In 2018, the state passed the California Consumer Privacy Act (CCPA), a law that established consumer rights for personal information collected by companies. For example, as a California resident, you have the right to know what info a business has on you and you may request to delete it. CCPA took effect on large businesses just this year. Prop 24 aims to strengthen CCPA, changing some of its language, increasing penalties, and creating an agency to enforce it.
Some tech industry groups oppose it, obviously, but surprisingly, tech companies themselves aren't throwing money to try and stop this (like Uber/Lyft/DoorDash are for Prop 22). Even some privacy and civil-liberties groups oppose Prop 24 because it doesn't do enough, has exemptions that may worsen consumer protections, and it would be difficult to modify with legislation. Supporters argue Prop 24 is necessary because tech companies were able to wiggle their way out of CCPA, and the fact that it would be hard to amend is a feature, not a bug, to prevent lobbying from eroding privacy protections.
We'll need to get into the weeds to explain the debate here, so please, watch your step.
Both sides agree with the overall intent and goal of CCPA and Prop 24 – to give consumers more control over how their personal information is collected, stored, and used by companies. Most people don't feel in control of their data. The disagreement with Prop 24 comes from how to codify that into law without totally stifling the way the major tech giants make money.
The full text of the proposition is 52 pages long. For sake of brevity, we won't go into every diggity detail that Prop 24 proposes. We recommend the official CCPA website to understand CCPA, and the LAO summary to understand what Prop 24 would change. Instead, we'll jump straight to what it intends to fix and why some privacy groups are against it.
After CCPA passed, tech companies capitalized on two loopholes to exempt themselves. In particular, the CCPA says users have a right to opt out of the "sale" of their data, but tech companies argued that they don't sell data, they simply share it. Secondly, CCPA exempts service providers who need data to perform a "business purpose." Tech companies argued that they provide the service of targeted advertising, exempting the aspect of their business the privacy law was targeting.
If a company does break the new law, it's up to the state attorney general to enforce it, but companies have 30 days to fix it, penalty-free.
Prop 24 amends the CCPA, changing the "Do not sell" clause to "Do not sell or share" and clarifies that targeted advertising is not a "business purpose." It also removes the 30 day grace period for companies to fix infractions, and creates an enforcement agency to put teeth on the law.
One of the main concerns of the No side is the expanded exemption that allows businesses to charge different prices (or offer different quality of goods/service) depending on the privacy rights a consumer exercises. That difference in price must be "reasonably related to the value provided to the business by the consumer’s data." To be clear, the exemption already exists in current law (CCPA), but Prop 24 would expand it to "loyalty, rewards, premium features, discounts, or club card programs."
There are two aspects to this.
Opponents also argue Prop 24 defaults to weaker privacy protections, putting the onus on consumers to contact the company to say they don't want their data collected or used. They would have preferred that the law compelled companies into an opt-in experience, where companies must get explicit user consent, much like GDPR did for cookies. Supporters counter that such an experience can be frustrating for users (i.e. cookie consent pop-up hell), and that browsers are already set up for automatic opt-out. (Unfortunately, most sites currently don't respect that browser header.)
Hi James, it's your pal Lionel from Yes on 24. Can I count on your vote this election to beef up consumer privacy for all Californians?
You gotta be kidding
I'm sorry, I didn't understand your question. Would you be willing to pledge to vote Yes on 24?
You're trying to convince me to vote on increased privacy by spam texting me
While you're wasting my time, I might as well waste yours. Please "Lionel" tell me about 24
Great question! 24 aims to toughen the California Consumer Privacy Act enacted this year. Tech companies have skirted the law, and Prop 24 fixes those loopholes.
I do know about the CCPA, and I liked that it tried to give consumers rights, but it puts a lot of work on the user. I don't have time to opt-out of every site I use.
The alternative, according the author of CCPA and Prop 24, would've been requiring consent on every website, and we know what that looks like thanks to GDPR.
Sure, but did CCPA really change anything, or will Prop 24? Who's going to email the sites they use, and then track down all the sites those sites share data with, etc, etc.
CCPA is the strongest consumer privacy law in the country. I know that's not saying much, which is why we need 24: to patch it up and to enforce it.
Why did the CCPA go through the normal legislative process but now we need to vote and understand Prop 24? Seems weird.
Alastair Mactaggart needed to get past tech lobbying and Republicans. He thinks the public would understand better why they need these rights.
Sure, but the tradeoff is it'll make it harder to adapt in the future. There's no way one man got it right.
Also, I just googled it. Why are people yelling "Pay for privacy" everywhere?
Prop 24 expands it to exempt loyalty clubs. CCPA needed to exempt certain aspects so as not to ruin entire industries.
For example, newspapers wouldn't be able to charge an ad-free subscription if it weren't for that clause. Opponents have twisted it into saying companies can allow pay for privacy.
... but that's what it is isn't it? Aren't we worried this creates more inequity. The wealthy get privacy. The poor are exploited with targeted ads.
Prop 24 allows for changes to be made with a simple majority vote in the legislature.
But they have to take into account it's impact on business?
The intent of the proposed law is clear and the courts would side with the intent.
kthnx