How Tech Companies Are Trying to Gut the California Consumer Privacy ActSeptember 12, 2019
Photo by Jenny Kane AP
With no federal law governing digital privacy, California’s Consumer Privacy Act is expected to set the national standard when it goes into effect on Jan. 1. Unless it’s neutralized by the state Legislature, which is wrapping up its 2018-2019 session.
Under the law, written in the spirit of tougher European regulations, any company doing business in California has to reveal what personal information they have collected about any state resident — upon request.
“When the CCPA goes into effect, and individuals and reporters will go to companies and say, ‘What do you know about me?’ I think that will be a game-changer,” said Mary Stone Ross, an expert in consumer privacy who co-authored the law.
Ross and her allies are betting that, for some companies, the very thought they’d have to disclose what they’re collecting if consumers ask might prove a deterrent.
“If all of a sudden it’s easy for me to find out that they’re collecting pictures of my children, maybe I won’t be so inclined to use them,” she said.
But how much of a game-changer the law will be is up for debate.
Room for Interpretation
The CCPA was rushed through Sacramento last year: inside a week, with no hearings. California lawmakers and lobbyists on all sides agreed at the time there would be tweaks this year, but of course, they disagreed on what they should be.
Privacy advocates including the American Civil Liberties Union, Common Sense Media and the Electronic Frontier Foundation want to tighten the language. Business interests want to loosen it.
Tuesday was the deadline for state lawmakers to play with a host of bills, some that include amendments to the CCPA, before they come up for a floor vote. Industry groups trying to weaken the act by futzing with its language succeeded in stripping out consumers’ right to opt-out of data collection without then having to pay more to receive the same services.
You can imagine, for instance, easily deciding to quit Instagram if opting out of data collection meant you had to pay for an account. But you may be less likely to opt-in to more expensive phone service or home insurance in order to opt-out of data tracking.
You’re the Product, Whether or Not You Paid for the Service
Companies big and small make money selling your data, or hope to in the future, whether you pay for their services or not: phone companies, carmakers, that stupid app you downloaded Saturday night. California’s Privacy Act doesn’t restrict any of this. The law as it stands now only provides consumers the right to know what data’s being collected, sold and sometimes given away in a data breach.
Companies of all sorts have been careful to let industry groups take the lead in making what could be considered an unpopular case.
For instance, a group called Keep the Internet Free, which is a project of the