All Eyes are on California

By Susan Grant, CFA Director of Consumer Protection and Privacy

Last year, California enacted the Consumer Privacy Protection Act (CCPA), the most sweeping state privacy legislation in the country. Even though the law doesn’t go into effect until 2020, there are several bills in the California legislature this year that would either strengthen or weaken it.

Why does that matter to those of us outside of California? What happens in that state, the most populous in the nation (and coincidentally, the home of many of the tech companies whose practices have raised so many concerns about privacy lately) influences what other states may do and what happens in the U.S. Congress. In fact, the CCPA is one of the reasons why interest in federal privacy legislation has really heated up over the past year and why some businesses that resisted it before are now pushing for it – as long as it blocks the states from passing stronger laws. We oppose this because states can move more quickly than Congress to enact and amend laws to protect consumers. This is especially crucial as the fast pace of technology raises new privacy concerns.

California Assembly member Buffy Wicks has introduced AB 1760, dubbed “Privacy for All“, which would improve the CCPA by:

  • Enabling consumers to learn which companies have received their personal information through a sale or other form of sharing.
  • Requiring companies that share consumers’ data, as well as those that sell it, to get their opt-in consent to do so.
  • Preventing companies from punishing people who exercise their privacy rights by charging them higher prices or providing them with an inferior product or service.

A recent poll conducted for the ACLU of Northern California showed that people who are likely to vote in 2020 overwhelmingly support the key provisions in this legislation:

  • 94% support new laws that require companies to get permission before they share personal information, and that give Californians the right to know what personal information has been collected and with whom it has been shared.
  • 9 in 10 agree that even if they don’t pay money for products like Google, Facebook or Twitter, they still have a right to privacy and their personal information should only be shared with permission.
  • 89% say tech companies need to take additional steps to protect personal information.

We support this bill, and we were heartened when 24 tech companies recently endorsed it as well. They recognize that strong privacy protections gives consumers more confidence in doing business, and that’s good for their bottom lines.

Unfortunately, consideration of AB 1760 has been delayed and it may not move during this legislative session. There is another bill, however, that we hope will progress quickly. SB 561, sponsored by state Senator Hannah-Beth Jackson, would give consumers the right to sue companies that fail to provide them with the information they’re entitled to, don’t honor their requests not to sell their data, or violate other provisions of the CCPA. Predictably, the ad industry is complaining that this would lead to “frivolous lawsuits.” While the California Attorney General can enforce the CPPA, no AG has the resources to bring action in every deserving case. Private lawsuits are an essential and effective tool to ensure that companies play by the rules and compensate consumers who have been wronged – which is why some businesses fight so hard against legislation that allows them and include language in their one-sided contracts that force consumers to go to arbitration rather than seek justice in court.

There are also a number of bills before that California legislature that we oppose because they would roll back some of the protections that the CCPA would provide. We need “Privacy for All,” not just in California but across the country. All eyes are on California to see if it can once again lead the way.