California’s Prop. 24 ballot initiative is headed to the voting booth in a little under a month, and nominally it is meant to shore up holes in the existing California Consumer Privacy Act (CCPA). Critics are concerned that it might instead create a “pay for privacy” scheme that would leave behind users of online services that are unwilling or unable to pay added fees.
As one might expect, some privacy advocates are opposing Prop. 24. But it also faces resistance (or at least a lack of support) from some members of the industries that would ostensibly benefit from a “pay for privacy” scheme, chiefly tech and media companies.
Prop. 24 in the crosshairs
Prop. 24 is essentially a “second try” by Alastair Mactaggart, real estate investor and architect of the CCPA. While the CCPA created the strongest set of data privacy regulations in the United States, weak points in it prevent it from achieving parity with the world’s premier data laws such as the EU’s General Data Protection Regulation (GDPR).
As it stands, CCPA does have some substantial loopholes that are primarily of benefit to big tech companies. One is the ability to simply reclassify as a “service provider” rather than an “advertiser,” which allows some companies to sidestep many of the regulations regarding the sale of personal data. The concept of “personal information” is also somewhat vaguely defined such that information that has been made public at some point might be excluded in terms of conditions of sale and data breach consequences.
These loopholes are not entirely clear-cut and it would take some time (and the results of complaint enforcement decisions) to see exactly how exploitable they are, but they are concerning enough that the Electronic Frontier Foundation (EFF) felt compelled to address the state attorney general about them in March. One would assume that the EFF would thus be a Prop. 24 supporter, but the EFF is refusing to support it. The privacy organization characterizes Prop. 24 as a “mixed bag” of changes that includes both positive and negative outcomes for data subjects, and it cites the “pay for privacy” proposal as the foremost of those consumer-unfriendly terms. Joining the EFF in opposing the bill are the ACLU of California, the California Nurses Association, Color of Change and the League of Women Voters among other groups.
Privacy advocates like the EFF coming out against Prop. 24 is one unexpected outcome. Another is the big tech companies of Silicon Valley mostly deciding to sit quietly on the sidelines rather than registering vociferous opposition to it. Google, Amazon and Facebook among others have opted to not take a position on Prop. 24 and have said little in public about it.
Lack of support for “pay for privacy”
One might expect robust support from big tech given that the “pay for privacy” proposal would appear to be to their direct benefit. Companies that collect and sell user data would be allowed to either charge consumers an added fee for the expected value of the personal information they have been cut off from, or offer an equivalent discount. The customer would thus end up paying a premium of some sort on each of their accounts to enjoy the full privacy protections of Prop. 24.
Mactaggart has framed the “pay for privacy” terms as a way for publishers to recoup vital income they would stand to lose under the stronger Prop. 24 regulations; in an interview he called it a means to “preserve the free press.” In spite of this, California’s newspapers have mostly lined up against the ballot measure, with the Los Angeles Times being the one major exception thus far to endorse it.
Mactaggart believes that the big tech companies are not openly fighting the proposed change to state law because of negative PR blowback in a climate that is increasingly supportive of data privacy, and he may well be right about that. However, it also could be that these companies have done the math and believe that the “pay for privacy” terms are more beneficial than whatever the cost of the new regulations might be.
While the #CCPA created the strongest set of data #privacy regulations in the US, weak points in it prevent it from achieving parity with the #GDPR. #respectdataClick to TweetWhile Prop. 24 would expand consumer’s ability to view the information that companies collect on them and add a much-requested right to edit and correct these records, there are some other terms beyond the “pay for privacy” scheme that are not beneficial to data subjects. The CCPA currently extends to protect Californians when they physically travel outside of the state; the new terms would remove protections once they cross the state border. Employees would also have to wait two years to be able to view information that employers have collected about them. And browser or device settings that automatically notify sites of privacy preferences would no longer be considered valid, as they are under the CCPA; end users would have to manually change settings and opt out with every site and service that they use.
If Prop. 24 passes, the new terms would go into effect in 2023.
