While the new year has brought new regulations, one sweeping state privacy law has also brought mass confusion around its enforcement and scope.
The California Consumer Privacy Act, or CCPA, promises to implement a range of new privacy requirements that will compel companies across industries — including major tech companies, such as Facebook Inc. and Alphabet Inc.'s Google LLC — to give consumers more access and control over their data. Although the law went into effect Jan. 1, the state's attorney general, Xavier Becerra, has not yet released the final rules for the law, bringing concern and uncertainty to many in the business community, who argue the proposed rules leave much unclear about the law and its enforcement.
Dan Jaffe, group executive vice president for government relations at the Association of National Advertisers, said in an interview that while it is too early to make broad generalizations about how CCPA will play out, ANA's members and the business community as a whole are struggling with the law because they are "in a state of limbo" without final regulations from Becerra.
"The attorney general has not completed his rulemaking and yet we need to comply or try to comply with the law while some of the key provisions are not clear cut and therefore companies are put in the position of playing regulatory Russian roulette," Jaffe said.
ANA members include Altice USA Inc. and AT&T Inc.
Among other provisions, CCPA will give consumers the right to opt out of having a business sell their personal information to a third party. The law will also let them know why a company wants to collect their data and the specific pieces of personal information a business has collected about them, among other provisions.
While CCPA went into effect earlier this year, a statute in the law stipulates that the attorney general shall not bring an enforcement action until July 1, though he has suggested that the gap in time between the law going into effect and enforcement starting will not be a blanket grace period.
Jaffe said questions over enforcement only add to the confusion, noting ANA members must decide now how best to comply because the law is in effect. "But will the attorney general, when he gets his authority to enforce, come back against people and say, 'Hey, you guessed wrong?'" he said.
The proposed regulations have drawn comments seeking clarification from a wide range of industries, spanning from trucking to insurance. The California Trucking Association, for instance, warned in written comments that by classifying carriers as "service providers," package transportation providers will need to discard shipping information about each individual package after delivery. This, they argued, would impair commerce and harm consumers.
And the American Property Casualty Insurance Association argued in public comments that, among other concerns, the "multitude of consumer notifications" required under the proposed regulations would increase consumer confusion and are "contrary to the trend in consumer demand for shorter, yet informative, notifications."
Alan Friel, a partner at the law firm BakerHostetler LLP who has helped companies develop and implement privacy programs to comply with CCPA, said in an interview that he suspects Becerra's initial enforcement efforts will be with "industry-leading companies," but added that Becerra's strategy around enforcement remains unclear.
The San Francisco Chronicle and other outlets reported in December 2019 that Becerra said he would be patient with mom-and-pop stores making clear efforts to comply, but that "ignorance of the law" would not be an excuse.
Becerra's office did not respond to a request for comment.
"I think he'll probably also look to bring some cases that sort of establish issues — like there's the issue of cookies," said Friel. "[It] wouldn't surprise me if that ultimately becomes an enforcement action because people are taking different approaches to how cookies are treated, although he's given no guidance on that and I would hope that he'd provide guidance before just bringing an enforcement action."
Cookies are small text files that websites place on a user's device to store information about the user's activity. They can be used to recognize a returning user or to provide targeted advertising.
Becerra has also said that he will prioritize a provision in the law that, in part, requires companies to receive consent from parents of children under 13, and "affirmative" authorization from children ages 13 to 16, to sell personal information, according to the San Francisco Chronicle report.
Prioritizing violations pertaining to children's privacy early on, Friel said, would "seem to be a natural place to start," because it has been an area of sensitivity where state attorneys general have been active in enforcing a federal children's privacy law, known as the Children's Online Privacy Protection Act.
While businesses are still seeking clarity over the existing law, some groups in California are already advocating for further protections. Alastair Mactaggart, board chair of the advocacy group Californians for Consumer Privacy, has filed an initiative to appear on the November 2020 ballot that would create additional privacy rights, because he says current California law does not go far enough.
"The finish line for regulation never seems to be in reach," said Jaffe of the most recent proposal. "It would be like you're running a 100-yard dash and suddenly they say, 'Uh-uh, you're running a 440-yard dash.'"