Data Privacy for Beauty and Wellness Brands

Claudia Lewis: 00:11

You're building a beauty or wellness brand in a fast moving, highly competitive market.

Kristen Ruisi: 00:16

Standing out isn't just about developing quality products and creative campaigns. It's about navigating regulations, protecting your brand, and managing risk.

Claudia Lewis: 00:25

From FDA oversight and product claims to data privacy and consumer expectations, the legal and regulatory landscape is becoming more complex.

Kristen Ruisi: 00:34

Social media, influencer marketing and global expansion are only accelerating that complexity.

Claudia Lewis: 00:40

I'm Claudia Lewis.

Kristen Ruisi: 00:41

And I'm Kristen Ruisi. We're partners in Venable's Beauty and Wellness team.

Claudia Lewis: 00:46

On this podcast, we talk with our Venable colleagues and industry insiders about the legal and regulatory issues shaping the beauty and personal care market.

Kristen Ruisi: 00:55

And focus on practical guidance brands can use to stay compliant and competitive.

Claudia Lewis: 01:00

Welcome to The Beauty Law Glow-Up.

Kristen Ruisi: 01:03

This week, we're talking about beauty brand privacy and data security.

Kristen Ruisi: 01:12

Hi. I'm Kristen Ruisi, a partner at Venable focusing on trademark prosecution, enforcement, and brand protection. As beauty brands become more data driven, they are also confronting a fast expanding web of privacy and data security obligations. From personalized skin care recommendations and virtual try ons to loyalty programs, apps, and targeted marketing, beauty and wellness companies are collecting increasingly sensitive information that can trigger compliance challenges across multiple jurisdictions.

Kristen Ruisi: 01:43

At the same time, new state laws, evolving rules for teen data, and growing scrutiny of biometrics and health related information are making privacy a strategic business issue, not just a legal one. In this episode, we explore how beauty brands can build scalable privacy programs, use consumer data responsibly, and navigate a rapidly changing regulatory landscape. Landscape. To help us do that, we're talking to Kelly Bastide, a Venable partner and co-chair of the firm's Privacy and Data Security Group. Kelly, thank you so much for being here today.

Kelly Bastide: 02:18

Thanks for having me.

Kristen Ruisi: 02:19

So to start us off, people don't always immediately associate beauty brands with data privacy risk. From your perspective, why is this industry actually a significant one in the privacy space?

Kelly Bastide: 02:31

Well, beauty is such a broad term. It encompasses skincare, cosmetics, fragrance, wellness. All of these different product categories are also different factors for data collection. I think the real trend we're seeing is that consumers expect hyperspecificity in products that are targeted for their concerns.

Kelly Bastide: 02:52

It's not just enough to be a general acne product the way that we had when we were kids. So I think that there's this sense that consumers want products that are made for them, and if it's not a custom formulation, that it's something that feels very close. The way to get that customization, it relies on data collection from consumers, and also advertising and marketing to make sure that those messages are getting to the relevant audiences.

Kristen Ruisi: 03:17

Interesting. And and what types of data are beauty and wellness brands typically collecting that raise legal considerations?

Kelly Bastide: 03:24

Well, there are a lot of legal considerations in this space. Privacy laws in The US are incredibly dynamic. I think most folks are aware of the CCPA in California, the California Consumer Privacy Act that went into effect in 2020. There are now 22 states that have similar laws. There are also new sectoral laws on a state basis, including laws around, health data, and the definitions in these laws are incredibly broad.

Kelly Bastide: 03:52

So I think we're all familiar with this old concept of PII, personally identifiable information, and there's really no quibble that you have to protect a Social Security number, or that an email address or a phone number are personal information that are associated with a consumer. But under these laws, the definitions of what's covered now are incredibly broad. California even considers olfactory information, so a custom sent profile, to be personal data. And we're looking at things like cookies, device identifiers, anything that can effectively be tied back to, an individual is considered protected by these laws. So when you look at that, the import is that a lot of data types that are commonly collected in the beauty industry start to raise concerns or compliance considerations under these laws.

Kelly Bastide: 04:42

We're talking about an expanded definition of health data. We're out of the realm of HIPAA and signing that notice at your doctor's office. Even if consumers are volunteering information, I have rosacea. I have acne.

Kelly Bastide: 04:56

There are state laws that consider that to be health data and, in many cases, sensitive data that requires heightened consideration. Biometrics is another area. So this idea around facial scans, we're going to scan your face shape, so that you can do virtual try ons. Depending on how that architecture works, it may be biometrics data, again, sensitive under state laws. Also protected biometric specific laws in a handful of states.

Kelly Bastide: 05:25

Race and ethnicity, really important if you're doing color matching, if you're recommending products, for different skin tones. Also sensitive information under state laws. And we have a growing number of laws that are going to regulate data collections from teens and tweens. So 13 used to be the age of an adult on the Internet, and you could treat data collection from 13 as you would anybody. Those laws are changing, and there are now enhanced protections in a number of areas for anyone 13 to 17.

Kristen Ruisi: 05:59

I see a lot of tweens in stores like Sephora running around. Does that all fall into the category, if they're 10 years old and they're clicking buttons? Is that all a consideration that falls under this?

Kelly Bastide: 06:12

And that's a fact pattern that implicates five different privacy legal considerations. So, yeah, data collection from kids under 13, potentially biometrics, what data is actually being collected, is it monitoring race and ethnicity, or is it registering that as part of the data collection? You have these very layered considerations. And in most cases, we're talking about state laws. So now you're sort of assessing that on a state by state basis as well.

Kristen Ruisi: 06:40

So how do you balance personalization, which consumers want, with compliance obligations?

Kelly Bastide: 06:46

I think that the touch word here is transparency. So I know that marketing teams, they fear friction in the user experience. They want things to be as seamless as possible, and we agree. Friction is not great from a consumer perspective, but disclosure and transparency often is not and can be helpful. There are fewer concerns often when users are providing the data. You hear marketing teams say, oh, they just could not provide it. They're doing it voluntarily. That's fine. But once the brand is actually holding or processing that data, they're legally responsible for any compliance obligations associated with that data. In some states, if we're talking about sensitive data types, that might mean robust consents, even just to intake that data, again, even if consumers are providing that voluntarily. So I would say, get those consents. Your lawyers can work to skinny them down, but think about where you need that enhanced transparency and, unfortunately, maybe an extra checkbox or two.

Kristen Ruisi: 07:53

And have you seen a case where a brand's marketing strategy created unexpected privacy risk?

Kelly Bastide: 07:59

I do have a a case study. It was a connected device, a wellness device. And in their case, they implied greater personalization than they were actually doing. So they were making marketing claims like, we're going to give you custom recommendations tailored to your health concerns. You go through a multi question survey. The notion was that you're going to get something that's as tailored as a doctor's prescription, for example. Behind the scenes, the product wasn't that sophisticated. If you ticked that you had concern about this one part of your body, it sort of spit out the same recommendation for everybody else that checked that.

Kelly Bastide: 08:42

But, the marketing team really talked about the dimensions of personalization, and I said, well, that that's a lot of health data you're using to make recommendations. That's sensitive data. We're going to have consents around there, and they said, well, we're not actually using it. Some of the boxes you had to check or the survey you had to respond to was candidly smoke and mirrors. It was to imply that the product was doing more than it was. So we had to peel back the layers of the onion, get to what the actual core data usage was, and then tailor the compliance to fit what was actually happening.

Kristen Ruisi: 09:20

You work with clients across multiple jurisdictions. How challenging, and I imagine it is challenging, is it for beauty brands to keep up with the patchwork of state laws and global regulations?

Kelly Bastide: 09:33

It's really tough. This is a really dynamic area of law in the U.S., and then we have changes happening all over the world. It feels like another country passes a regime of comprehensive data privacy almost one a month another country comes online. And it's often hard to monitor from afar what's happening in other countries if the source materials aren't in English. But I think what we've seen as a trend, there are commonalities that you can fall back on if you have a small team, but you're trying to keep abreast of what's happening in a lot of different places, all over the globe. So things that I tell my clients to comfort them. Laws very rarely go into effect instantly. You will have time to implement changes almost universally across the board.

Kelly Bastide: 10:27

So even if you see a new story that there's a new law in China or pick another jurisdiction, maybe where you're looking to expand, there will be time to digest that law, to engage local council if you need to, and to think through how, any new obligations might map onto your existing compliance program. Also, even though there is a lot of variety in the world, I think privacy laws are still built on fundamental core principles. And companies can take that time to digest, maybe look and survey what's happening in the world on a regular cadence to check for updates. Laws come into effect at regular times. In the U.S., it tends to be, they go into effect beginning of the year or middle, kind of that July time frame.

Kelly Bastide: 11:13

So, you can engineer yourself backwards. Look at the calendar and think about how much lead time you might need to digest a new law and build that into your time frame. And then prioritize those core markets and understand enforcement patterns and trends just because a law goes into effect. Again, you'll have time to implement, and they typically don't start bringing enforcement on day one after it goes into effect.

Kelly Bastide: 11:39

So, you often have a little bit of time to see how that market is reacting, maybe to see what some of your peers or competitors are doing to adjust to that market and kind of make sure that you stay within the current pattern of what everybody else is doing. So perfect compliance, of course, is always the goal, but I think building risk based practices is a way to make your privacy program sustainable.

Narrator: 12:04

Artificial intelligence is transforming industry. But with opportunity comes new legal, business, and strategic challenges. On AI and IP: The Legal Frontier, Venable partner Justin Pierce talks with industry leaders and legal professionals about AI governance, innovation, intellectual property, property, compliance, and risk management. Get practical insights to help your organization harness AI with confidence. Search for AI and IP: The Legal Frontier, wherever you listen.

Kristen Ruisi: 12:36

And how should a growing brand think about building a privacy program that can scale internationally?

Kelly Bastide: 12:42

I know this is a real challenge because I think brands might start small, but can really go viral and scale very, very quickly. So one minute you're selling from a really basic out of the box website, and the next thing you know your brand is in Sephora, in department stores, and, has a lot of interest in your building just this whole online community and experience. Privacy is probably not top of mind for your team when you're in that growth phase, especially if your business is at that time using data just to acquire users or grow the brand. But I talked about how privacy laws tend to share certain principles or core elements, but that foundation is always built on notice.

Kelly Bastide: 13:25

It's built on choice or consent. It's built on consumer rights. And if you build a privacy program around those principles, it will serve you well in almost every new market you might enter. I also want to stress the importance of complaints and how they drive enforcement. So there are thousands upon thousands of beauty brands, and you think about every other kind of consumer facing business that might exist in any given jurisdiction, government agencies can't possibly enforce against even a significant percentage of them.

Kelly Bastide: 14:01

But enforcement is driven by complaints. So think about how your privacy experience looks to consumers. If they inquire about how their data is using, are you providing standard responses that are friendly but not dismissive of their concerns that address them? Are your processes robust enough to withstand an error?

Kelly Bastide: 14:21

So if somebody wants their data deleted and there's a mistake and it doesn't happen, how are you handling that in a way that you're not going to anger your online base? They start agitating in whatever forum they're on, and maybe an enforcer gets wind of that. So you want to make sure that you are able to solve your problems in house so they don't become a bigger headache for you.

Kristen Ruisi: 14:45

Good customer service always. Can you walk us through how you typically help a client go from we need to be compliant to actually implementing a workable program?

Kelly Bastide: 14:56

I'm going to say a dirty word in the privacy space: data mapping. Everybody hates to do it. There still aren't great ways to do it, although I think there are a lot of vendors out there that will sell you a tool that claim that they're able to do it. But it really is getting a bird's eye view of the data that's coming in the door, where it is when your company has it, how it's being used, any third party disclosures, how it's going out the door.

Kelly Bastide: 15:23

So I think about it like this, the advice to spring clean your wardrobe, go through and look at everything you wear and pick what you're going to keep and what you're going to donate and what you're going to trash. Companies should do the same with data repositories once they reach a certain level of size or robustness. What data are we actively using? Do we have plans for? Is that data clean?

Kelly Bastide: 15:43

Do we have whatever consent or permissions we might need in the market where we collected it to do the things that we want to do with it. And then do you have a trove of the trash data? These are consumers that visited your site once, that they signed up, got their coupon and never came back. That your email response rates are are nil. They're not even opening the email. Maybe you acquired it somehow. Maybe you purchased it, the provenance of that data is unclear. Does your marketing team really need it, or is it just creating risk for you on the back end? Is that data that can be trashed?

Kelly Bastide: 16:20

And if you have a good data mapping procedure, it doesn't have to be fancy. It doesn't have to involve a vendor or a technical tool. Just like real solid data hygiene. Hopefully, you're going have some insight into that and get everyone comfortable if there really is data that you want to delete or move on from.

Kristen Ruisi: 16:36

That's very insightful. Thank you. What is the most common and costly mistake that you see?

Kelly Bastide: 16:42

So it's back to those data repositories that you build, and it's a really typical scenario where this brand has scaled. They started small. They went viral. Their data's coming in the door in all kinds of ways. They're doing in person experiences and collecting data. They have folks coming to different websites, their brand website. Maybe they're getting it from their own distributors. And the data all just goes into one single lake. A data lake.

Kelly Bastide: 17:10

But it doesn't come in tagged with where it originated from, maybe what permissions are attached to the data. Maybe there's poor consent management around some of the data so that the brand is unclear, can we actually use this? Can we market to these folks? Where are they located? Data that's collected as part of the consumer journey, but your business doesn't know if they can leverage it. That's data that raises risk.

Kelly Bastide: 17:33

Maybe that risk is minimal. Maybe it's just an email address, and we can get comfortable moving forward and trying to correct going forward. But the challenge that I see that's really costly is trying to retroactively kind of like retrofit this data.

Kelly Bastide: 17:49

So, a question I get a lot from clients is, okay we were too small for privacy laws. We didn't meet or we've we're entering a new market. And folks are requesting their data to be deleted, but we can't delete it because the way that the system was set up, something breaks on the back end. Is it okay if we just write over it with x x x x x? Is that okay under the laws of this particular jurisdiction? And they're really trying to plug a lot of holes in a very bespoke way, and it becomes a real drag on the team. These questions take a lot of time, a lot of retroactive engineering, and then eventually going to move it to a different platform that's more robust and none of the data matches. It's like rote challenges for data engineers and for marketing teams. So if you just set these repositories up in a way that contemplates some of these challenges as you grow, it can save you a lot of time in the future.

Kristen Ruisi: 18:51

And you've also looked at emerging technologies like AI. How are beauty brands using these tools and what are the privacy implications?

Kelly Bastide: 19:01

So, of course, there's enormous interest in AI tools from brands. I think it feels like a lot of the clients I counsel that brand adoption is not what I would consider wholly transformative yet. They're sort of white labeling tools, some of these virtual try on tools.

Kelly Bastide: 19:18

These are, maybe they're being developed in house, but I would say more commonly, they're being white labeled and purchased elsewhere. And they're in this bucket of entertainment. The way that we all play with with ChatGPT. So there's just like AI twists on concepts that already exist in the marketplace.

Kelly Bastide: 19:36

At present in the U.S., there are actually few AI specific privacy laws that would address these kinds of uses. So you're really looking at the same privacy laws for the data collection as as any other. If you're keeping that face scan, that's a biometrics question, whether it was collected through AI or not, and you have to think about it through that lens. Also the AI laws, again the AI privacy laws that exist, they are focused on practices that raise risk to individuals.

Kelly Bastide: 20:07

So if you know credit scoring or something like that, and not really this category of it's recommending an eye shadow for you. So it's just an area that's evolving, and it's a little bit of a wait and see. But there are certainly a lot of threads to pull there, and I think the technology should be adopted thoughtfully. Again, in anticipation of a future where it may be more heavily regulated from a privacy perspective.

Kristen Ruisi: 20:34

And for beauty founders or in house teams listening, what's one thing they consistently underestimate when it comes to privacy?

Kelly Bastide: 20:42

So I'd say the complexity and time involved in working through that complexity, it's really common for brands, again, especially the smaller brands to come and say, okay, this is like our main competitor. We took their privacy policy. We Control F'd. Looks pretty good.

Kelly Bastide: 20:59

Can we just put this on our website? Or, my least favorite question, they can do x. They don't have a consent. Well, can't we go that way too? And there might be a lot of reasons why they're proceeding without a consent.

Kelly Bastide: 21:15

It's hard to tell from the outside. U.S. privacy laws, many of them have minimal thresholds for data disclosure. So if you are smaller or you're processing, a lower volume of data, you may not be subject to those laws, at least not yet. So it's really hard to look from the outside in and try to think through another company's legal process, and I would challenge brands to not start from that position. Although, of course, benchmarking is always helpful.

Kelly Bastide: 21:44

Tools that aren't customized that they purchase on the market, compliance that just kind of comes out of a box, copying notices, copying policies, they think that's going to save time, and often it ends up wasting time in the long run because it's harder to work with someone else's set of practices and customize it to you than it would be to start clean and develop your own policies. So I also think laws can be used to your advantage. There are many exemptions. We talked about the volume of data. That's a really important point that will reduce the number of laws that you may be subject to as a brand, and to take the time to think through those exemptions and how they can be helpful in scaling your privacy program appropriately.

Kristen Ruisi: 22:33

And to wrap up, what trends do you think will shape privacy and data security in the beauty industry over the next few years?

Kelly Bastide: 22:42

We did talk about these laws that are developing around minors and teens. It really is going to be a fundamental change to the landscape. I should mention there are a small number of states that have these app store accountability laws. They're actually going to require the app stores to pass age information back to the app developers. So in a world where you could put an app out in the wild and say, do we think teens are using it? Probably. Do we know which folks are teens? Nope. We have no idea.

Kelly Bastide: 23:11

That landscape is going to change very quickly because you might get direct technical age information, from the app stores themselves. I'll say some of them are under legal challenge, so there's a little bit of a pause in the development there. But I've been working with a number of clients who are, for the first time, thinking about what has to change in my app when I know a 14 year old is using it. I don't want to kick the 14 year olds off. They're an important constituency.

Kelly Bastide: 23:39

But things like we can have advertising in certain states targeted to those users once we know who they are. And then also once you have that age information, it's going to go to that same user when they visit your website. You're going to know how old they are. So it really is going to cause a bit of a sea change once those laws take root and that technical data starts flowing.

Kristen Ruisi: 24:01

And we have just a little bit of time left. What's one piece of advice you'd like to give a brand trying to grow responsibly in today's data driven environment? Try to get away from the practice of, well, we collect data, but we're not using it, but we might someday. Question your marketing teams. Really put them through the paces. Every time they want to put a new pixel or a new third party on the website or in the app, ask them, what analytics are you getting from them that you're not getting from the other three analytics vendors that are already on the site. Make sure that they're able to give a thoughtful response to that because that creates risk to have those third parties operating on the site. I think beauty is so personal that being a good steward of consumer data can be part of your brand ethos. You know, folks are sharing data about their health concerns, about the way they look, and that's data that might make them feel vulnerable. So I think put yourself in their shoes and treat their data as you would want that data to be treated in the hands of another.

Kristen Ruisi: 25:02

Well, thank you so much, Kelly. This has been very insightful. We appreciate you being here and taking the time.

Kelly Bastide: 25:08

Thanks, Kristen.

Kristen Ruisi: 25:10

Okay. That's all we have time for today. I want to thank Kelly for helping us better understand how beauty and wellness brands can balance personalization with privacy, build scalable compliance programs, and manage the growing data risks that come with operating in an increasingly digital marketplace. You could read more about Venable's Beauty and Wellness team by visiting venable.com/beauty. I'm Kristen Ruisi. Thanks for listening to The Beauty Law Glow-Up.