California’s new privacy law could create haves and have-nots

This week, in other voting stories, Californians passed Proposition 24, known as the Consumer Privacy Rights Act. It’s a new law designed to improve on one passed in 2018, the California Consumer Privacy Act, or CCPA. The updated version lets people request that companies not share their data, in addition to not selling it. It also creates an enforcement agency for compliance to be set up by 2023.

Like Europe’s General Data Protection Regulation, California’s privacy law has the potential to set rules of the road throughout the U.S. But a number of surprising groups opposed it, including the ACLU of Northern California and the advocacy group Color of Change because they said it could create data privacy inequality.

It’s a topic for “Quality Assurance,” the Friday segment where I take a deeper look at a big tech story. I spoke with Jessica Lee, a partner with the law firm Loeb & Loeb who advises companies on privacy. The following is an edited transcript of our conversation.

Jessica Lee: I think the concern of those [organizations] was that there was no private right-of-action, which means that individuals can’t sue a company to enforce their rights — they have to rely on this California Privacy Protection Agency. There are also some exemptions, so while businesses were concerned about this law, there were some exemptions that were built-in that are helpful [to them]. It increased the threshold so some smaller companies will fall outside of the scope. They clarify how much companies need to do to comply, so you don’t have to necessarily onboard new technology to help you find unstructured data in your datasets. Even the concept of offering financial incentives, I think, from the perspective, particularly of the civil rights [groups], sets up a structure where people might be in the position to have to pay for privacy. So privacy might be something that’s afforded to people who can pay for it as opposed to people who can’t.

Molly Wood: Can you explain to us what the law says in terms of this idea of loyalty programs?

Lee: I’ll take a step back for a second, because I think this is a law that gives consumers a lot of choice and you can opt out of sale, you can opt out of certain sharing, and it does put some principles on companies to limit the amount of data they collect. And I think you’ll see over time, I mean, we’ve kind of bought into this concept of an ad-supported internet. We get access to a lot of content for free, because our data is used for advertising purposes. So if we have to opt out, if the way that we protect our privacy is that we have to opt out of sharing or opt out of selling, well, then the response might be companies will start to put up paywalls or put together subscription models. And I think that kind of future is what these organizations are concerned with.

Wood: Well, yeah, I mean, fundamentally, this is an age-old battle: opt-out versus opt-in, it sounds like. Even the creator of the original proposition had originally hoped that the simplest solution in, some ways, is to say that the default setting should be that companies can’t sell our data. And if we want to let them we can opt in, right?

Lee: Right. It does have some traction, but it’s just culturally so different than how we’ve set our systems up. So it would be different if we had this conversation and this kind of rule when the internet was created, or we first started doing more digital advertising. But we’re so far down the path of another framework. I think the people behind this, [Alastair] Mactaggart and Californians for Consumer Privacy, did try to have some voice of business at the table, because they want a law that can be workable, won’t completely destroy the industry. But I think it’s very hard to force an opt-in regime on a country that has really operated on an opt-out basis on almost every front for decades.

Wood: I mean, I guess that’s the question. Sometimes California sets the rules of the road for other parts of the country, and we’ve talked about that with CCPA. And I wonder, will the existence of this law at least begin to advance a larger conversation, continue to advance a larger conversation about privacy regulation?

Lee: Oh, definitely. I think there will be a lot more motivation to really get a federal privacy bill. Now, I say that sitting in, I don’t know if it’s, I think it’s day three, but it feels like day 45 of our election. So what happens at the federal level is still very much in the air, and that’s both with how the presidential election shakes out, but then also, I think, we can kind of see where it’s going, what it looks like in the Senate. And I think getting a federal privacy bill passed will be very difficult if we have a divided House and Senate, or even some division between the president and the House and Senate. I think you need all three of those bodies to be in one party — I hate to say that, but to be in one party — in order to see something pass. It’ll be very challenging otherwise. I think there’ll be a push for it, but I’m not confident in the midst of our current political climate and what the likelihood is that’s going to be in the next four years.

Wood: Do you think it is inevitable that we will begin to create a system of haves and have-nots around data and privacy?

Lee: I do, unless we take some thoughtful steps to correct it, because there’s a fundamental right to privacy. I definitely agree to that. But there’s no fundamental right to the content you have access to online. And I think if the business model shifts and the current advertising model becomes less profitable, companies will have to look to other models. And those other models might require a pay-for-access, resulting in a good amount of inequality, unless we can start to get ahead of it. And I think we haven’t really seen any strong proposals to address that issue.

Related links: More insight from Molly Wood

There’s a lot more reading on Prop 24, as it was known in California, and what this law might mean down the road. But tell you what, there’s a reason this law passed handily in the state and never trailed: People do not trust tech companies or the devices we all use every day.

A report released in September by WhistleOut, which is a cellphone shopping and comparison site, found that more than 80% of Americans who responded to its survey think some big tech company is spying on them. Of those surveyed, many think it’s Facebook, TikTok or Google. Two-thirds of the respondents said they have definitely had the thing where they talk about something they’ve never searched and been targeted for a product ad. Fifty-five percent think that’s because of Facebook, 40% said TikTok, 39% think Google, which seems low to me on the Google front, I’m not going to lie. And more than half said they thought the government should ban at least one big tech company.