LEGAL STANDARD

1. Yurok Tribal Code’s Freedom of Information Act protects confidential or private information from being disclosed.

Under the Yurok Tribe’s Freedom Of Information Act, Yurok Tribal Members have rights to access financial and business information of the Tribe, but disclosure is limited when it pertains to individual records that do not fall within an exception.[1] As an arm of the Tribe, AWC is subject to the FOIA act, so would need to disclose information to Tribal Members upon request, with individual’s personal information redacted or consolidated data for statistical reporting, unless each individual gives written consent prior to disclosure. Further, as in both federal and state laws pertaining to collection of personal information, Yurok Code requires that:

"[a]ll individuals shall have access to their personal record maintained by the Yurok Tribe or a program thereof upon written request. Such individuals shall also have a right to request amendment of a record pertaining to him or her; and shall have the right to appeal the denial of a request for amendment of a personal record to the appropriate committee or Executive Director of the Yurok Tribe.”[2] 

The AWC privacy policy should include protections against disclosure of personal information, and a review and edit process for information collected from Tribal members.

2. If AWC intends to collect personal information directly from youth outside California under 13 federal internet privacy requirements should be incorporated in the privacy policy.

The Children’s Online Privacy Protection Act (“COPPA”) is a federal law that applies to certain commercial websites when children under the age of 13 are the users whose information is being collected by a website, if the collection occurs across state lines.[3] Although the law does not specifically name Tribes or Tribal entities, for best practices the guidelines should be considered in crafting the privacy policy for AWC. Further, a state attorney general is authorized to bring suit on behalf of state residents for certain violations of COPPA[4], so adherence to the applicable sections is advised. In the list of items to include in a privacy policy that follows, items required only by COPPA and no other laws are noted with a + symbol.

In addition to posting a privacy policy, there must be processes to obtain consent from a parent or guardian prior to collecting a child’s personal information, and for parents to access, review, delete and prevent further collection of their child’s data. Information must be maintained confidentially and kept no longer than is necessary for the collection’s intended purpose.[5]

3. AWC is not subject to California civil regulatory requirements but can look to California for best practices in privacy policy creation.

States do not have jurisdiction to assert regulatory authority within the Yurok Reservation, unless that has been delegated by Congress. Public Law 83-280 delegated criminal authority to California, but civil jurisdiction is not applicable when the conduct at issue is generally allowed but regulated in some fashion.[6] Maintaining a website is generally allowed, and regulated civilly in California, as noted below. Not only is AWC located in the Yurok Reservation, it is run by the Yurok Tribe’s Parks and Recreation Department, nested under the Executive Branch of the Yurok Tribe. As such, the regulatory requirements California imposes on websites are not applicable to AWC. However, as with the federal laws regarding internet privacy, looking to the state requirements for best practices in developing AWC website’s privacy policy.

a. California Online Privacy Act (CalOPPA), §§ 22575-2257, would not apply to AWC information collection.

By doing business with consumers or users in California, a commercial entity may be subject to the state’s privacy statutes, even if operating from afar. Websites that are subject to the California Online Privacy Act (CalOPPA) must post a privacy policy on their site and adhere to other protections for consumer privacy. Although AWC will collect “personally identifiable information” from “consumers,”[7] likely including California residents, AWC is an arm of the Yurok Tribe, and not a for-profit entity operating a website for commercial purposes.

Because AWC plans to collect information of the type subject to the CalOPPA from California residents, the website should post a privacy policy conspicuously on the website as best practices. As with the federal law requirements, the requirements of CalOPPA are included in the list of items to include in a privacy policy that follows.

b. California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CCPA), Civil Code §§ 1798.100 et seq, would not apply to AWC information collection.

As with CalOPPA, CCPA applies to certain websites operating in California, but does not apply to AWC. California Civil Code 1798.140 defines businesses in the typical fashion, including for-profit entities that are incorporated, or partnerships, sole proprietors or joint ventures that are unincorporated. Only businesses are subject to CCPA. AWC is a “nonbsuiness” as defined under CCPA regulations[8] and statute.

As a subdivision of the Yurok Community Development Division, Parks and Recreation, and the AWC itself, is a nonbusiness for the purposes of the Consumer Privacy Protection Agency regulations. As such, the center itself is not subject to the requirements of CCPA.

Even if AWC is to be considered a business under the CCPA, the statute would not likely apply based on the threshold requirements of applicability. A business is subject to CCPA if it meets one or more of these threshold requirements[9]: had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, deals in the personal information of 100,000 or more consumers or households or makes 50%+ of annual revenues from such dealings; is a joint venture of partner to any of the above businesses. Unless and until AWC meets any of the thresholds above, CPPA regulations do not apply. A website doing business in California can voluntarily certify to the California Privacy Protection Agency that it is in compliance with and agrees to be bound by the CCPA rules and regulations; this is not advised.

It should be noted that the laws and best practices related to payment processing are not covered by this analysis, but should be considered in choosing and maintaining a payment processor who has comprehensive security standards and is in full compliance with applicable laws.

[1] Yurok Tribal Code, 1.20.020, 1.20.060 Disclosure (2025).

[2] Yurok Tribal Code, 1.20.070 (2025).

[3] 15 U.S.C. 6501 et. seq.

[4] 15 U.S.C. 6504.

[5] Complying with COPPA: Frequently Asked Questions, Federal Trade Commission, https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#A.%20General%20Questions, 8/18/2025.

[6] California v. Cabazon Band of Indians, 480 U.S. 202 (1987).

[7] California Business and Professions Code §22577

[8] California Code of Regulations Title 11 §7001 (p).

[9] California Business and Professions Code §1798.140 (d)(1-4)