4 ms·
This law seems much more reasonable compared to GDPR. "(b) "Business" means: (1) a sole-proprietorship, partnership, limited-liability company, corporation, as
by ryanworl 8y ago
This law seems much more reasonable compared to GDPR.
"(b) "Business" means:
(1) a sole-proprietorship, partnership, limited-liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers' personal information, that does business in the State of California, and that satisfies one or more of the following thresholds: (A) has annual gross revenues in excess of $50,000,000, as adjusted pursuant to paragraph (5) of subdivision (a) of section 1798.115; or (B) annually sells, alone or in combination, the personal information of 100,000 or more consumers or devices; or (C) derives 50 percent or more of its annual revenues from selling consumers' personal information; ..."
And the definition of "selling" is also clearly defined.
"
(q)(l) "Sell," "selling," "sale," or "sold," means:
(A) selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for valuable consideration; or (B) sharing orally, in writing, or by electronic or other means, a consumer's personal information with a third party, whether for valuable consideration or for no consideration, for the third party's commercial purposes."
[https://oag.ca.gov/system/files/initiatives/pdfs/17-0039%20%28Consumer%20Privacy%20V2%29.pdf https://oag.ca.gov/system/files/initiatives/pdfs/17-0039%20%...]
- blub 8y agoIt looks like it was designed to be useless, since neither Google nor Facebook sell info under the definition of selling you posted.
- yuhong 8y agoAnd yet they still lobbied against it.
- ryanworl 8y agoThere are many business that “sell” data under the second clause TO both Facebook and Google which could be impacted. The Facebook Pixel is definitely disclosing data to Facebook, even if they aren’t being paid for it. And they probably use data from the Facebook Pixel across many advertisers for Facebook’s own business purposes.
- 8077628 8y agoI guess the question is whether selling targeted ads counts as selling personal information under this law. My impression is that it doesn't, which makes me wonder what the author was thinking. In fact, this will be worst for the smaller companies that don't harvest, target and serve all in-house, while the behemoths will be untouched.
- mtgx 8y agoIt's not about Facebook Pixel, but the fact that ad companies usually don't "sell the data". They share the data with third-parties, and they can also give access to their advertising platforms (where the third-parties don't have direct access to the data).
- ryanworl 8y agoSharing the data is explicitly in the definition of selling I listed so long as the entity receiving the data uses it additionally for their own purposes. If Facebook uses it to provide more accurate targeting to a different advertiser, that sounds like using it for their own purposes to me. Edit: to be clear, the Facebook Pixel is basically fine under this law so long as Facebook only uses the data for facilitating ads for the company the data was collected from in the first place.
- jiveturkey 8y agon/a to facebook and google != useless. sounds like it would hurt equifax. that’s worth way more than google, which only gives access to demographic data and doesn’t directly share it.
- lajhsdfkl 8y agoIs the law only effective at protecting privacy in your mind if it kills Facebook's and Google's business model? Because I suspect that is what GDPR advocates truly want.
- saagarjha 8y agoIf their business model is violating privacy, then sure.
- mikekchar 8y agoI became an advocate for GDPR after I started implementing it for the company I work for. I am an advocate for it because it requires companies to think hard about what they need the data for and whether or not it is going to adversely affect their customers. Before GDPR there was virtually no downside for gathering private information. There was no downside for using that information to profile customers for any purpose you want. Now there is a downside: you have to tell the customer what you are doing with the data and you have to get permission to do so if the use is not related to the service that you are providing to the customer. IMHO this strikes a good balance. You can still use the data, but there is a cost. Even within the organisation where I work, it has completely changed the way they look at this data. Previously the attitude was, "Let's collect the data and use it, because why not?" Now we're being told, "These are the only things we want to collect data on because we don't want to piss off our customers". This is exactly what I want. I have in the past used Facebook's services. I currently use Google's services. I don't mind if their business model is destroyed because IMHO, on balance this way is better. I don't mind if people will have to pay for services like theirs. I'm old enough to remember a time where it was already like that -- it's really not so bad. Having thought about it (by way of being required to implement GDPR), I'm going to move to move away from the Google's et al. Having seen the transition in the company I work for, it's clear to me how much better it is.
- thoman23 8y agoThey might just be over the 50 million gross revenue threshold though.
- ocdtrekkie 8y agoNot only would this not affect Google and Facebook, who "sell your data" to their own internal marketing products (let's not pretend they aren't actually selling your data, they just have the marketing company in-house), but that minimum revenue bar also likely exempts your Unroll.mes who do literally sell your data, because they probably don't bring in enough revenue to cross the line. Companies burning investment money and not bringing in actual revenue would also be exempt.
- ryanworl 8y agoUnroll.me would probably fall under either of the other two categories that are not revenue-based.
- ocdtrekkie 8y agoAh, good point.
- friedman23 8y ago>let's not pretend they aren't actually selling your data, they just have the marketing company in-house They aren't actually selling your data... Maybe if you decide to change the definition of the word "selling" they are selling your data.
- JdeBP 8y agoOr, as pointed out in this very discussion, use the definition that is right there in front of you.
- friedman23 8y agoNo, I'll use the actual definition of the word thank you very much.
- Radle 8y agoTo many details in laws give judges less roam to do their job. There's a reason why European Countries aren't as specific.
- erik_seaberg 8y agoI should know what's forbidden without having to go consult every judge.
- pmoriarty 8y agoLetting smaller businesses off the hook here is not a good idea, since the larger businesses could just buy data off of the smaller ones, or both could belong to the same umbrella corporation and the data could be shared for nothing.
- tathougies 8y agoWhat incentive would such a small business have for operating. They would have to deliberately cap their revenue in order to maintain the business size and not run afoul of the regulation. The moment their revenue tips over, the profit maximizing behavior would be for facebook and google to use home-grown compliant solutions. Once they have a home-grown solution that complies with the law, they'd have no reason to ever again contract out the collection work.