below, this gap is rated as HIGH risk, given the volume of California consumers affected and the regulatory focus on Sensitive PI by the California Attorney General and the CPPA.
C. Opt-In Consent for Non-Essential Uses
Under the CPRA regulatory framework, if a business wishes to use or disclose Sensitive PI for purposes beyond those "necessary to perform the services or provide the goods reasonably expected by an average consumer," it must either (i) provide the right-to-limit mechanism and honor consumer requests submitted through that mechanism, or (ii) obtain the consumer's affirmative opt-in consent to such additional uses.
The uses that are considered "necessary to perform the services or provide the goods reasonably expected" are defined narrowly in the CPRA regulations and include purposes such as:
• Performing the services or providing the goods requested by the consumer;
• Ensuring security and integrity;
• Short-term transient use (not including disclosing to third parties or building consumer profiles);
• Performing services on behalf of the business (e.g., customer service, order processing, payment processing);
• Verifying or maintaining the quality or safety of the business's services or goods; and
• Other enumerated purposes.
Cascade's use of precise geolocation data for geo-targeted advertising, push-notification marketing, and sharing with third-party advertising partners for audience targeting and campaign measurement constitutes use beyond what is "necessary to perform the services reasonably expected by an average consumer." While the in-store navigation and product-finding functionality could be argued to be a reasonably expected service, the marketing and advertising uses — and particularly the sharing with third-party advertising partners — clearly exceed this standard. An average consumer requesting in-store navigation assistance would not reasonably expect that their precise location data would be transmitted to fourteen third-party advertising and analytics partners for audience targeting and campaign measurement purposes.
Recommendation. We recommend that Cascade implement both mechanisms:
(i) A "Limit the Use of My Sensitive Personal Information" link and mechanism on cascade.com and in the mobile application, enabling California consumers (and, as discussed below, consumers in other applicable jurisdictions) to direct Cascade to limit its use of their Sensitive PI to necessary purposes; and
(ii) A separate, granular opt-in consent flow specifically for the collection and use of precise geolocation data for marketing and advertising purposes, presented within the mobile application at the point of geolocation-data collection.
This dual approach provides the maximum flexibility for Cascade's business operations while ensuring compliance. Consumers who affirmatively opt in to geolocation-based marketing will be able to receive the full suite of geo-targeted features. Consumers who decline or who subsequently exercise their right to limit will have their geolocation data used only for the in-store navigation functionality (a permissible "reasonably expected" use), and sharing with third-party advertising partners will be suppressed.
D. Disclosure Obligations
CCPA/CPRA imposes extensive disclosure requirements regarding Sensitive PI. Specifically, the privacy policy must disclose:
(i) The categories of Sensitive PI that the business collects;
(ii) The purposes for which each category of Sensitive PI is collected and used;
(iii) Whether each category of Sensitive PI is sold or shared (as those terms are defined under CCPA/CPRA);
(iv) The length of time the business intends to retain each category of Sensitive PI, or if that is not possible, the criteria used to determine such period; and
(v) The consumer's right to limit the use and disclosure of Sensitive PI, including instructions on how to exercise that right.
Cascade's current privacy policy (last updated March 2022) fails to meet any of these disclosure requirements. The policy does not identify "sensitive personal information" as a category, does not describe the right to limit, and does not provide the specificity required for the categories of Sensitive PI collected or the purposes of their use. These deficiencies must be addressed in the Omnibus Privacy Policy (target completion: September 12, 2025) and the California-Specific Privacy Disclosures Addendum. The drafting of these documents is a separate workstream within the Phase 1 engagement, and the analysis in this memorandum will directly inform the Sensitive PI sections of those documents.
E. Data Minimization and Retention
The CPRA introduced data-minimization and purpose-limitation principles into California privacy law. Under Cal. Civ. Code § 1798.100(c), a business's collection, use, retention, and sharing of personal information must be "reasonably necessary and proportionate" to achieve the purposes for which the personal information was collected or processed, or another disclosed purpose that is compatible with the context in which the personal information was collected. These principles apply with full force to Sensitive PI.
CPRA regulations further require that businesses establish, document, and comply with retention schedules for each category of personal information, including Sensitive PI. Businesses must not retain personal information for longer than is reasonably necessary for the disclosed purpose of collection.
Cascade currently has no documented data-retention schedule for any category of consumer personal information, including Sensitive PI. This was identified as Gap No. 6 in the Fieldhaven Report. Gregory Farris confirmed that while payment-card data is subject to PCI-DSS retention requirements (and CVVs are never stored post-authorization), there is no formal retention policy governing the duration for which geolocation data, loyalty-account credentials, or other categories of consumer data are maintained. Priya Nandakumar indicated that Peakview Analytics retains consumer-event data (including geolocation records) indefinitely in its data warehouse, subject to storage-capacity constraints.
The absence of a retention schedule presents a compliance risk under CCPA/CPRA and other state statutes that incorporate data-minimization principles. A Data Retention & Disposal Schedule is a Phase 1 deliverable with a target completion date of October 2025. We recommend establishing specific retention limits for geolocation data — for example, a maximum retention period of twenty-four months for raw geolocation records used for analytics purposes, with shorter retention periods for geolocation data used for real-time marketing triggers (which may be retained only for the duration necessary to deliver the geo-targeted content and then aggregated or deleted).
V. Legal Analysis — Virginia Consumer Data Protection Act (VCDPA)
A. Definition of Sensitive Data Under VCDPA
The Virginia Consumer Data Protection Act, codified at Va. Code § 59.1-575 et seq., defines "sensitive data" to include:
(i) Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status;
(ii) The processing of genetic or biometric data for the purpose of uniquely identifying a natural person;
(iii) The personal data collected from a known child; and
(iv) Precise geolocation data.
Notably, the VCDPA's definition of "sensitive data" does not explicitly include account login credentials or financial account/payment-card information in the manner that CCPA/CPRA does. Virginia's sensitive-data definition is narrower in this respect, focusing on the categories enumerated above. Accordingly, while Cascade's collection of precise geolocation data unquestionably triggers the VCDPA's sensitive-data provisions, the processing of payment-card data and account login credentials does not trigger the heightened consent requirements under the VCDPA (though such processing remains subject to the VCDPA's general data-protection obligations, including the duty to limit collection to data that is adequate, relevant, and reasonably necessary for the disclosed purposes).
Cascade has a meaningful presence in Virginia, operating retail locations in the Commonwealth and serving Virginia residents through its e-commerce and mobile-application platforms. The Company meets the VCDPA's jurisdictional thresholds.
B. Consent Requirement
Virginia Code § 59.1-578(A)(5) requires that a controller obtain the consumer's consent before processing sensitive data. This is a mandatory, affirmative opt-in requirement — not merely an opt-out right, as is the default for non-sensitive personal data under the VCDPA.
The VCDPA defines "consent" in § 59.1-575 as "a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer." The statute further specifies that consent may include "a written statement, including a statement written by electronic means, or any other unambiguous affirmative action." Importantly, consent does not include:
• Acceptance of a general or broad terms of use or similar document that contains descriptions of personal-data processing along with other, unrelated information;
• Hovering over, muting, pausing, or closing a given piece of content; or
• Agreement obtained through the use of dark patterns.
Current Gap. Cascade's current approach to geolocation data collection — relying solely on the device-level operating-system location-services permission prompt — presents a significant compliance gap under the VCDPA. The device-level OS permissions prompt is generated by Tidewater Industries (iOS) or Severin Industries (Android), not by Cascade, and provides only generic information about the application's request to access location data. It does not:
• Identify Cascade Retail Holdings Inc. by name or provide Cascade-specific information about the purposes of geolocation-data collection;
• Disclose the specific purposes for which Cascade will use the geolocation data (e.g., in-store navigation, geo-targeted marketing, store-visit attribution analytics);
• Identify the categories of third-party recipients with whom Cascade shares geolocation data;
• Inform the consumer that precise geolocation constitutes "sensitive data" under applicable law; or
• Provide sufficient specificity to constitute the "freely given, specific, informed, and unambiguous agreement" required under the VCDPA.
While the device-level permissions prompt is arguably a "clear affirmative act" in the sense that the consumer must take an affirmative action to grant the permission, it is not "specific" or "informed" within the meaning of the VCDPA because it does not convey Cascade-specific information about the purposes of collection and the recipients of the data. The Virginia Attorney General's office has not issued formal guidance on whether OS-level permissions satisfy the VCDPA consent standard, but the weight of commentary from privacy practitioners and the statute's plain language suggest that they do not.
Recommendation. We recommend that Cascade deploy an in-app consent dialog that is presented to the consumer either before or immediately after the device-level OS permissions prompt. This Cascade-specific consent dialog should:
• Identify Cascade Retail Holdings Inc. by name;
• Clearly state that Cascade is requesting permission to collect the consumer's precise geolocation data;
• Specify the purposes for which geolocation data will be used, including in-store navigation, geo-targeted marketing and push notifications, and store-visit attribution analytics;
• Identify the categories of recipients with whom geolocation data is shared (e.g., advertising partners, analytics providers);
• Provide a clear, granular opt-in mechanism (e.g., separate toggles for "Use my location for in-store navigation" and "Use my location for personalized offers and marketing");
• Provide an easy-to-use mechanism for the consumer to withdraw consent at any time (accessible through the application's settings menu); and
• Not bundle the geolocation consent with acceptance of the general terms of service or other unrelated permissions.
This consent dialog should be designed to meet the VCDPA's requirements and, as discussed below, can be configured to simultaneously satisfy the consent requirements of the Colorado CPA, CTDPA, and other applicable state statutes.
VI. Legal Analysis — Colorado Privacy Act (CPA)
A. Sensitive Data Definition
The Colorado Privacy Act, codified at C.R.S. § 6-1-1303(24), defines "sensitive data" to include personal data that reveals:
(i) Racial or ethnic origin;
(ii) Religious beliefs;
(iii) A mental or physical health condition or diagnosis;
(iv) Sex life or sexual orientation;
(v) Citizenship or immigration status; or
(vi) Genetic or biometric data that may be processed for the purpose of uniquely identifying an individual.
The definition also includes:
(vii) Personal data from a known child; and
(viii) Precise geolocation data.