Guess you can’t please everyone.
Comments on the second draft of the California attorney general’s implementation regs for the California Consumer Privacy Act (CCPA) are rolling in, and no one seems all that satisfied.
Privacy advocates, such as the Electronic Frontier Foundation, think the California attorney general is watering down the law, while ad industry reps, such as the Association of National Advertisers (ANA), don’t think the AG is doing enough to amend it.
Written feedback on the draft was due Tuesday following a 15-day comment period. After digesting the comments over the next few weeks, the AG will either release a third draft for comment, if it makes substantial changes, or issue its final version.
The ANA’s arguments
The ANA has three primary points of contention with the AG’s modified regs: confusion about how to administer loyalty programs, a lack of clarity on implementing global privacy controls and the rapidly approaching CCPA enforcement date.
The ANA argues that the loyalty program requirements in the AG’s second draft are too vague. A business with a loyalty program must prove that the value it receives from a consumer’s information is commensurate with the value that the consumer is receiving from the loyalty program. But there’s no guidance on how to quantify that value, said Dan Jaffe, the ANA’s group VP of government relations.
The ANA is also nonplussed by the AG’s Do Not Track-like mandate for businesses to honor user-enabled global privacy settings, which the ANA claims will hinder a consumer’s ability to make specific, business-by-business choices about which companies can and can’t sell their personal information.
Considering these and other open questions, the ANA is advocating that the AG give businesses a six-month enforcement moratorium until Jan. 1, 2021, so that they have more time to adjust to the law. CCPA enforcement is scheduled to begin July 1.
If the AG makes further changes to its regs based on the comments it received and releases a third draft, that triggers another 15-day comment period. And even if no further changes are made, California’s Office of Administrative Law still must approve the AG’s proposal, which could take up to an additional 30 days.
“At that point, we’ll be pushing up against the July deadline for enforcement,” Jaffe said. “It’s even possible that the regulations won’t be done before enforcement, which is a problem for businesses.”
Jaffe is hopeful that the AG’s office will be sympathetic to at least some of the ANA’s suggestions.
“They were clearly listening before and they made some important changes in the second draft,” he said. “But that doesn’t fully solve the problem – if you make something half OK, there’s still another half that’s not.”
A different take
Parties on the other side of the debate, however, such as the EFF, see the state of play for the AG’s CCPA rulemaking process quite differently. From their point of view, every step forward for the ad industry is a step backward for consumer privacy.
In its comments to the AG, the EFF laments that the modified regs “make a number of changes to the original draft that are business-friendly at consumers’ expense.”
In the original draft, for example, businesses that collect consumer data online would be required to treat user-enabled privacy controls, such as browser plugins or other privacy settings, as an opt-out. The second draft added language that a Do Not Track control cannot be used to opt out of data sales.
“A business that cannot collect a person’s information cannot sell that information,” the EFF wrote in its comments. “The greater (do not collect) includes the lesser (do not sell), so businesses should treat ‘do not track’ headers as requests to opt out of a sale covered by CCPA.”
The EFF is also disconcerted that the second draft reduces the types of information covered under the law. IP addresses, for instance, are carved out of the personal data category as long as they can’t reasonably be linked to an individual or household.
Now that the gauntlets are down (again), it’s up to the California attorney general’s office to sort through the comments and come up with a plan that pacifies vastly different stakeholders while also hewing to the principles of the law. Good luck. We await your third draft.
