Where are the promised fixes to the new privacy law?

One year ago, the California Legislature passed the California Consumer Privacy Act (CCPA), and then-Gov. Jerry Brown signed it into law.

Even at passage, the legislative leadership recognized its flaws – what some observers called an “unmitigated disaster in the making” – and committed to addressing its flaws in the year before it took effect in January of 2020.

Now that a year has come and gone, with a minor clean-up bill passed in 2018, narrow improvements are still alive.

The internet helps businesses reach consumers through an interactive process with real-time feedback from consumers, based on their specific online behaviors.

The CCPA exemplifies the problem of making law with a gun at the Legislature’s head: acting in haste under the threat of a protracted ballot initiative. But now the state’s businesses are left with the consequences. With lawmakers back in session, the Legislature should keep its word and enact additional fixes to the CCPA, including two that are critically important.

First, language must be adopted to fix the definition of “personal information.” The current definition is so broad that even the initiative’s original proponent, Alastair Mactaggart, acknowledged the need to address the ambiguity. Conflating anonymous, generic data with sensitive, personal information does not protect consumers. Instead, it decreases the value of their online experience by hampering access to the information they receive through the current ad-supported model that funds digital content and services; those who decide that they don’t want that information can simply opt out. The Legislature should revise the definition to specify that it applies to information that identifies or links, directly or indirectly, to a particular consumer.

Second, the CCPA must be modified to ensure that companies that provide media and entertainment, streaming music, tourism, traffic and navigation platforms, smart cities services, multimedia and creative agencies, and consumers that enjoy those apps and services are not eviscerated by the CCPA.

The internet helps businesses reach consumers through an interactive process with real-time feedback from consumers, based on their specific online behaviors. This is not a “sale.” As consumers engage online – for example, shop for shoes — predictive analytics connects businesses with consumers, and consumers are delivered ads that are relevant to their preferences and desired goods and services.

To address this fatal flaw in the CCPA, the Legislature should clarify that the sharing of limited and specific types of information is not considered a “sale.”

The CCPA allows consumers to specify that businesses not “sell” their personal information to third parties and to access the information businesses have collected about them.  Consumers should control their personal information,  but the law’s definition of “sell” disconnects consumers from the digital advertising ecosystem — treating all internet engagement relating to a consumer as a “sale.”

Startup companies, an important part of California unique economic culture, depend on a full functioning internet to make their entry into the market and sustained viability feasible. Under the regulatory controls imposed by the CCPA, they will be unable to attract the venture capital to innovate or monetize operations to the point where they can gain a loyal customer base.

Consumers will lose, too. As businesses dependent on customer interactions, whose products and services are supported by advertising revenue from the internet, adjust to a decline in revenue, consumers that rely on free services may be forced to pay subscription fees – or find that those services disappear.

To address this fatal flaw in the CCPA, the Legislature should clarify that the sharing of limited and specific types of information is not considered a “sale” if shared in a narrow fashion to provide customized content and on-line advertising to consumers. The resale of personal and identifying information, a cornerstone of the CCPA, would still be prohibited and consumers who do not want that content could simply opt out.

By embracing both of these fixes, the Legislature and governor can stay true to the original intent of the CCPA — protecting consumers – without devastating California’s technology, advertising, media, tourism and retail industries that depend on a highly functioning internet.

Those promises were made – and trusted — with good faith.

Now, they should be kept.
—
Editor’s Note: Matt Gardner is the founder and CEO of the California Technology Council.