As Goes California, So Goes the Digital Ecosystem
While you were focused on a confusing and contentious presidential race, you may have missed the fact that California passed a consumer data privacy law (CPRA) that extends and strengthens the 2018 California Consumer Privacy Rights Act. (CCPA). You may notice when you visit many websites, you are served a popup asking you to opt into cookies, disclosing the website is tracking your browser. That's due to the CCPA. The CCPA was meant to limit the amount of consumer data that could be sold, but loopholes meant that "sharing" isn't "selling," so Facebook, Google and many anonymous data brokers avoided oversight.
The CPRA attempts to close those loopholes. requiring more transparency in what data companies collect and how they use that data. It allows consumers to opt out of collection. It creates a new category of Sensitive Personal Information (not just your name), including race, sexuality, religion and health data..
Common sense tells us that what marketers and content providers must adhere to in California ends up universally applied. This is the world wide web, not the California web. And while it's disruptive to digital ad-tech, my view is that consumers have consistently traded privacy for convenience, so they'll continue to opt in. And, in a way. the transparency of data collection may feel less stalker-y than random uber-targeted ads that have clearly been tracking your digital breadcrumbs. "How did Facebook know I was thinking about adopting a puppy?" The American Advertising Federation disagrees and is lobbying for a federal privacy law.
Of course there are a few caveats:
- Enforcement doesn't begin until 2023
- Businesses with less than $25 million in revenue are exempt
- Experian and Equifax are exempt
- Companies can exempt customers from perks who do not share (Somehow this just feels like a Supreme Court case - small provision with big precedent.)
