Consumer Reports Study Shows California's Privacy Law Is A Poorly-Enforced Mess

from the not-helping dept

Over the last few decades, the U.S. government (more accurately the industries that lobby it) have made it abundantly clear most aren't keen on even the most basic of privacy law for the internet era. Sure, companies like Facebook and AT&T say they want a privacy law, but they don't. Not really. Even the most basic privacy laws would educate consumers and empower them to more easily opt out of tracking and behavioral ads, costing countless sectors billions of dollars. What they want, if we have to have a law at all, is a law their lawyers write, so riddled with loopholes and caveats as to legalize dodgy behavior, not ban it.

Since these bogus solutions don't sell well with consumer advocates and many privacy experts, we routinely hit gridlock. The result: the U.S. has no meaningful federal privacy law for the internet era decades after the fact. And, in the rare instances where U.S. leaders somehow manage to shake off lobbying influence and their own incompetence to pass even modest rules (like the FCC's dead broadband privacy rules), they're quickly dismantled by a Congress slathered in campaign contributions from multiple, coordinating industries.

This federal, lobbyist-induced apathy to passing any real federal privacy solutions has resulted in states rushing to fill the void. Often poorly. California, for example, has been lauded for passing one of the most comprehensive privacy solutions in the nation (which isn't saying much) in the form of the California Consumer Privacy Act (CCPA). The problem, as we've noted previously, is that it was a rushed mess cobbled together in a mad dash. Sloppy wording means the bill had a huge share of problems, which Mike has outlined previously. For a subject this complicated, a "mad dash" approach was never likely to work out that well.

Fast forward to this week, when a new report by Consumer Reports found the bill (surprise!) isn't really succeeding at its primary goal: clearly informing consumers what's going on in terms of access to their data, and making it easier to opt out of data collection and sale. This most basic provision also isn't being meaningfully enforced in any substantive way. The organization spent much of May testing numerous websites and found that actually trying to opt out of data collection and sales was either impossible, or very difficult to confirm with the companies in question:

Consumers struggled to locate the required links to opt out of the sale of their information. For 42.5% of sites tested, at least one of three testers was unable to find a DNS link. All three volunteers failed to find a “Do Not Sell” link on 12.6% of sites, and in several other cases one or two of three testers were unable to locate a link.

At least 14% of the time, burdensome or broken DNS processes prevented consumers from exercising their rights under the CCPA.

Consumers often didn’t know if their opt-out request was successful. Neither the CCPA nor the CCPA rules require companies to notify consumers when their request has been honored. As a result, about 46% of the time, consumers were left waiting or unsure about the status of their request. About 52% of the time, the tester was “somewhat dissatisfied” or “very dissatisfied” with opt-out processes.

Cool. The full report (pdf) is worth a read, and also found that data brokers fairly consistently violated the law without any penalty. One used data gleaned from opting out to actually sign the consumer up for additional marketing. Some brokers demanded data that consumers eager to opt-out of data monetization and tracking wisely weren't keen on providing to often-dodgy data brokers (like copies of government IDs). Again, none of these problems should be particularly surprising for a bill numerous experts say was rushed and undercooked, attempting to fix a problem that's global and massive.

Consumer Reports was quick to note that some of these problems should be fixed by California Proposition 24, which will be voted on in November. Though still, questions remain as to whether California has the competency to pull this off given the scale of the problem we're talking about. Ideally, it would be best to have this problem tackled by a cohesive, federal level law and actually staffed and funded privacy regulators at places like the FTC. But most efforts to accomplish that are routinely undermined by a coalition of industries (and the lawmakers paid to love them) which would prefer consumers remain opted in and befuddled by fine print.

But with major privacy scandals occurring weekly, doing nothing is starting to get harder to pull off. So instead, we're starting to see a laundry list of federal solutions by bad faith actors whose top interest isn't consumer protection, but bogus laws designed to pre-empt tougher, better, consensus-driven solutions on both the state and federal level. As such while California's proposal is a (hopefully fixable) mess, it's surprising the bill was even created at all in an environment where doing nothing or doing nothing but dressing it up as something is the preferred outcome for a large number of privacy-violating giants.

Filed Under: california, ccpa, privacy

Good News: ACLU Calls On Californians To VOTE NO On Bogus 'Consumer Privacy' Proposition 24

from the listen-up dept

Last fall we wrote about the unfortunate situation happening with privacy laws in California. As you may know, California has a new privacy law that recently went into effect. And even though we're big supporters of privacy here at Techdirt, we've noted that the CCPA law is and remains an unmitigated disaster. Much of that has to do with the way it came together. A wealthy real estate developer, Alastair Mactaggart, with little to no understanding of how the internet actually works, spent millions of dollars to get a "consumer privacy" ballot measure on the ballot in 2018. But it was incredibly dangerous and confused. Mactaggart, though, cut a deal: if the California legislation agreed to a privacy law, he would drop the ballot measure. So, the California legislature rushed through a very under-cooked privacy bill, that was written in just a couple of weeks, in order to get Mactaggart to drop his much, much worse ballot measure.

And that's how we ended up with such a half-baked law. Except, last fall, Mactaggart decided to go back on his word, and said that even though the legislature pushed through the already problematic CCPA to get him to stop his ballot measure, he was going to push for another similar ballot on consumer privacy. For a little while, it looked like he might not get the ballot measure on the ballot, but he did, and now it will be up for a vote in November.

And here's the thing: as with many ballot measures in California, most voters don't understand the nuances and details of what they're voting for, and your average voter, upon seeing a ballot measure that says it will "expand the state's consumer privacy laws" is likely to vote yes, because that sounds good. Privacy is good, and so privacy laws sound good. But only if you don't know what the initiative actually does: which would be a huge disaster for actual privacy.

We were actually a bit disappointed last time around that some of the civil society groups we normally support came out in strong support of the CCPA, but this time around, it looks like many are recognizing just how dangerous Mactaggart's plan is for actual privacy. The various ACLU subsidiaries in California have now come out strongly against the ballot measure, known as Proposition 24, making the argument that it "benefits big tech and corporate interests, and will disproportionately harm vulnerable communities." As the ACLU notes, the proposition would put the burden on individuals themselves to fill out forms to "protect their privacy." As the ACLU's Jake Snow says: "Proposition 24 isn't privacy protection, it's privacy paperwork."

Also, there's this:

This is the kind of proposition that someone like Mactaggart would love. It lets him pretend that he's actually a champion of privacy, while actually helping some of the biggest businesses who regularly violate our privacy.

The ACLU announcement mentions a bunch of other civil society groups also coming out against Proposition 24 as well, including Public Citizen and Color of Change. That's good to see and hopefully the message gets out there: this is no way to craft privacy legislation -- especially considering that it's coming from a rich dude who literally went back on his word mere months after promising to drop his ballot initiative in exchange for a poorly written law.

Filed Under: alastair mactaggart, ballot initiatives, california, ccpa, privacy, proposition 24
Companies: aclu

Wireless ISP Starry Says It Will Apply California's Privacy Requirements Nationwide

from the swimming-with-the-currents dept

Like Microsoft, wireless startup Starry -- the brain child of Aereo creator Chet Kanojia -- has decided to view the public's desire for solid privacy rules as a marketing opportunity instead of something to ceaselessly undermine or whine about.

Knowing that the telecom giants they're hoping to disrupt have an abysmal record on privacy, Starry has announced that, like Microsoft, it will be using California's looming privacy law as a template for its business nationwide. While California's looming law is admittedly under-cooked and needs some major revisions before serious enforcement begins later next year (it takes effect in January but won't be seriously enforced until June), Starry, which is slowly pushing uncapped wireless service to major metro areas around the US, announced it's going to adhere to its core principles in every state it does business.

That includes getting permission before sharing data, being transparent about what data is being collected and who it's sold to, and giving consumers at least some passing control over what data is already stored (largely mirroring the FCC broadband privacy rules industry lobbyists killed in 2016). Both Starry and Microsoft seem to understand that after an endless sea of corporate privacy scandals and incompetence, the public wants at least some baseline privacy protections, and swimming against that sentiment is going to prove counterproductive:

"Inevitably, there will be grumblings that these common-sense privacy principles are too simple, or conversely, that they go too far. To us, this is a starting point, a baseline from where we believe all companies need to begin, not necessarily end, when it comes to consumer privacy. We prioritize privacy because it’s the right thing to do, even if it means we give up short term opportunities and shortcuts. In today’s climate, that can be a hard choice to make – but it’s not."

There are any number of companies (AT&T, Facebook) that claim they support the US having an actual privacy law for the internet era, but you shouldn't be fooled. In reality, what they want is a law their lawyers write, filled with so many loopholes as to be utterly useless, with one real goal: pre-empting tougher, better state or federal efforts. They don't really want a meaningful law, since any law worth its weight would inform and educate consumers, who'd in turn opt out of data collection and monetization, costing them billions.

It goes without saying that building a meaningful US privacy law for the internet era is going to be an unholy mess courtesy of Congressional Luddites and corrupt lawmakers and cross-sector lobbyists who'll attempt to undermine the process at every conceivable opportunity. The alternative however is to just keep stumbling idiotically down the path we're on, which as Facebook, Equifax, the DMV and countless others make very clear, involves giant corporations and government agencies routinely trampling your privacy rights then seeing little to no penalty as a result.

At least some companies seem to realize that swimming against the current is a waste of calories, the quest for some basic privacy rules are an opportunity to compete on privacy and ethics, and there might be some PR benefit in winning the support of a very pissed off US public.

Filed Under: broadband, california, ccpa, privacy
Companies: starry

Microsoft Says It's Cool With California's New Privacy Law

from the competing-on-privacy dept

We've made it abundantly clear that California's new privacy law is aggressively undercooked, and will require some very serious fine tuning if it's going to be workable for many California companies. At the same time, giant companies like Google, Comcast, and AT&T have spent a lot of time aggressively misrepresenting what the law actually does, running ads outright lying about the bill's impact, and downplaying the fact that states wouldn't be wading into the privacy waters if these companies hadn't lobbied to kill modest federal privacy requirements in the first place.

Whereas companies like Facebook have repeatedly and routinely tripped over themselves in almost dystiopian fashion to make their existing regulatory headaches worse, it has been interesting to watch Microsoft, steeled from its experiences in the late 90s, navigate the current minefield more deftly. That was on display again this week when Microsoft came out in seemingly total support of California's new privacy law, with a blog post by Chief Privacy Officer Julie Brill stating the company intends to apply its adherence to the California Consumer Privacy Act (CCPA) law nationwide:

"CCPA marks an important step toward providing people with more robust control over their data in the United States. It also shows that we can make progress to strengthen privacy protections in this country at the state level even when Congress can’t or won’t act.

We are strong supporters of California’s new law and the expansion of privacy protections in the United States that it represents. Our approach to privacy starts with the belief that privacy is a fundamental human right and includes our commitment to provide robust protection for every individual."

It may just be that I've covered telecom companies like AT&T for too long, but it's interesting to note that nowhere in the blog post does Microsoft even fling so much as an underhanded, veiled criticism of California's efforts. It's a notable contrast to other Internet Association members, many of which have been running advertisements falsely claiming the bill will result in people having to pay per click just to access websites that used to be free:

While Microsoft is still a member of the group running these ads, the blog post seems to indicate at least a few people at Microsoft understand that this is a battle you're not going to win by swimming upstream or doubling down on idiotic behavior (oh hey Facebook, didn't see you standing there).

Outside of the problematic COPPA, there's no meaningful US privacy laws for the internet era, and the endless series of hacks, breaches, incompetence (like leaving private data in openly exposed Amazon cloud buckets) make it clear modern US industry is too incompetent to self regulate and we need at least some basic rules of the road on privacy. Yes, government dysfunction and corruption means it's going to be ugly as hell as we figure out what that looks like, but that doesn't somehow magically eliminate the necessity for some meaningful penalties for incompetent privacy-violating corporate giants.

Microsoft's clear support for existing efforts is a far cry from the response by companies like Facebook and AT&T. Both companies claim they want a federal privacy law, but what they really want is their lawyers to write a loophole-filled federal law with only one real purpose: to pre-empt any tougher state or federal measures. They're well aware that any good bill will result in informed, empowered consumers who'll opt out of snoopvertising, costing them billions, and their response is to try and undermine those efforts at every opportunity.

And while it's certainly possible Microsoft feels the same way and is just engaged in a convincing head fake here, it's also possible Microsoft seriously intends to actually compete on privacy, realizes the die is already cast thanks to an incredibly pissed off public, and knows that swimming against the tide is going to prove counterproductive and harmful to their brand--and their customers--over the longer haul.

Filed Under: california, ccpa, privacy
Companies: microsoft

Facebook And Twitter Hope To Fix California's Troubled Privacy Law With...Misleading Ads?

from the you're-not-helping dept

With the federal government doing little to pass a real privacy law for the modern era, states have begun rushing into the void. That's unfortunately resulting in some state privacy laws that are a lacking in the...quality department. That's been particularly true in California, where the government recently passed the new California Consumer Privacy Act. While the law may be well intentioned, we've noted how the rushed bill has plenty of problems that need fixing if it's ever going to actually work. Murky definitions and drafting errors leave the bill a bit of a muddled mess, with the potential to even undermine other, existing laws.

While all sides of the debate have descended upon the California legislature in a bid to try and fix the bill's language, Silicon Valley lobbying giants have been busy running some highly misleading ads in a bid to try and soften the bill. Under the banner of "Keep the Internet Free," the Google, Twitter, Facebook, and Microsoft-backed Internet Association has been running ads trying to claim that the bill would result in users having to pay errant fees just to use the internet:

"The FREE websites and apps you use every day could start costing you,” announced one such ad on Twitter.

“Using the internet shouldn’t hurt your wallet,” began another that predicted browsing the Web could someday seem like paying at the pump for gasoline."

And while California's proposal certainly has numerous problems, any claim it's going to result in the internet being turned into some kind of pay-to-play hellscape is just nonsense. Sacramento-area users who actually click on the ad are directed to a website that further tries to suggest the new bill will suddenly have users paying to access social media in much the same way they have to pay to buy gasoline:

This obviously isn't the Internet Association's first foray into misleading privacy lobbying. Silicon Valley worked hand in hand with the telecom sector early on to try and stall California's privacy law efforts, pushing ads and talking points claiming that a state-level privacy law would embolden extremists, endanger children, and litter the internet with annoying popups, none of which was actually true. This was after telecom and Silicon Valley worked hand in hand to kill some fairly modest (and far better written) FCC privacy rules back in 2017.

Granted, Silicon Valley giants have some very good reasons to oppose the California bill, given it's rushed and sloppy language could easily result in steeper additional operational costs and numerous unforseen headaches.

At the same time, it's oddly understated that these companies would much prefer it if no privacy law were passed at all, and if a bill is passed, they'd prefer it be loaded with so many loopholes as to be largely useless. Even if the bill lacked troubling language, no major company actually wants to suddenly face million/billion dollar losses due to restrictions on data monetization or behavioral ads, and the combined lobbying firepower of the telecom, tech, insurance, healthcare, and marketing industries makes passing any privacy law with teeth a steep uphill climb.

The problem in California is the bill is slated to go live (warts and all) on January 1, though actual enforcement isn't expected until at least next summer. Efforts by privacy advocates to strengthen the bill have stalled, so their focus now is simply keeping the tougher portions of the bill intact:

"After two failed bids to strengthen the 2018 law, data-privacy advocates say their goal for the year is simply to keep the Privacy Act intact.

"We’re basically looking to hold the line on everything." said Lee Tien, a senior staff attorney for the Electronic Frontier Foundation, a San Francisco-based group that advocates for stronger consumer protections online. "We’re watching for gut-and-amends and the usual shenanigans on the floor."

In contrast, the tech sector's goal is to try and weaken the definitions of what's collected, how it can be shared, and who it can be sold to. And while the industry certainly has plenty of other of legitimate reasons to oppose the bill as currently written, further muddying the waters with additional layers of misleading advertising isn't likely to help their cause.

Filed Under: ads, california, ccpa, lobbying, misleading ads, privacy
Companies: facebook, google, internet association

Yes, Privacy Is Important, But California's New Privacy Bill Is An Unmitigated Disaster In The Making

from the not-how-to-do-it dept

We've talked a little about the rush job to pass a California privacy bill -- the California Consumer Privacy Act of 2018 (CCPA) -- and a little about how California's silly ballot initiatives effort forced this mad dash. But a few people have asked us about the law itself and whether or not it's any good. Indeed, some people have assumed that so many lobbyists freaking out about the bill is actually a good sign. But, that is not the case. The bill is a disaster, and it's unclear if the fixes that are expected over the next year and a half will be able to do much to improve it.

First, let's state the obvious: protecting our privacy is important. But that does not mean that any random "privacy regulation" will be good. In a future post, I'll discuss why "regulating privacy" is a difficult task to tackle without massive negative consequences. Hell, over in the EU, they spent years debating the GDPR, and it's still been a disaster that will have a huge negative impact for years to come. But in California they rushed through a massive bill in seven days. A big part of the problem is that people don't really know what "privacy" is. What exactly do we need to keep private? Some stuff may be obvious, but much of it actually depends quite heavily on context.

But the CCPA takes an insanely broad view of what "personal info" is covered. Section 1798.140(o)(1) defines "personal information" to mean... almost anything:

“Personal information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following:

(A) Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
(B) Any categories of personal information described in subdivision (e) of Section 1798.80.
(C) Characteristics of protected classifications under California or federal law.
(D) Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E) Biometric information.
(F) Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.
(G) Geolocation data.
(H) Audio, electronic, visual, thermal, olfactory, or similar information.
(I) Professional or employment-related information.
(J) Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99).
(K) Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

So, first off, note that it's not just associated with any individual, but also a "household." And, again, in the list above, there are lots of items and situations where it totally makes sense that that information should be considered "private." But... there are other cases where that might not be so obvious. Let's take "information regarding a consumer's interaction with an internet web site." Okay. Yes, you can see that there are reasonable privacy concerns around a company tracking everything you do on a website. But... that's also generally useful information for any website to have just to improve the user experience -- and basically every website has tended do some form of user tracking. It's not privacy violating -- it's just understanding how people use your website. So if I'm tracking how many people flow from the front page to an article page... now suddenly that's information impacted by this law. Perhaps the law is intended to mean tracking people on other websites through beacons and such... but the law appears to make no distinction between tracking people on your own website (a feature that's built into basically every webserver) and tracking people elsewhere.

Similarly, "preferences" is private information? Sure, on some sites and for some reasons that makes sense. But, I mean, we do things like let users set in their preferences whether or not they want to see ads on our site at all (in case you don't know, you can turn off ads on this site in the preferences, no questions asked). But... in order to make sure we don't show you ads, we kinda have to keep track of those preferences. Now, I think many of you will recognize that in removing ads, we're actually helping you protect your privacy. But under this law, we're now incentivized not to keep such preferences because doing so is now its own legal liability.

And that leads into the "costs" vs. the "benefits" of such a law. Again, lets be clear: many internet companies have been ridiculously lax in how they treat user data. That's a real problem that we don't, in any way, mean to diminish. But, the costs of this law seem very, very, very likely to outweigh a fairly minimal set of benefits. On the benefits side: yes, a few companies who have abused your data will face some pretty hefty fines for continuing to do so. That's potentially good. But the costs are going to be massive. For this part, I'll borrow from Eric Goldman's analysis of the bill, which is well worth reading. It's long, but he outlines just some of the likely "costs":

How Much Will This Cost? (part 1) Regulated companies–i.e., virtually every business in California–will need to spend money on compliance, including building new processes to deal with the various consumer requests/demands. Adding up all of the expenditures across the California economy, how much will this cost our society? It’s not like these expenditures come from some magic pot of money; the costs will be indirectly passed to consumers. Are consumers getting a good deal for these required expenditures?

How Much Will This Cost? (part 2) Lengthy statutes seem like they are detailed enough to eliminate ambiguity, but it actually works in reverse. The longer the statutes, the more words for litigators to fight over. This law would give us 10,000 different bases for lawsuits. One of the current tussles between the initiative and the bill is whether there is a private right of action. Right now, the bill attempts to limit the private causes of action to certain data breaches. If the private right of action expands beyond that, SEND YOUR KIDS TO LAW SCHOOL.

How Much Will This Cost? (part 3) The bill would create a new “Consumer Privacy Fund,” funded by a 20% take on data breach enforcement awards, to offset enforcement costs and judiciary costs. Yay for the bill drafters recognizing the government administration costs of a major new law like this. Usually, bill drafters assume a new law’s enforcement costs can be buried in existing budgets, but here, the bill drafters are (likely correctly) gearing up for litigation fiestas. But exactly how much will these administration costs be, and will this new fund be sufficient or have we written a blank check from the government coffers to fund enforcement? Most likely, I expect the Consumer Privacy Fund will spur enforcement, i.e., enforcement actions will be brought to replenish the fund to ensure it has enough money to pay the enforcers’ salaries–a perpetual motion machine.

Let's dig into that first part, because it's important. It's important to remind people that this bill is not an "internet" privacy bill. It's an everyone privacy bill. Any business that does business in California more or less is impacted (there are some limitations, but for a variety of reasons -- including vague terms in drafting -- those limitations may be effectively non-existent). So now, in order to comply, any company, including (for example!) a small blog like ours, will have to go through a fairly onerous process to even attempt to be in compliance (though, as point two in Eric's list above shows, even then we'll likely have no idea if we really are).

An analysis by Lothar Determann breaks out some of what we'd need to do to comply, including setting up entirely new processes to handle data access requests, including a system to verify identity and authorization of individuals, and ways of tracking requests and blocking the chance that anyone who opts out of certain practices is offered a chance to opt-back in. So... to use the example above, if someone sets a preference on our site not to see ads, but then makes a data privacy request that we not track that data, we then would likely need to first verify the person and that they are the one making the request, and then we'd need to set up a system to (get this!) make sure we somehow track them well enough so that they... um... can't "opt-in" to request that we no longer show them ads again.

Think about that. In order to stop letting someone opt out of ads on our site "for privacy purposes" we'd have to set up a system to track them to make sure that they aren't even offered the possibility of opting out of ads again. It's mind boggling. Also, this:

Consider alternative business models and web/mobile presences, including California-only sites and offerings, as suggested in Cal. Civ. Code §1798.135(b) and charges for formerly free services to address the complex and seemingly self-contradictory restrictions set forth in Cal. Civ. Code §1798.125 on a company's ability to impose service charges on California residents who object to alternate forms of data monetization.

Okay, so I'm all for businesses exploring alternative business models. It's what we talk about here all the time. But... requiring that by law? And, even requiring that we offer a special "California-only" site that we charge for?

I'm having difficulty seeing how that helps anyone's privacy. Instead, it seems like it's going to cost a ton. And... for limited to negative benefit in many cases. Just trying to figure out what this would cost us would mean we'd probably have to let go of multiple writers and spend that money on lawyers instead.

And that leaves out the cost to innovation in general. Again, this is not to slight the fact that abusive data practices are a real problem. But, under this law, it looks like internet sites that want to do any customization for users at all -- especially data-driven customization -- are going to be in trouble. And sure, some customization is annoying or creepy. But an awful lot of it is actually pretty damn useful.

An even larger fear: this could completely cut off more interesting services and business models coming down the road that actually would serve to give end users more control over their own data.

Also, as with the GDPR, there are serious First Amendment questions related to CCPA. A number of people have pointed out that the Supreme Court's ruling in Sorrell v. IMS Health certainly suggests some pretty serious constitutional defects with the CCPA. In Sorrell, the Supreme Court struck down a Vermont law that banned reporting on certain prescription practices of doctors as violating the First Amendment. It's possible that CCPA faces very similar problems. In an analysis by professor Jeff Kosseff, he explains how CCPA may run afoul of the Sorrell ruling:

CCPA is more expansive than the Vermont law in Sorrell, covering personal information across industries. Among its many requirements, CCPA requires companies to notify consumers of the sale of their personal information to third parties, and to opt out of the sale. However, CCPA exempts “third parties” from coverage if they agree in a contract to process the personal information only for the purposes specified by the company and do not sell the information. Although CCPA restricts a wider range of third-party activities than the Vermont statute, it still leaves the door open for some third parties to be excluded from the disclosure restrictions, provided that their contracts with companies are broadly written and they do not sell the data. For instance, imagine a contract that allows a data recipient to conduct a wide range of “analytics.” Because the recipient is not selling the data, the company might be able to disclose personal information to that recipient without honoring an opt-out request.

Under Sorrell, such distinctions might lead a court to conclude that CCPA imposes a content-based restriction on speech. Moreover, the findings and declarations section of the bill cites the revelations about Cambridge Analytica’s use of Facebook user data, and states “[a]s a result, our desire for privacy controls and transparency in data practices is heightened.” This could cause a court to conclude that the legislature was targeting a particular type of business arrangement when it passed CCPA.

I highly recommend reading the rest of Kosseff's analysis as well. He notes that he's generally in favor of many internet regulations -- and has been advocating for cybersecurity regulations and didn't think amending CDA 230 would be that bad (I think he's wrong on that... but...). And his analysis is that CCPA is so bad it cannot become law:

[M]y initial reaction was that nothing this unclear, burdensome, and constitutionally problematic could ever become law.

He then goes on to detail 10 separate serious issues under the law -- and notes that those are just his top 10 concerns.

While it's nice to see lots of people suddenly interested in privacy issues these days, the mad dash to "deal" with privacy through poorly thought out legislation where the target and intent is unclear other than "OHMYGOD INTERNET COMPANIES ARE DOING BAD STUFF!!!" isn't going to do any good at all. There is little in here that suggests real protection of privacy -- but plenty of costs that could significantly change the internet many of you know and love, in large part by making it nearly impossible for small businesses to operate online. And, frankly, ceding the internet to the largest providers who can deal with this doesn't exactly seem like a way to encourage smaller operations who actually are concerned about your privacy.

Filed Under: california, ccpa, free speech, gdpr, privacy, regulations