The New California Privacy Law—Should You Care?

By Eric Little

More privacy.  It seems like a good thing—something like money or apple pie, where more is better.

At least that’s what the folks down the hill in Sacramento seem to think.  A couple of weeks ago the California legislators passed a new privacy law, all 16 pages of it, unanimously, with barely a fist full of absentees and no “Nays.”  The catalyst for the law was a ballot initiative on privacy scheduled for November which had been financed by a wealthy real estate investor.  The new law strikes a bargain with the investor as it takes effect January 1, 2020 on the condition that he withdraws his initiative.

At the moment there’s plenty not to like in the new law.  Its unintended consequences will hurt small and medium-sized businesses and limit effective civil and political discourse to a small number of on-line platforms.

Like the recently implemented European General Data Protection Regulation (the “GDPR”) the California law covers all personal information, regardless of whether such information is collected, sold or transferred over the internet, by video, manually, or some other fashion.  Although the law applies to only certain for-profit entrepreneurs and companies, it will, none-the-less, sharply curtail the collection, sale or transfer of personal information about California residents.  Indeed, this is its intended purpose.

While affected companies can still collect personal information, they must:

• Delete such information if requested by a California resident;
• Not discriminate in price or quality of service against customers that have required deletion of personal information, prohibited its sale or exercised certain other rights; and
• Post a link that says “Do Not Sell My Personal Information.”

Many will say this is a good thing.  They’re damn tired of having ads for lawn chairs after they’ve checked prices on Amazon, follow them around like a lost puppy on the next 15 internet sites they visit.  Nothing wrong about prohibiting that, they might say.

Well, let’s walk through what might happen.  Clearly, the legislators think that it is important that a long list of different types of information about California residents not be widely sold or otherwise shared.  Let’s take them at their word and assume that most people press the button and say “DON’T SELL MY PERSONAL INFORMATION.”

Information about California consumers will become unavailable as data brokers avoid this market segment.  Even aggregated information based on consumer location will, over time, dry-up, limiting the marketing efforts of small to medium sized businesses, non-profits, political campaigns, and other advocacy organizations.

For companies that make a living from the collection or sale of consumer information, the effects will be severe.  Startup and emerging companies with a business plan that relies on the sale of data will no longer have buyers.  They will have to pivot to a new revenue model, or more likely, simply go out of business.

For the largest technology and social networking companies, revenues from the sale of data are certain to drop off or even vanish.  But there may be a silver lining for these companies.  Their market power will probably increase while their smaller start-up and emerging competitors are driven out of business.  How could this perverse result happen?  Easily.

Companies will continue to collect data about their customers by offering them the following choice, buried deeply in their cookie or privacy policies.

We support ourselves through advertising.  Please select the type of advertisements you would like to see when you visit our site.

              Choice 1.  A random selection of ads,

              Choice 2.  Ads which we believe are most relevant to You based on your interests and activities.

Either by choice or as a result of click fatigue, my guess is that most visitors will opt for the targeted advertisements.

Thus, the largest companies–the Twitters, the Googles, the Facebooks and, of course, Amazon-will have enough consumer data that vendors will continue to place targeted ads on their platforms.  If these companies are unable to sell this information to data brokers or vendors, vendors will have to come to them to sell targeted ads.

Rates for targeted ads will rise and the importance and market power of the biggest on-line companies with the most data will increase, rather than decline.  Smaller companies who don’t collect sufficient information on consumers will be out of luck.

But wait, there’s more.

Because targeted advertising will be limited to a smaller number of platforms, many vendors will seek to market on Google and other search engines, displaying their advertisements when relevant searches suggest that a visitor is a likely prospect for their products or services.  However, the number of individuals searching for relevant items is, at any one time, going to be far smaller than the targeted market, so vendors will have to place more ads and this alternative will also become more expensive.

Already there is evidence that Google, as a consequence of restrictions in the GDPR that are loosely analogous to the new California law, is benefiting from this change in marketing behavior.

These effects, by themselves, argue for a rethink of the privacy law.  Yet vastly more important than its economic effects may be the new law’s long-term civic and political impact.

One of the few beliefs that may still be shared by most Americans is a belief in a government of limited powers.  Each of our three branches of government serves as a check on the others so that no one of them can become too powerful.  But there is a fourth power, set forth in the First Amendment, where it states that the government shall make “no law … prohibiting … the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.”

The great social movements in the United States—universal suffrage, civil rights, protections for labor and many others—grew out of the exercise of this right.  With so much of our lives lived on-line these days, this right to gather together and seek redress must also live on-line.  However, if names and addresses of California residents, both physical or on-line, are unavailable, how can we exercise this right effectively?

Thus, one has to ask.  Will the next great social movement be forced to advertise on Facebook or Google to share its message?  Is that what we truly want?

Fortunately, the new law desperately needs to be written to clarify ambiguities and inconsistencies that are likely a consequence of rapid drafting.  During the coming year there will be a fight over possible revisions to it.  The privacy advocates and the lobbyists will have their say.  It’s your chance to speak up as well.

It’s not that state or federal law should not protect some information about individuals from public disclosure.  Democratic Senator Mark Warner released a white paper this week which included several good proposals.  However, the breadth of the California law and its all-encompassing definition of personal information go too far.

Technology companies are likely to push for a federal law that would preempt state legislation.  However, the prospect that the California law might go into effect without revision, or worse, that it might be a model for nationwide legislation, is frightening.

Really, seeing too many lawn chair advertisements is a cheap price for preserving the power of future generations to be agents of social change.  So yes, you should care.