Privacy & Security 4 min. read

What California’s strict new privacy law means for tech

What California’s strict new privacy law means for tech

When California signed into law its new data privacy regulation, it was met with differing perspectives. On one hand, you had some calling the state a “bellwether” for the rest of the country, lauding its swift ability to act based on public outrage at recent consumer privacy scandals. Then you had the tech companies, many of which called the law “rushed,” and a bill that will ultimately lead to “unintended consequences.”

If you dig into the details, you can perhaps see both sides of the coin. What’s clear, however—as we’re still recovering from the Facebook bombshell—is that data privacy laws are in tatters and something has to change.

The California Consumer Privacy Act of 2018, set to go into effect in 2020, is said to “mirror” much of what the European Union has implemented with GDPR. The law, signed by Calif. Gov. Jerry Brown on June 28, effectively gives consumers the right to ask businesses whether they have collected any personal data on them—and whether they’ve sold that data. A consumer will also be able to opt out of such data collection. Companies that store large amounts of personal information—including major players like Google and Facebook—will be required to disclose the types of data they collect, as well as identify the category of third-party organizations that receive the information.

On the surface, this all sounds reasonable—and, frankly, something that should have been in place anyway. And yet large tech organizations are readying to fight back, many of which already spent millions of dollars trying to kill this privacy initiative before it ever reached Gov. Brown’s desk.

Those efforts were, as we’ve now learned, in vain—and to a degree, hypocritical. For instance, Amazon has gone on record as being a proponent of GDPR, and yet it adamantly opposes the new California law—despite the similarities between the two. Facebook reportedly shelled out $200,000 to block the CA privacy measure, but after its Cambridge Analytica scandal and Zuckerberg’s grilling on Capitol Hill, the tech giant flipped a 180 and declared support for the new law, after all, stating that much of the regulation’s necessary changes have already been implemented in Facebook’s recent privacy overhaul.

The way things currently stand, the big issue tech giants have is that businesses rely on being able to identify customer preferences to find the right people to market their product to. For instance, a company that sells dog products needs to serve its ads only to people who actually own dogs. If customers opt out of sharing data, however, that might not be possible; businesses may waste dollars marketing their fancy dog collar to a person who has never, and will never, actually own a dog.

This law could, then, drastically change the way companies go about finding their prospective customers, and it could hurt smaller businesses simply trying to keep the doors open.

Another reason tech giants are, in general, against this law is that it could “interfere with a retailer’s ability to treat VIP customers like VIP customers,” effectively putting an end to loyalty programs that offer discounts to members. The new law would prohibit retailers from treating customers who opt out of data sharing any differently from those that do; if you’ve ever signed up for a loyalty card and agreed to let the retailer share your data in return for, say, 20% of your purchase, that, under the new regs, would be prohibited.

Where the frustration lies with tech companies is not so much that stricter rules have been signed into law, it’s that in order to rush the legislation through, no tech firms were consulted. As Microsoft says, “the California measure could have unintended consequences for both businesses and consumers and that there is a better way to give consumers the privacy rights they deserve.”

Google followed that up with a similar statement, noting that while the law “marks some improvements to an overly vague and broad ballot measure, it came together under extreme time pressure, and imposes sweeping novel obligations on thousands of large and small businesses around the world.”

In short, the major tech giants suggest we need to think more carefully about this, but it’s worth remembering that the reason this law came about is because Alastair Mactaggart, a real estate developer, spearheaded the charge after speaking to a Google engineer candidly one night who indicated that consumers would be shocked by the breadth of data collected by online companies. And the collection and sale of that data, as noted in the dog business example above, is worth a lot of money.

One might think that, with the law not taking effect until 2020, we have time for amendments that eliminate some of the “unintended consequences” to be made. However, broad changes to the way a company operates can take a long time to implement; because the current law was hastily assembled, legal groups have said that determining exactly what constitutes as ‘personal information’ is unclear, and therefore it’s difficult under its current guise to adequately advise companies on what they need to do next.

And let’s not forget that this law only applies to California. New York may, for example, implement a similar set of regulations of its own. But even minor differences between the two could have large implications for businesses preparing to stay compliant. This is why tech companies are pushing for laws to be adopted on a national level—creating one set of guidelines to follow.

And perhaps that will happen. After all, sometimes it takes a group to throw their hats into the ring for things to escalate, and with California reacting so swiftly to the controversy regarding private consumer data, this could be the catalyst needed to adopt a widespread regulation that appropriately protects the privacy of consumers across the country.

That, in a nutshell, is what we’re fighting for. There needs to be better regulation to protect users, and, frankly, any step is a step in the right direction—anything to spark a conversation is a vehicle to move the initiative forward.

What’s clear, though, is that there are murky waters ahead. However, there are times when you simply have to wade in to find what you’re ultimately looking for.

Get the latest stories and tips from Hotspot Shield in your inbox