How Tech Companies Are Trying to Gut the California Consumer Privacy Act

With no federal law governing digital privacy, California’s Consumer Privacy Act is expected to set the national standard when it goes into effect on Jan. 1. Unless it’s neutralized by the state Legislature, which is wrapping up its 2018-2019 session.

Under the law, written in the spirit of tougher European regulations, any company doing business in California has to reveal what personal information they have collected about any state resident — upon request.

“When the CCPA goes into effect, and individuals and reporters will go to companies and say, ‘What do you know about me?’ I think that will be a game changer,” said Mary Stone Ross, an expert in consumer privacy who co-authored the law.

Ross and her allies are betting that, for some companies, the very thought they’d have to disclose what they’re collecting if consumers ask might prove a deterrent.

“If all of a sudden it’s easy for me to find out that they’re collecting pictures of my children, maybe I won’t be so inclined to use them,” she said.

But how much of a game changer the law will be is up for debate.

Room for Interpretation

The CCPA was rushed through Sacramento last year: inside a week, with no hearings. California lawmakers and lobbyists on all sides agreed at the time there would be tweaks this year, but of course, they disagreed on what they should be.

Privacy advocates including the American Civil Liberties Union, Common Sense Media and the Electronic Frontier Foundation want to tighten the language. Business interests want to loosen it.

Tuesday was the deadline for state lawmakers to play with a host of bills, some that include amendments to the CCPA, before they come up for a floor vote. Industry groups trying to weaken the act by futzing with its language succeeded in stripping out consumers’ right to opt out of data collection without then having to pay more to receive the same services.

You can imagine, for instance, easily deciding to quit Instagram if opting out of data collection meant you had to pay for an account. But you may be less likely to opt in to more expensive phone service or home insurance in order to opt out of data tracking.

You’re the Product, Whether or Not You Paid for the Service

Companies big and small make money selling your data, or hope to in the future, whether you pay for their services or not: phone companies, carmakers, that stupid app you downloaded Saturday night. California’s Privacy Act doesn’t restrict any of this. The law as it stands now only provides consumers the right to know what data’s being collected, sold and sometimes given away in a data breach.

Companies of all sorts have been careful to let industry groups take the lead in making what could be considered an unpopular case.

For instance, a group called Keep the Internet Free, which is a project of the Internet Association — a trade group for tech companies like Facebook, Google, Microsoft and Twitter, has been geo-targeting people in Sacramento with online ads like this one in recent weeks.

Tech companies asked reporters to contact industry organizations about the CCPA; the groups didn’t respond to KQED requests for comment.

The Fight Going Forward

Privacy advocates don’t anticipate further changes to the language of the act this year. But next year, both sides will continue to do battle while business interests work to weaken or kill similar bills in Washington D.C. — even as they claim that a federal law is necessary to avoid a “patchwork” of laws on the state level.

It’s not yet clear whether a federal law would necessarily preempt tougher state laws.

“Privacy is a right that cuts across all different demographics. Male, female. Old, young. Republican, Democrat,” said Chris Conley, a policy attorney with the ACLU of Northern California.

“The CCPA is a very important first step. It is not the perfect bill,” Conley added. “But someone has to be the first. It might as well be California pushing forward the idea that consumers are ultimately the ones who are in control of their own personal information, and that they are not simply subject to the terms of service and policies that companies impose upon them.”

Even if the new law isn’t held up by lawsuits before it goes into force, supporters — and opponents — agree that the CCPA has created a new political playing field on which they expect to stay busy for the long term.