Five major advertising trade groups the 4As, the AAF, the ANA, the IAB and the NAI, are asking California Attorney General Xavier Becerra to “clarify” the California Consumer Privacy Act (CCPA) “through rulemaking to provide improved consumer protection and guidance to business.”
Due to absent pre-emption by federal legislation, the CCPA is set to become the default data privacy law of the United States when it goes into effect on January 1, 2020. The CCPA, a little less stringent than the GDPR, was passed to head off a 2018 California ballot initiative. One of the things that the CCPA mandates is that consumers be given the ability to prevent their personal data from being sold or distributed to third parties. In addition, companies subject to the law will have the burden of disclosing information being collected about individual consumers. It also provides penalties for non-compliance and gives affected individuals the right to sue. None of this is agreeable to many brands and marketers, as well as to the U.S. Chamber of Commerce, since it threatens current operating procedures of the digital data ecosystem. The trade groups have asked for changes in the law that should lead to reduce the burdens of compliance and the potential exposure for marketers, retailers and brands.
Specifics are as quoted below:
Section 1798.115(d) of the CCPA prohibits a company from selling consumer personal information that it did not receive directly from the consumer unless the consumer has received “explicit notice” and is provided an opportunity to exercise the right to opt out of that sale. We urge the AG to recognize that a written assurance of CCPA compliance is sufficient and reasonable.
Sections 1798.105 and 1798.120 of the CCPA allow consumers entirely to opt out of the sale of their data or delete their data; but the law does not explicitly permit a business to offer a consumer the choice to delete or opt out regarding some, but not all, of their data. We request that the AG clarify that businesses may offer reasonable options to consumers to choose the types of “sales” they want to opt out of, the types of data they want deleted, or to completely opt out—and not have to just provide an all-or-nothing option.
Section 1798.110(c) of the CCPA arguably requires a business’ privacy policy to disclose to a consumer the specific pieces of personal information the business has collected about that consumer. We ask the AG to clarify that a business does not need to create individualized privacy policies for each consumer to comply with the law.
The group is proposing that consumers and companies be given more options around consent to the use of personal data. It implies the ability to offer incentives to consumers in exchange for use of their data. The trade group letter says, “Without clarification and adjustments, these and other ambiguities in the law could result in reduced choice and privacy for consumers, rather than expanding it, as the law intended.”
The CCPA could majorly disrupt the way companies collect and use consumer data. Depending on how it’s implemented and how consumers react, third parties in the data ecosystem could see their business models threatened. In addition, consumers prefer to allow first party data uses but are reluctant to allow their data to be distributed to third parties.
