28 ms·

Silicon Valley is terrified of California’s privacy law

566 points by ssklash 7y ago

jkp56 7y ago
This law is a step in the right direction, although in its current form it's toothless and uses disgustingly submissive language (e.g. the user may not out or the user needs to be informed about how theur data is going to be abused). The final goal of such laws should be to poison user data: so that collecting it and storing would open all sorts of legal and criminal troubles and that no company would want to touch user data with even 10 foot pole. This will open more ethical business opportunities that currently can't compete with data mining model. An analogy in real world. If theft and robberry was legal, no other business model could exist: if you sell gas for 3 bucks a gallon and your neighbor sells it for a negative price, but sells user address to theft agencies, you'd be out of business long before everybody realises the true cost of that "free" gas.
deleted 7y ago
[deleted]
rdlecler1 7y ago
So the author would rather see each state/country implement it’s own laws so that a small startup needs to ensure they comply with hundreds of regulatory jurisdictions... awesome.
- buildzr 7y ago
  I'm just going to ignore them all until my actual operating jurisdiction implements one, I'm not beholden to the laws of another country, let alone a specific state in it.
  - social_quotient 7y ago
    I’m not sure this is entirely true. Texas for example has some pretty big arms (long-arm statute) when conducting business in or with a resident or Texas business. Maybe helpful - http://euro.ecom.cmu.edu/program/law/08-732/Jurisdiction/LongArmSurvey.pdf http://euro.ecom.cmu.edu/program/law/08-732/Jurisdiction/Lon...
    - buildzr 7y ago
      I'm not even in their country, pretty sure I'm not going to get extradited for breaking the privacy laws of a jurisdiction in which I have no physical presence.
- badrequest 7y ago
  or, you could not start a business that requires you capture every single facet of a person's life as a data point.
  - LanceH 7y ago
    But you'll start a business which captures some data, and you're on the hook for proving that everything captured is necessary and compliant in hundreds of jurisdictions.
    - SomeOldThrow 7y ago
      You could start a different business instead.
- mitchdoogle 7y ago
  The gist of these laws are all the same. Just respect ALL users' data from the start, and you shouldn't have any difficulty with compliance.
  - clay_the_ripper 7y ago
    Totally disagree. Complicate is not the same thing as following the spirit of the rules. Compliance is proving you followed the rules. Totally different. Also, you have to define what you mean by “respecting privacy”. Something that I do on my website, like basic retargeting marketing for abandoned shopping carts doesn’t feel to me like an invasion of privacy. To you, it might. The rules have to be defined clearly.
    - mirimir 7y ago
      If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem. If you have a shopping cart, you must collect billing and shipping information. But you don't need to use it for any other purpose.
      - btilly 7y ago
        By your rule, companies should not engage in A/B testing to figure out how to make their sites easier to use. Because that involves tracking users for a purpose that is not actually essential to delivering content and services. Does this outcome make sense to you? (Disclaimer, I have worked in adtech a little bit, but I have worked a lot more with A/B testing.)
        mirimir 7y ago
        I suspect that A/B testing is doable without collecting user information. Except for the OS, of course. But certainly nothing that's not in server logs.
      - yuliyp 7y ago
        Do you have an error log on your web server? Does that only collect data that is essential or do you do something like log a referer or IP address or user id in hopes that it might be useful un debugging. Is there an access log? What happens if a user asks to delete their data. Do you go back and scrub all such logs? What about if you have a backend service that logs errors about what data it had problems accessing. Or an SQL server that logs bad queries? It's not so straight forward as you make it seem.
- katabatic 7y ago
  How is that different than, well -- anything? In the United States all 50 states can make their own laws; it's a fundamental part of our legal system. As for every country making their own laws - well, yeah? That's what sovereignty is all about?
  - javagram 7y ago
    In cases where the Feds have decided there should be a uniform standard, states can’t make their own law. https://en.m.wikipedia.org/wiki/Federal_preemption https://en.m.wikipedia.org/wiki/Federal_preemption
    - kelnos 7y ago
      I don't think that works quite like you think it does. The Federal government generally does not restrict states from making stronger laws than the equivalent Federal law. Take the Federal minimum wage, for instance: they set one level, but states are free to set a higher minimum wage. This case follows the same pattern: whatever meager privacy protections in place at the Federal level will continue to apply, but California law will take precedence in the case where it's stronger. There are certainly exceptions, like how currently Trump and the EPA are attempting to disallow CA's higher vehicle emissions standards, but, again: exceptions. (In this case, the relevant law has specific language that makes the EPA the final authority on this sort of thing, and requires states to get waivers for going their own way. That's not a general, common thing, though.) And I expect that bit to be tied up in court for a while.
      - trothamel 7y ago
        Actually, I think you're the one that's incorrect here. California can set a higher minimum wage because it's explicitly allowed to by 29 U.S. Code § 218. https://www.law.cornell.edu/uscode/text/29/218 https://www.law.cornell.edu/uscode/text/29/218 That's an exception that's written into the law, while federal preemption is the usual rule.
      - javagram 7y ago
- bpodgursky 7y ago
  Yeah... CCPA and GDPR have proved that large enterprises will do just fine, because Amazon can always afford enough lawyers to handle regulatory overhead and confusion across territories. The startups end up either (1) ignoring the laws or (2) giving up. Good job EU, if making the FAANGs the only companies with the clout to hold customer data or break into new markets was your primary goal.
  - TazeTSchnitzel 7y ago
    GDPR is not a difficult law to comply with for an EU company, unless you're adtech.
    - bsder 7y ago
      We've already had this discussion. We've already seen non-adtech companies simply shut down EU access if they don't have enough revenue. That's probably not a good thing. I support the GDPR, but complying with it is far from simple and the jurisprudence is not yet clear.
      - jjuhl 7y ago
        "We've already seen non-adtech companies simply shut down EU access if they don't have enough revenue. That's probably not a good thing." - Why not? I suspect we can live happily without them.
      - kelnos 7y ago
        > That's probably not a good thing. That's debatable. I imagine that many EU residents who are tired of having their data collected and sold by US companies consider this to be a very good thing. It also means that an EU-based company can come a long and fill the void left by the former incumbent that doesn't want to play ball, which is likely good for the EU's economy. Maybe it's not good for the US company, or for the US economy, but the EU (in theory) exists to further the interests of EU citizens. As a California resident, if the same happens with the CCPA, I will not shed a single tear.
- bcheung 7y ago
  Essentially, yes. And don't forget all the other ones from other countries as well.
- PopeDotNinja 7y ago
  And that's how privacy compliance as a service was born.
  - Sweetness 7y ago
    i hate this, but you're right. pointless regulations that lead to pointless jobs to oversee and sell compliance is such a net waste for society.
  - tchock23 7y ago
    Unfortunately, you’re correct. Post GDPR I’ve been pitched many times by EU companies trying to be my representative for GDPR, so if that is any indication we’ll see a booming industry for that in the US as well... Funny enough, the emails sent by these companies are not GDPR compliant and they’ve given me no indication as to how they gathered my info, nor do they give me an opt out.
- TazeTSchnitzel 7y ago
  No, a federal law that's as good as or better than CCPA would be great. But they know that's not what will happen.
- rdiddly 7y ago
  That's how it is with lots of things governed by laws though. Even murderers have to deal with a confusing patchwork of laws and penalties. "Do they have to prove premeditation in this state? Can the degree of the charge be changed at trial? Is there a death penalty?" It's getting so small-time murderers have to have a wall of law books just to do business!
- ryandrake 7y ago
  If your business is operating so close to the boundary of the law that you could be breaking it in some places but not others, then yea, you should be worried. If your business operates well above board and is not doing anything close to what might be the danger zone, then you should have nothing to worry about. It's always the folks walking right next to the cliff complaining about how complicated their path needs to be.
- munk-a 7y ago
  Each state can choose to be as restrictive as they like in their laws, and each startup can chose to invest in compliance on a wide scale or in the narrow scale as they'd like. It'd be nice if this was unified but it ain't because: 1. Tech companies lobby like hell at a national level 2. The national government is sort of broken right now so that's how the cookie crumbles. The fact that a number of companies have skirted local regulations and abused data usage so much is why this is happening, so don't blame the victims of this activity that want sane privacy laws - blame the bad actors that have forced this issue to need to be dealt with.
  - Kalium 7y ago
    > Each state can choose to be as restrictive as they like in their laws, and each startup can chose to invest in compliance on a wide scale or in the narrow scale as they'd like. There's a special hell that exists where one state mandates records must be held for at least seven years and another mandates deletion at five. When the two states border one another and you may not have home addresses, how do you determine how to comply for a given user? You're absolutely right, in every way, that tech companies have brought this regulatory backlash on themselves. Yet, it might still be worth considering the potential costs.
    - DaveFr 7y ago
      Is this a hypo or a real example?
      - Kalium 7y ago
        As far as I know it's a hypothetical, but it is very much the kind of thing that could happen. Regulations don't always align across political borders, which means there's the possibility there being no way to comply with both.
        behringer 7y ago
        This is what you call putting the cart before the horse.
- jjuhl 7y ago
  Just don't do stupid privacy violating shit and you'll be fine anywhere. Collect no information. Share no information. You are good - everywhere. And that really ought to be the default behaviour..
  - GreenJelloShot 7y ago
    That is what they said about GDPR...
    - jjuhl 7y ago
      And what is your problem complying with that if you collect no information nor share any information?
      - vonmoltke 7y ago
        The main issue is proving compliance. Any website could, in theory, be recording information that counts as "personal data" under GDPR and CCPA without the user realizing it. What happens if a user doesn't believe you when you say you don't store or share anything? How do you prove to a regulator that you actually don't?
  - fragmede 7y ago
    I'm not sure how ecommerce works without some information from the user, such as what they're trying to purchase, the quantity, a shipping address, and some form of payment, most likely a credit card.
    - morganherlocker 7y ago
      ... and if you plan to handle this type of highly sensitive data, you should be prepared to provide some basic levels of compliance, including appropriate auditing of sensitive data along with informed consent from users.
  - opportune 7y ago
    How are you supposed to do any business over the internet without collecting information?
- SomeOldThrow 7y ago
  You could also not track or store PII.
- nathanyz 7y ago
  "With great scale, comes great responsibility"
milesskorpen 7y ago
Does anyone know the real implications of the CCPA for things like Sift Science, Google's Recaptcha, and maybe even Cloudflare? All of these are based on many companies contributing information about users to create profiles which curb abuse. And Sift/Google/etc. get commercial benefit from this data sharing, which might trigger the CCPA. But you can't give bad actors the ability to opt out of this kind of data sharing without crippling them. I think these kind of companies are really important to a functioning internet. I hope there are carve outs of some sort, but seems like they're living on the edge right now.
- matty22 7y ago
  If Recaptcha gets the ax due to CCPA, the internet will be better off for it.
  - milesskorpen 7y ago
    There needs to be some way to identify non-humans and/or malicious actors.
    - 0xffff2 7y ago
      Malicious actors? Yes. Non-humans? No. If my bot is playing by the same rules a human would, what do you care as a website operator?
  - HALtheWise 7y ago
    Do you have a proposed alternative way of preventing spam? Neural networks basically mean that any traditional captcha too hard for a bot is also too hard for a human.
mehrdadn 7y ago
If the Environmental Protection Agency can hold a straight face while revoking California's ability to protect its own environment with higher standards, I'll hold off on getting excited about privacy laws until we see the FTC/FCC/etc.'s response.
tspike 7y ago
A significant part of the fear comes from how poorly worded it is.
- itronitron 7y ago
  all each company has to do is click 'accept'
  - quadrangle 7y ago
    BINGO!!! Hah!
- TazeTSchnitzel 7y ago
  Broad wording means companies have to be conservative (collect less data) and less loopholes. That's a win for the ordinary person.
  - tick_tock_tick 7y ago
    Or realistically it means they will collect the same and wait for clarification. Since it's worded so poorly they won't be punished for it or going by past examples in California the fine will be so small it was worth it.
    - TazeTSchnitzel 7y ago
      The US has a common law system. What is not specified in the statute will be slowly clarified by the courts.
  - summerlight 7y ago
    Broad wording usually has a higher risk of being ambiguous thus violating the vagueness doctrine. This is not a strictly better thing; all the efforts invested to the law can be easily invalidated by 9 justices due to the poor wording.
gojomo 7y ago
So many NYC-based journalists who love to spit all over "Silicon Valley". Is there room for a TechCrunch-like publication with a more Silicon Valley-influenced editorial bent? (There's already a massive surplus of sneering Brooklyn-based scolds in "tech media".)
- Barrin92 7y ago
  >Is there room for a TechCrunch-like publication with a more Silicon Valley-influenced editorial bent? are you actually asking for someone to purposefully preach to the quire? The function of journalism is to speak truth to power, you think facebook et al need any further help? I think they actually paid the telegraph for a series of agitprop articles, you might want to check those out.
  - corebit 7y ago
    "are you actually asking for someone to purposefully preach to the quire?" He's both rightfully pointing out that TechCrunch is preaching to one minority choir and asking for another publication to preach to a different choir. Ironically the publication he's asking for was TechCrunch before it was bought by AOL and ruined.
- 908087 7y ago
  If you want SV propaganda, try techdirt.com.
throawayuk55po 7y ago
We need to have a conversation about jurisdictions in the digital age. The way governments have decided that having a website accessible in a country makes you liable to respect the law of this country is a convulted and hacky notion that has been accepted way too fast. The physical establishment rule was the only sound approach. The fact that some countries started to lose shouldn't have allowed them to rewrite the rules (especially in such a hacky manner). Can you imagine owning a grocery store and having to ask every customer their nationality to check which law you must follow to do business with them? Then multiply this hell by 10 and soon 1000 considering new laws created left and right and you have the environment these dishonest politicians have created.
- deleted 7y ago
  [deleted]
- javagram 7y ago
  Just block your website from being accessed in any country where you aren’t sure you can comply with their laws. A lot of sites are doing that for GDPR.
  - dantheman 7y ago
    The country can choose the block the website. Why should you have to do it?
  - elondaits 7y ago
    The GDPR only applies to websites / companies that either have offices / legal status in a european country or that specifically target / sell to europeans (e.g. they place ads in Europe, ship merchandise to Europe, etc.). You don't need to block european countries if you have no business or interest there.
    - tzs 7y ago
      It also applies to sites not in the Union if their processing activities are related to "the monitoring of their behaviour as far as their behaviour takes place within the Union". (Article 3 section 2(b)). Unlike the target/sell case, this doesn't seem to require intent to specifically deal with Europeans. If you aren't sure that what you do doesn't count as monitoring behavior, then blocking can make sense.
codesushi42 7y ago
What will these laws accomplish in real terms? This just seems like poorly written legislation with the purpose of pandering to the populist public. I guess if it makes you all at least feel better.
- simplecomplex 7y ago
  Nothing, except soon there will be annoying legalese on every website form. Just like the GDPR. Large businesses will benefit at the expense of smaller ones. Lawyers will make more money selling these legalese templates, and sometimes when a big company doesn’t pay the right bean counter they’ll end up being investigated by regulators, and paying the state money to continue doing the same thing. But it will be celebrated as a heroic victory because “privacy good. Business bad. I want a banana.”
  - bengale 7y ago
    The GDPR does a lot to protect user data. As someone that’s implemented stuff at a huge company for GDPR and at my startup, it was waaaay harder at the larger company. The ICO has been beyond helpful with the few questions I’ve had recently and implementation for my startup has been fairly straightforward.
    - simplecomplex 7y ago
      “The GDPR does a lot to protect user data” As you proceed to state absolutely nothing. Before GDPR my information was in a bunch of databases managed by other people. After GDPR my information is in the same databases managed by the same people. Except now they have legalese stating this totally fucking obvious fact. Before GDPR if my information was hacked and used to hurt me, the business was not liable. After GDPR they still are not liable. Oh and if they violate the GDPR the state gets money, but the victims don’t. Such amazing protection of consumer data...
      - chobeat 7y ago
        Dude, GDPR's effects just began. Give it time. A sudden enforcement of GDPR would destroy too many business and so it's being enforced gradually. Still, there are beginning to discuss the complete outlaw of the real time bidding in adtech because completely incompatible with the GDPR. That means destroying bilions of dollars of businesses, so they go slow until there's enough political consensus to do so without fear of retaliative lobbying. This is not something that is done overnight.
morganherlocker 7y ago
Lot's of (mis)information floating around regarding CCPA. I recommend taking the time to read the actual text[1]. The text is not particularly long or dense. There has been a lot of speculation about complex compliance procedures, but the main thrust of the bill is to provide users with information about how their data is collected, who it is shared with, and the rights to prevent certain types of selling or sharing of said data. The leginfo site also includes non-partisan analysis (under the "Bill Analysis" tab) of the bill and amendments as it moves through the legislature, which is useful for getting an understanding of how specific issues are being considered and addressed. Something to consider is that bills change substantially through the amendment process, so often critiques you read are based off old versions of the text that have already been addressed. [1] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...
- SamReidHughes 7y ago
  > (4) Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law. Well, thanks for the link. For example, informing people that a user is located in a dormitory in The Netherlands sounds like free speech to me. So is location tracking information exempt from deletion?
  - morganherlocker 7y ago
    Location data is explicitly called out as sensitive personal information in the text of the bill, so it's definitely not exempt as a category of data. > (e) Many businesses collect personal information from California consumers. They may know where a consumer lives and how many children a consumer has, how fast a consumer drives, a consumer’s personality, sleep habits, biometric and health information, financial information, precise geolocation information, and social networks, to name a few categories. As to how this will interact with free speech - in this case, speech of the company - is a bit of an open question. One of the assumptions of the bill though is that selling telemetry data about a consumer is not a form of protected speech, and that adding some restrictions to this practice is reasonable.
nabnob 7y ago
I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privacy-bill-heads-to-governors-desk/ https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that data. - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service. - Businesses can, however, offer “financial incentives” for being allowed to collect data. - California authorities are empowered to fine companies for violations. I totally understand that this will impact a lot of tech companies' profits...but that's to be expected if you're making money selling people's data to third parties without their permission.
- hkai 7y ago
  If you favor an idea that a private company should be compelled to provide a service for free, even if you don't share your data, would you also agree to the idea that a private company should be compelled to respect freedom of speech on their platform even if they don't benefit from it?
- jakelazaroff 7y ago
  I am on board with this law, but I’m curious how these two points will shake out: > - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service. > - Businesses can, however, offer “financial incentives” for being allowed to collect data. Seems to me that it’s a distinction without a difference. Is there something I’m missing?
  - danaris 7y ago
    It sounds like this means it'll have to be clearly disclosed up front as a bonus, rather than being charged after the fact as a penalty and hidden somewhere in the ToS.
  - danharaj 7y ago
mychael 7y ago
Is this an opinion article or a legit journalism? The article clearly has a slant, but TechCrunch didn't classify it as Opinion.
Despegar 7y ago
While I think CCPA is a step in the right direction from the status quo, which is basically a free-for-all, it's still a mediocre privacy law. GDPR remains the gold standard because it's opt-in, CCPA is opt-out. The only reason it was even passed was because some guy was going to force the issue with a ballot initiative so lawmakers scrambled to do something. If not for that, California would be the last state to pass meaningful privacy regulation.
yalogin 7y ago
It’s jarring to see such headlines on TechCrunch. They fed the valley by giving every little news a place and are ne of the original hype masters for startups. They profit off the area by hosting the disrupt conference as well, which is again a huge pat each other on the back event. So now they turn around and post a headline like that is just somehow ugly to me. It’s absolutely in their right obviously.
- degenerate 7y ago
  Pet peeve: when editors/authors throw their opinions on the end of headlines. [and why it's a good thing / and why you should care / and why it's dangerous / etc] Just give me the facts and let me decide on my own after reading the facts. I don't need your opinion up front.
- buboard 7y ago
  Journalists think that bashing big tech because they are rich gives them views. I doubt there is evidence for that but journobloggers tend to be very herdish.
noodlesUK 7y ago
People keep comparing this to the GDPR. I have lived in the UK pre and post GDPR and the US. I like the GDPR a lot. It isn’t just internet businesses either. Because it was such a crazy bogeyman, plenty of brick and mortar businesses have paid a bit more attention to their data security. I like being told what’s gonna happen with my PII, and having the right to control my data. Most people seem to like the effects of the GDPR in my (anecdotal) experience. Yeah you have people using it as some bizarre bogeyman to stop you doing normal things, but it makes you think about it. From a business perspective, the ICO provides great advice to people and companies when they need it. It’s not as though what you need to do is a secret. You just need to do business in accordance with peoples’ rights.
ptest1 7y ago
Besides the tremendous onus laws like this may place on small startups and side projects: Does anyone know how companies are supposed to comply if “user data” literally cannot be deleted? I’m thinking in the case of blockchain type applications, where one users’ actions feed into another users’ actions, and you can’t deleted user A’s actions without deleting potentially tons of other stuff and destroying the application. Like does this law basically ban GitHub and code collaboration too?
- dsfyu404ed 7y ago
  >Besides the onus laws like this may place on small startups and side projects: Startups and side projects are a non-issue. They can just comply from the get go. It's the too small to afford compliance but too big to easily change their business model that are going to be hurt by this. However, that brings up the question as to whether those business models should be able to exist profitably in the first place.
  - ptest1 7y ago
    What I’m saying is that there is more work for startups / side projects to do, not that it’s impossible. It raises the barrier.
- chobeat 7y ago
  For the 1) you just don't commit data in the blockchain itself. You can commit an ID that points to external data and drop these external data if requested. This clearly looks like an anti-pattern but putting personal data in an immutable data structure is an anti-pattern too, since those data don't belong to you. What if a bank put the gold of their customers in a concrete pillar instead of a vault? Fuck the back, I guess. I don't see why not.
  - ptest1 7y ago
    Again, the GitHub example is a good one. I have some commits in Django core from years ago. What if I “request” my data be deleted from GitHub? What are they supposed to do? If they rewrite the history it will destroy the project; and if anyone can rewrite the history in the future it leaves projects open to hostile actions. I suppose the argument would have to be made that it’s not personal data; it’s an act of public publishing or something. So in this case it’s akin to me publishing a blog and other people quoting it years later. I can delete the original blog but not the reprints in newspapers or quotes. Or that it stops becoming “your” data and becomes instead “the other user’s” once eg the Django project accepts the PR. So you can delete user A’s PR but not the Django project’s now-integrated copy. I think this rationale makes the most sense. After all, someone could still have the repository on their computer and push it back to GitHub again. I realize this is an edge case that doesn’t apply to 99.9999% of companies, but as an engineer I find it interesting! Edit: after thinking this through more, I suspect that e.g. GitHub could argue they comply as long as they delete User A’s repo. Subsequently integrated PRs, etc wouldn’t have to be deleted because they could argue they’re no longer User A’s. I kinda feel like if language to allow this was added to the law explicitly it would be open to abuse, so I suppose this kind of thing has to remain vague and open to interpretation in e.g. the courts if someone is being nasty.
calithrowaway 7y ago
How is this not a violation to the first amendment? Does the first amendment not extend as follows: (?) As a citizen don't I have the right to create a business and privately take notes on whatever I'd like to about my customers? If i run a dry cleaners and take notes about my customers, should I be obligated to disclose these notes or even the existence of these notes to my customers? I don't see why extending the dry cleaning business to a mobile app or website effects anything. What about journalists, are they required to disclose what data they're collecting about people as they do their job? I feel like the state constitution granted right to privacy does not supersede the federally mandated right to freedom of speech both the right to take internal notes and documentation and the violation of one's speech rights by forcing this disclosure. however IANAL and I don't live in California. Could someone share some insights onto the first amendment side of this?
- mdavidn 7y ago
  IANAL, but I think a human needs to be involved in the individuals' processing as a prerequisite to "speech." An automated process has no Constitutional rights.
  - zbentley 7y ago
    > An automated process has no Constitutional rights. Yet.
- krapp 7y ago
  >I feel like the state constitution granted right to privacy does not supersede the federally mandated right to freedom of speech Gonna have to stop you there. The First Amendment doesn't mandate a right to free speech. It only prevents Congress from passing laws abridging that right. There's nothing, Constitutionally speaking, preventing states from doing so. Edit: nope, Apparently I'm wrong on this one.
  - mdavidn 7y ago
    That's not the case. The Bill of Rights now does largely apply to the states. https://en.wikipedia.org/wiki/Incorporation_of_the_Bill_of_Rights https://en.wikipedia.org/wiki/Incorporation_of_the_Bill_of_R...
Havoc 7y ago
The whole system is rotten to the core. Allowing companies to portray themselves in a positive light on privacy > “The time to act is now,” While pushing a federal law geared towards undermining privacy rights? Doublespeak anyone?
buboard 7y ago
This: > The bill would authorize businesses to offer financial incentives for collection of personal information. Means it's nothing like the GDPR. This might actually be a sane law. And it doesnt implement punitive fines if you get hacked. Nor does it bring about a massive cookie alert insanity. The right to delete may work in europe , but i think in the US it is going to clash with free speech laws. So it might not work at all.
aazaa 7y ago
> Since the law passed, tech giants have pulled out their last card: pushing for an overarching federal bill. >In doing so, the companies would be able to control their messaging through their extensive lobbying efforts, allowing them to push for a weaker statute that would nullify some of the provisions in California’s new privacy law. In doing so, companies wouldn’t have to spend a ton on more resources to ensure their compliance with a variety of statutes in multiple states. Is it really that much easier to control a federal vs. state legislator? I wonder if the idea might actually be to prevent the likely future scenario in which 50+ different privacy regulations need compliance. Setting a national standard could prevent such an outcome. Privacy advocates should favor the state-by-state solution, though. The more difficult it is to comply with regulations, the more expensive it becomes to collect the data in the first place. As the cost of compliance increases, the alternative of simply not collecting the data in the first place becomes more attractive. But that itself can lead to unintended consequences. It would mean that only the biggest companies could afford the regulatory burden of collecting the data. And these are the very companies that have received the most negative attention. All of which makes me wonder whether at some point we could see a private data settlement along the lines of the tobacco settlement: https://en.wikipedia.org/wiki/Tobacco_Master_Settlement_Agreement https://en.wikipedia.org/wiki/Tobacco_Master_Settlement_Agre...
Nasrudith 7y ago
I can't help but view it with disgust just at the headline of having the wrong kind of mentality. It is a spiteful logical fallacy of the worst kind. "Soviets terrified of plan to nuclear first strike whole world - good!" Just because even the vilest foe dislikes it doesn't mean it is a good idea. The whole article seems to be about shutting down thinking and manipulation via playing with emotions. I am probably an outlier but I view that as an active sign that is terrible because otherwise they would lead on better points. The article made me /less/ supportive of it. It is perhaps unduly harsh but I would call it an outright propaganda piece not because of the message but how it was delivered.
- notTyler 7y ago
  "Shutting down thinking." Reporting on transgressions and laws designed to hold parties accountable is designed to shut down thinking now, and how those who would be affected by it are literally trying to kill the bill is considered "shutting down thinking." This is literally what you just said.
  - Nasrudith 7y ago
    You proved my point ironically. It is all about "punishing the bad ones for their past sins" as opposed to going forward the impact of the law - the part to actually think about. Instead straight to emotionally knee jerk driven narratives of "they are bad and must be punished" instead of what the law is actually about. See emotions come out and the thinking on the topic like "would it actually help with Cambridge Analytica 2.0" go kaput. It is an old trick narrative for pushing terrible "tough on crime" laws for advancement. If you point out that it isn't a well thought out idea you support bad people!
atoav 7y ago
In short: laws against things that never sbould have been. One can only hope they make sure it hits big actors more than any other ones, because they are what makes this kind of data collection dangerous for societies.
gojomo 7y ago
Anyone remember when TechCrunch actually took the side of "Silicon Valley"?
dillondoyle 7y ago
I'm pretty concerned about it, and we are a tiny political digital agency. My reading is that basically any small sized email list, website, service etc that 'receives for the business’ commercial purposes' data on more than 50k 'devices' or 'consumers' must be compliant which is a very low bar. Like small business email lists would hit this, though maybe burden falls onto Mailchimp for most. It should be fairly easy to add a contact us address for delete and info requests to the bottom of websites. A lot harder and would take development time to automate a UI for a person to see all data associated automatically (e.g. lots of separate analytics; would have to build api to lookup ip/device/user data match across tables/dbs, and then how do I verify a user is requesting their data and not someone else's). Also harder to 'block' new data collection of device/consumer post delete request. What I'm less sure about is 'inform consumers before the point of collection.' Does a privacy policy link in footer count? If not what is required for compliance? What about advertising? Another big concern for me is that this is going to be weaponized in my industry (politics). I think a political campaign wont fit the bill's definition of 'business' (profit seeking for shareholders) but I think it will still be weaponized by opposition campaigns and service providers.
- Sephr 7y ago
  Sounds like you need a Data Privacy Infrastructure provider so you don't have to worry about the implementation details. The startup I'm working at, https://transcend.io https://transcend.io, offers that.
EGreg 7y ago
Can someone who has actually READ this law summarize the main provisions from it?
rpastuszak 7y ago
As much as most browsers have implemented a standardised payment API, a generic, browser-level Privacy related GUI would be helpful. By that I mean something less repetitive than the multitude of consent screens people have to deal with (not to mention dark UX patterns in the existing solutions).
- ptest1 7y ago
  Yes, please!!
calimac 7y ago
I love it! The big tech SJW Comifornian citizens finally are getting a taste of the effects of their burdensome heavy handed California legislature. Good riddens. They pushed their data analytics tech to the edge and it finally blew up with legislation.
calimac 7y ago
this is a result of data analytics pushing the bleeding edge and passing what is decent and allowing their tech to enter the invasive and creepy realm.
nicky19890202 7y ago
I think everyone's data must belong to their own.
systematical 7y ago
I wish I lived in California. I'd be requesting the deletion of my data ALL OVER the internet.
Aperocky 7y ago
LMAO, Google should just make itself unavailable in California due to 'involuntary violation' of this law to see it repealed real quick. Those who complain can use bing.
nickpp 7y ago
Well, the EU managed to destroy the websites' User Experience with their brain-dead GDPR - why should California be left behind?!
xhruso00 7y ago
Instead of complying with the law they are wasting time lobbying. If they don't comply on 1st of JAN what excuse are they going to have?
classified 7y ago
Project Gutenberg currently blocks users from Europe to avoid having to comply with GDPR. Logically the next step would be to block users from California as well.
tempodox 7y ago
Many comments here make the false dichotomy of paying for a service with money vs paying with your data. That ship has sailed. In the current market selling user data will win every time. Only laws can make sure that a company you pay for “premium service” or “no ads” won't turn around and sell your data anyway.

566 points by ssklash 7y ago

This law is a step in the right direction, although in its current form it's toothless and uses disgustingly submissive language (e.g. the user may not out or the user needs to be informed about how theur data is going to be abused). The final goal of such laws should be to poison user data: so that collecting it and storing would open all sorts of legal and criminal troubles and that no company would want to touch user data with even 10 foot pole. This will open more ethical business opportunities that currently can't compete with data mining model. An analogy in real world. If theft and robberry was legal, no other business model could exist: if you sell gas for 3 bucks a gallon and your neighbor sells it for a negative price, but sells user address to theft agencies, you'd be out of business long before everybody realises the true cost of that "free" gas.

deleted 7y ago

[deleted]

rdlecler1 7y ago

So the author would rather see each state/country implement it’s own laws so that a small startup needs to ensure they comply with hundreds of regulatory jurisdictions... awesome.

buildzr 7y ago
I'm just going to ignore them all until my actual operating jurisdiction implements one, I'm not beholden to the laws of another country, let alone a specific state in it.
- social_quotient 7y ago
  I’m not sure this is entirely true. Texas for example has some pretty big arms (long-arm statute) when conducting business in or with a resident or Texas business. Maybe helpful - http://euro.ecom.cmu.edu/program/law/08-732/Jurisdiction/LongArmSurvey.pdf http://euro.ecom.cmu.edu/program/law/08-732/Jurisdiction/Lon...
  - buildzr 7y ago
    I'm not even in their country, pretty sure I'm not going to get extradited for breaking the privacy laws of a jurisdiction in which I have no physical presence.
badrequest 7y ago
or, you could not start a business that requires you capture every single facet of a person's life as a data point.
- LanceH 7y ago
  But you'll start a business which captures some data, and you're on the hook for proving that everything captured is necessary and compliant in hundreds of jurisdictions.
  - SomeOldThrow 7y ago
    You could start a different business instead.
mitchdoogle 7y ago
The gist of these laws are all the same. Just respect ALL users' data from the start, and you shouldn't have any difficulty with compliance.
- clay_the_ripper 7y ago
  Totally disagree. Complicate is not the same thing as following the spirit of the rules. Compliance is proving you followed the rules. Totally different. Also, you have to define what you mean by “respecting privacy”. Something that I do on my website, like basic retargeting marketing for abandoned shopping carts doesn’t feel to me like an invasion of privacy. To you, it might. The rules have to be defined clearly.
  - mirimir 7y ago
    If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem. If you have a shopping cart, you must collect billing and shipping information. But you don't need to use it for any other purpose.
    - btilly 7y ago
      By your rule, companies should not engage in A/B testing to figure out how to make their sites easier to use. Because that involves tracking users for a purpose that is not actually essential to delivering content and services. Does this outcome make sense to you? (Disclaimer, I have worked in adtech a little bit, but I have worked a lot more with A/B testing.)
      - mirimir 7y ago
        I suspect that A/B testing is doable without collecting user information. Except for the OS, of course. But certainly nothing that's not in server logs.
    - yuliyp 7y ago
      Do you have an error log on your web server? Does that only collect data that is essential or do you do something like log a referer or IP address or user id in hopes that it might be useful un debugging. Is there an access log? What happens if a user asks to delete their data. Do you go back and scrub all such logs? What about if you have a backend service that logs errors about what data it had problems accessing. Or an SQL server that logs bad queries? It's not so straight forward as you make it seem.
katabatic 7y ago
How is that different than, well -- anything? In the United States all 50 states can make their own laws; it's a fundamental part of our legal system. As for every country making their own laws - well, yeah? That's what sovereignty is all about?
- javagram 7y ago
  In cases where the Feds have decided there should be a uniform standard, states can’t make their own law. https://en.m.wikipedia.org/wiki/Federal_preemption https://en.m.wikipedia.org/wiki/Federal_preemption
  - kelnos 7y ago
    I don't think that works quite like you think it does. The Federal government generally does not restrict states from making stronger laws than the equivalent Federal law. Take the Federal minimum wage, for instance: they set one level, but states are free to set a higher minimum wage. This case follows the same pattern: whatever meager privacy protections in place at the Federal level will continue to apply, but California law will take precedence in the case where it's stronger. There are certainly exceptions, like how currently Trump and the EPA are attempting to disallow CA's higher vehicle emissions standards, but, again: exceptions. (In this case, the relevant law has specific language that makes the EPA the final authority on this sort of thing, and requires states to get waivers for going their own way. That's not a general, common thing, though.) And I expect that bit to be tied up in court for a while.
    - trothamel 7y ago
      Actually, I think you're the one that's incorrect here. California can set a higher minimum wage because it's explicitly allowed to by 29 U.S. Code § 218. https://www.law.cornell.edu/uscode/text/29/218 https://www.law.cornell.edu/uscode/text/29/218 That's an exception that's written into the law, while federal preemption is the usual rule.
    - javagram 7y ago
bpodgursky 7y ago
Yeah... CCPA and GDPR have proved that large enterprises will do just fine, because Amazon can always afford enough lawyers to handle regulatory overhead and confusion across territories. The startups end up either (1) ignoring the laws or (2) giving up. Good job EU, if making the FAANGs the only companies with the clout to hold customer data or break into new markets was your primary goal.
- TazeTSchnitzel 7y ago
  GDPR is not a difficult law to comply with for an EU company, unless you're adtech.
  - bsder 7y ago
    We've already had this discussion. We've already seen non-adtech companies simply shut down EU access if they don't have enough revenue. That's probably not a good thing. I support the GDPR, but complying with it is far from simple and the jurisprudence is not yet clear.
    - jjuhl 7y ago
      "We've already seen non-adtech companies simply shut down EU access if they don't have enough revenue. That's probably not a good thing." - Why not? I suspect we can live happily without them.
    - kelnos 7y ago
      > That's probably not a good thing. That's debatable. I imagine that many EU residents who are tired of having their data collected and sold by US companies consider this to be a very good thing. It also means that an EU-based company can come a long and fill the void left by the former incumbent that doesn't want to play ball, which is likely good for the EU's economy. Maybe it's not good for the US company, or for the US economy, but the EU (in theory) exists to further the interests of EU citizens. As a California resident, if the same happens with the CCPA, I will not shed a single tear.
bcheung 7y ago
Essentially, yes. And don't forget all the other ones from other countries as well.
PopeDotNinja 7y ago
And that's how privacy compliance as a service was born.
- Sweetness 7y ago
  i hate this, but you're right. pointless regulations that lead to pointless jobs to oversee and sell compliance is such a net waste for society.
- tchock23 7y ago
  Unfortunately, you’re correct. Post GDPR I’ve been pitched many times by EU companies trying to be my representative for GDPR, so if that is any indication we’ll see a booming industry for that in the US as well... Funny enough, the emails sent by these companies are not GDPR compliant and they’ve given me no indication as to how they gathered my info, nor do they give me an opt out.
TazeTSchnitzel 7y ago
No, a federal law that's as good as or better than CCPA would be great. But they know that's not what will happen.
rdiddly 7y ago
That's how it is with lots of things governed by laws though. Even murderers have to deal with a confusing patchwork of laws and penalties. "Do they have to prove premeditation in this state? Can the degree of the charge be changed at trial? Is there a death penalty?" It's getting so small-time murderers have to have a wall of law books just to do business!
ryandrake 7y ago
If your business is operating so close to the boundary of the law that you could be breaking it in some places but not others, then yea, you should be worried. If your business operates well above board and is not doing anything close to what might be the danger zone, then you should have nothing to worry about. It's always the folks walking right next to the cliff complaining about how complicated their path needs to be.
munk-a 7y ago
Each state can choose to be as restrictive as they like in their laws, and each startup can chose to invest in compliance on a wide scale or in the narrow scale as they'd like. It'd be nice if this was unified but it ain't because: 1. Tech companies lobby like hell at a national level 2. The national government is sort of broken right now so that's how the cookie crumbles. The fact that a number of companies have skirted local regulations and abused data usage so much is why this is happening, so don't blame the victims of this activity that want sane privacy laws - blame the bad actors that have forced this issue to need to be dealt with.
- Kalium 7y ago
  > Each state can choose to be as restrictive as they like in their laws, and each startup can chose to invest in compliance on a wide scale or in the narrow scale as they'd like. There's a special hell that exists where one state mandates records must be held for at least seven years and another mandates deletion at five. When the two states border one another and you may not have home addresses, how do you determine how to comply for a given user? You're absolutely right, in every way, that tech companies have brought this regulatory backlash on themselves. Yet, it might still be worth considering the potential costs.
  - DaveFr 7y ago
    Is this a hypo or a real example?
    - Kalium 7y ago
      As far as I know it's a hypothetical, but it is very much the kind of thing that could happen. Regulations don't always align across political borders, which means there's the possibility there being no way to comply with both.
      - behringer 7y ago
        This is what you call putting the cart before the horse.
jjuhl 7y ago
Just don't do stupid privacy violating shit and you'll be fine anywhere. Collect no information. Share no information. You are good - everywhere. And that really ought to be the default behaviour..
- GreenJelloShot 7y ago
  That is what they said about GDPR...
  - jjuhl 7y ago
    And what is your problem complying with that if you collect no information nor share any information?
    - vonmoltke 7y ago
      The main issue is proving compliance. Any website could, in theory, be recording information that counts as "personal data" under GDPR and CCPA without the user realizing it. What happens if a user doesn't believe you when you say you don't store or share anything? How do you prove to a regulator that you actually don't?
- fragmede 7y ago
  I'm not sure how ecommerce works without some information from the user, such as what they're trying to purchase, the quantity, a shipping address, and some form of payment, most likely a credit card.
  - morganherlocker 7y ago
    ... and if you plan to handle this type of highly sensitive data, you should be prepared to provide some basic levels of compliance, including appropriate auditing of sensitive data along with informed consent from users.
- opportune 7y ago
  How are you supposed to do any business over the internet without collecting information?
SomeOldThrow 7y ago
You could also not track or store PII.
nathanyz 7y ago
"With great scale, comes great responsibility"

milesskorpen 7y ago

Does anyone know the real implications of the CCPA for things like Sift Science, Google's Recaptcha, and maybe even Cloudflare? All of these are based on many companies contributing information about users to create profiles which curb abuse. And Sift/Google/etc. get commercial benefit from this data sharing, which might trigger the CCPA. But you can't give bad actors the ability to opt out of this kind of data sharing without crippling them. I think these kind of companies are really important to a functioning internet. I hope there are carve outs of some sort, but seems like they're living on the edge right now.

matty22 7y ago
If Recaptcha gets the ax due to CCPA, the internet will be better off for it.
- milesskorpen 7y ago
  There needs to be some way to identify non-humans and/or malicious actors.
  - 0xffff2 7y ago
    Malicious actors? Yes. Non-humans? No. If my bot is playing by the same rules a human would, what do you care as a website operator?
- HALtheWise 7y ago
  Do you have a proposed alternative way of preventing spam? Neural networks basically mean that any traditional captcha too hard for a bot is also too hard for a human.

mehrdadn 7y ago

If the Environmental Protection Agency can hold a straight face while revoking California's ability to protect its own environment with higher standards, I'll hold off on getting excited about privacy laws until we see the FTC/FCC/etc.'s response.

tspike 7y ago

A significant part of the fear comes from how poorly worded it is.

itronitron 7y ago
all each company has to do is click 'accept'
- quadrangle 7y ago
  BINGO!!! Hah!
TazeTSchnitzel 7y ago
Broad wording means companies have to be conservative (collect less data) and less loopholes. That's a win for the ordinary person.
- tick_tock_tick 7y ago
  Or realistically it means they will collect the same and wait for clarification. Since it's worded so poorly they won't be punished for it or going by past examples in California the fine will be so small it was worth it.
  - TazeTSchnitzel 7y ago
    The US has a common law system. What is not specified in the statute will be slowly clarified by the courts.
- summerlight 7y ago
  Broad wording usually has a higher risk of being ambiguous thus violating the vagueness doctrine. This is not a strictly better thing; all the efforts invested to the law can be easily invalidated by 9 justices due to the poor wording.

gojomo 7y ago

So many NYC-based journalists who love to spit all over "Silicon Valley". Is there room for a TechCrunch-like publication with a more Silicon Valley-influenced editorial bent? (There's already a massive surplus of sneering Brooklyn-based scolds in "tech media".)

Barrin92 7y ago
>Is there room for a TechCrunch-like publication with a more Silicon Valley-influenced editorial bent? are you actually asking for someone to purposefully preach to the quire? The function of journalism is to speak truth to power, you think facebook et al need any further help? I think they actually paid the telegraph for a series of agitprop articles, you might want to check those out.
- corebit 7y ago
  "are you actually asking for someone to purposefully preach to the quire?" He's both rightfully pointing out that TechCrunch is preaching to one minority choir and asking for another publication to preach to a different choir. Ironically the publication he's asking for was TechCrunch before it was bought by AOL and ruined.
908087 7y ago
If you want SV propaganda, try techdirt.com.

throawayuk55po 7y ago

We need to have a conversation about jurisdictions in the digital age. The way governments have decided that having a website accessible in a country makes you liable to respect the law of this country is a convulted and hacky notion that has been accepted way too fast. The physical establishment rule was the only sound approach. The fact that some countries started to lose shouldn't have allowed them to rewrite the rules (especially in such a hacky manner). Can you imagine owning a grocery store and having to ask every customer their nationality to check which law you must follow to do business with them? Then multiply this hell by 10 and soon 1000 considering new laws created left and right and you have the environment these dishonest politicians have created.

deleted 7y ago
[deleted]
javagram 7y ago
Just block your website from being accessed in any country where you aren’t sure you can comply with their laws. A lot of sites are doing that for GDPR.
- dantheman 7y ago
  The country can choose the block the website. Why should you have to do it?
- elondaits 7y ago
  The GDPR only applies to websites / companies that either have offices / legal status in a european country or that specifically target / sell to europeans (e.g. they place ads in Europe, ship merchandise to Europe, etc.). You don't need to block european countries if you have no business or interest there.
  - tzs 7y ago
    It also applies to sites not in the Union if their processing activities are related to "the monitoring of their behaviour as far as their behaviour takes place within the Union". (Article 3 section 2(b)). Unlike the target/sell case, this doesn't seem to require intent to specifically deal with Europeans. If you aren't sure that what you do doesn't count as monitoring behavior, then blocking can make sense.

codesushi42 7y ago

What will these laws accomplish in real terms? This just seems like poorly written legislation with the purpose of pandering to the populist public. I guess if it makes you all at least feel better.

simplecomplex 7y ago
Nothing, except soon there will be annoying legalese on every website form. Just like the GDPR. Large businesses will benefit at the expense of smaller ones. Lawyers will make more money selling these legalese templates, and sometimes when a big company doesn’t pay the right bean counter they’ll end up being investigated by regulators, and paying the state money to continue doing the same thing. But it will be celebrated as a heroic victory because “privacy good. Business bad. I want a banana.”
- bengale 7y ago
  The GDPR does a lot to protect user data. As someone that’s implemented stuff at a huge company for GDPR and at my startup, it was waaaay harder at the larger company. The ICO has been beyond helpful with the few questions I’ve had recently and implementation for my startup has been fairly straightforward.
  - simplecomplex 7y ago
    “The GDPR does a lot to protect user data” As you proceed to state absolutely nothing. Before GDPR my information was in a bunch of databases managed by other people. After GDPR my information is in the same databases managed by the same people. Except now they have legalese stating this totally fucking obvious fact. Before GDPR if my information was hacked and used to hurt me, the business was not liable. After GDPR they still are not liable. Oh and if they violate the GDPR the state gets money, but the victims don’t. Such amazing protection of consumer data...
    - chobeat 7y ago
      Dude, GDPR's effects just began. Give it time. A sudden enforcement of GDPR would destroy too many business and so it's being enforced gradually. Still, there are beginning to discuss the complete outlaw of the real time bidding in adtech because completely incompatible with the GDPR. That means destroying bilions of dollars of businesses, so they go slow until there's enough political consensus to do so without fear of retaliative lobbying. This is not something that is done overnight.

morganherlocker 7y ago

Lot's of (mis)information floating around regarding CCPA. I recommend taking the time to read the actual text[1]. The text is not particularly long or dense. There has been a lot of speculation about complex compliance procedures, but the main thrust of the bill is to provide users with information about how their data is collected, who it is shared with, and the rights to prevent certain types of selling or sharing of said data. The leginfo site also includes non-partisan analysis (under the "Bill Analysis" tab) of the bill and amendments as it moves through the legislature, which is useful for getting an understanding of how specific issues are being considered and addressed. Something to consider is that bills change substantially through the amendment process, so often critiques you read are based off old versions of the text that have already been addressed. [1] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

SamReidHughes 7y ago
> (4) Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law. Well, thanks for the link. For example, informing people that a user is located in a dormitory in The Netherlands sounds like free speech to me. So is location tracking information exempt from deletion?
- morganherlocker 7y ago
  Location data is explicitly called out as sensitive personal information in the text of the bill, so it's definitely not exempt as a category of data. > (e) Many businesses collect personal information from California consumers. They may know where a consumer lives and how many children a consumer has, how fast a consumer drives, a consumer’s personality, sleep habits, biometric and health information, financial information, precise geolocation information, and social networks, to name a few categories. As to how this will interact with free speech - in this case, speech of the company - is a bit of an open question. One of the assumptions of the bill though is that selling telemetry data about a consumer is not a form of protected speech, and that adding some restrictions to this practice is reasonable.

nabnob 7y ago

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privacy-bill-heads-to-governors-desk/ https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that data. - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service. - Businesses can, however, offer “financial incentives” for being allowed to collect data. - California authorities are empowered to fine companies for violations. I totally understand that this will impact a lot of tech companies' profits...but that's to be expected if you're making money selling people's data to third parties without their permission.

hkai 7y ago
If you favor an idea that a private company should be compelled to provide a service for free, even if you don't share your data, would you also agree to the idea that a private company should be compelled to respect freedom of speech on their platform even if they don't benefit from it?
jakelazaroff 7y ago
I am on board with this law, but I’m curious how these two points will shake out: > - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service. > - Businesses can, however, offer “financial incentives” for being allowed to collect data. Seems to me that it’s a distinction without a difference. Is there something I’m missing?
- danaris 7y ago
  It sounds like this means it'll have to be clearly disclosed up front as a bonus, rather than being charged after the fact as a penalty and hidden somewhere in the ToS.
- danharaj 7y ago

mychael 7y ago

Is this an opinion article or a legit journalism? The article clearly has a slant, but TechCrunch didn't classify it as Opinion.

Despegar 7y ago

While I think CCPA is a step in the right direction from the status quo, which is basically a free-for-all, it's still a mediocre privacy law. GDPR remains the gold standard because it's opt-in, CCPA is opt-out. The only reason it was even passed was because some guy was going to force the issue with a ballot initiative so lawmakers scrambled to do something. If not for that, California would be the last state to pass meaningful privacy regulation.

yalogin 7y ago

It’s jarring to see such headlines on TechCrunch. They fed the valley by giving every little news a place and are ne of the original hype masters for startups. They profit off the area by hosting the disrupt conference as well, which is again a huge pat each other on the back event. So now they turn around and post a headline like that is just somehow ugly to me. It’s absolutely in their right obviously.

degenerate 7y ago
Pet peeve: when editors/authors throw their opinions on the end of headlines. [and why it's a good thing / and why you should care / and why it's dangerous / etc] Just give me the facts and let me decide on my own after reading the facts. I don't need your opinion up front.
buboard 7y ago
Journalists think that bashing big tech because they are rich gives them views. I doubt there is evidence for that but journobloggers tend to be very herdish.

noodlesUK 7y ago

People keep comparing this to the GDPR. I have lived in the UK pre and post GDPR and the US. I like the GDPR a lot. It isn’t just internet businesses either. Because it was such a crazy bogeyman, plenty of brick and mortar businesses have paid a bit more attention to their data security. I like being told what’s gonna happen with my PII, and having the right to control my data. Most people seem to like the effects of the GDPR in my (anecdotal) experience. Yeah you have people using it as some bizarre bogeyman to stop you doing normal things, but it makes you think about it. From a business perspective, the ICO provides great advice to people and companies when they need it. It’s not as though what you need to do is a secret. You just need to do business in accordance with peoples’ rights.

ptest1 7y ago

Besides the tremendous onus laws like this may place on small startups and side projects: Does anyone know how companies are supposed to comply if “user data” literally cannot be deleted? I’m thinking in the case of blockchain type applications, where one users’ actions feed into another users’ actions, and you can’t deleted user A’s actions without deleting potentially tons of other stuff and destroying the application. Like does this law basically ban GitHub and code collaboration too?

dsfyu404ed 7y ago
>Besides the onus laws like this may place on small startups and side projects: Startups and side projects are a non-issue. They can just comply from the get go. It's the too small to afford compliance but too big to easily change their business model that are going to be hurt by this. However, that brings up the question as to whether those business models should be able to exist profitably in the first place.
- ptest1 7y ago
  What I’m saying is that there is more work for startups / side projects to do, not that it’s impossible. It raises the barrier.
chobeat 7y ago
For the 1) you just don't commit data in the blockchain itself. You can commit an ID that points to external data and drop these external data if requested. This clearly looks like an anti-pattern but putting personal data in an immutable data structure is an anti-pattern too, since those data don't belong to you. What if a bank put the gold of their customers in a concrete pillar instead of a vault? Fuck the back, I guess. I don't see why not.
- ptest1 7y ago
  Again, the GitHub example is a good one. I have some commits in Django core from years ago. What if I “request” my data be deleted from GitHub? What are they supposed to do? If they rewrite the history it will destroy the project; and if anyone can rewrite the history in the future it leaves projects open to hostile actions. I suppose the argument would have to be made that it’s not personal data; it’s an act of public publishing or something. So in this case it’s akin to me publishing a blog and other people quoting it years later. I can delete the original blog but not the reprints in newspapers or quotes. Or that it stops becoming “your” data and becomes instead “the other user’s” once eg the Django project accepts the PR. So you can delete user A’s PR but not the Django project’s now-integrated copy. I think this rationale makes the most sense. After all, someone could still have the repository on their computer and push it back to GitHub again. I realize this is an edge case that doesn’t apply to 99.9999% of companies, but as an engineer I find it interesting! Edit: after thinking this through more, I suspect that e.g. GitHub could argue they comply as long as they delete User A’s repo. Subsequently integrated PRs, etc wouldn’t have to be deleted because they could argue they’re no longer User A’s. I kinda feel like if language to allow this was added to the law explicitly it would be open to abuse, so I suppose this kind of thing has to remain vague and open to interpretation in e.g. the courts if someone is being nasty.

calithrowaway 7y ago

How is this not a violation to the first amendment? Does the first amendment not extend as follows: (?) As a citizen don't I have the right to create a business and privately take notes on whatever I'd like to about my customers? If i run a dry cleaners and take notes about my customers, should I be obligated to disclose these notes or even the existence of these notes to my customers? I don't see why extending the dry cleaning business to a mobile app or website effects anything. What about journalists, are they required to disclose what data they're collecting about people as they do their job? I feel like the state constitution granted right to privacy does not supersede the federally mandated right to freedom of speech both the right to take internal notes and documentation and the violation of one's speech rights by forcing this disclosure. however IANAL and I don't live in California. Could someone share some insights onto the first amendment side of this?

mdavidn 7y ago
IANAL, but I think a human needs to be involved in the individuals' processing as a prerequisite to "speech." An automated process has no Constitutional rights.
- zbentley 7y ago
  > An automated process has no Constitutional rights. Yet.
krapp 7y ago
>I feel like the state constitution granted right to privacy does not supersede the federally mandated right to freedom of speech Gonna have to stop you there. The First Amendment doesn't mandate a right to free speech. It only prevents Congress from passing laws abridging that right. There's nothing, Constitutionally speaking, preventing states from doing so. Edit: nope, Apparently I'm wrong on this one.
- mdavidn 7y ago
  That's not the case. The Bill of Rights now does largely apply to the states. https://en.wikipedia.org/wiki/Incorporation_of_the_Bill_of_Rights https://en.wikipedia.org/wiki/Incorporation_of_the_Bill_of_R...

Havoc 7y ago

The whole system is rotten to the core. Allowing companies to portray themselves in a positive light on privacy > “The time to act is now,” While pushing a federal law geared towards undermining privacy rights? Doublespeak anyone?

buboard 7y ago

This: > The bill would authorize businesses to offer financial incentives for collection of personal information. Means it's nothing like the GDPR. This might actually be a sane law. And it doesnt implement punitive fines if you get hacked. Nor does it bring about a massive cookie alert insanity. The right to delete may work in europe , but i think in the US it is going to clash with free speech laws. So it might not work at all.

aazaa 7y ago

> Since the law passed, tech giants have pulled out their last card: pushing for an overarching federal bill. >In doing so, the companies would be able to control their messaging through their extensive lobbying efforts, allowing them to push for a weaker statute that would nullify some of the provisions in California’s new privacy law. In doing so, companies wouldn’t have to spend a ton on more resources to ensure their compliance with a variety of statutes in multiple states. Is it really that much easier to control a federal vs. state legislator? I wonder if the idea might actually be to prevent the likely future scenario in which 50+ different privacy regulations need compliance. Setting a national standard could prevent such an outcome. Privacy advocates should favor the state-by-state solution, though. The more difficult it is to comply with regulations, the more expensive it becomes to collect the data in the first place. As the cost of compliance increases, the alternative of simply not collecting the data in the first place becomes more attractive. But that itself can lead to unintended consequences. It would mean that only the biggest companies could afford the regulatory burden of collecting the data. And these are the very companies that have received the most negative attention. All of which makes me wonder whether at some point we could see a private data settlement along the lines of the tobacco settlement: https://en.wikipedia.org/wiki/Tobacco_Master_Settlement_Agreement https://en.wikipedia.org/wiki/Tobacco_Master_Settlement_Agre...

Nasrudith 7y ago

I can't help but view it with disgust just at the headline of having the wrong kind of mentality. It is a spiteful logical fallacy of the worst kind. "Soviets terrified of plan to nuclear first strike whole world - good!" Just because even the vilest foe dislikes it doesn't mean it is a good idea. The whole article seems to be about shutting down thinking and manipulation via playing with emotions. I am probably an outlier but I view that as an active sign that is terrible because otherwise they would lead on better points. The article made me /less/ supportive of it. It is perhaps unduly harsh but I would call it an outright propaganda piece not because of the message but how it was delivered.

notTyler 7y ago
"Shutting down thinking." Reporting on transgressions and laws designed to hold parties accountable is designed to shut down thinking now, and how those who would be affected by it are literally trying to kill the bill is considered "shutting down thinking." This is literally what you just said.
- Nasrudith 7y ago
  You proved my point ironically. It is all about "punishing the bad ones for their past sins" as opposed to going forward the impact of the law - the part to actually think about. Instead straight to emotionally knee jerk driven narratives of "they are bad and must be punished" instead of what the law is actually about. See emotions come out and the thinking on the topic like "would it actually help with Cambridge Analytica 2.0" go kaput. It is an old trick narrative for pushing terrible "tough on crime" laws for advancement. If you point out that it isn't a well thought out idea you support bad people!

atoav 7y ago

In short: laws against things that never sbould have been. One can only hope they make sure it hits big actors more than any other ones, because they are what makes this kind of data collection dangerous for societies.

gojomo 7y ago

Anyone remember when TechCrunch actually took the side of "Silicon Valley"?

dillondoyle 7y ago

I'm pretty concerned about it, and we are a tiny political digital agency. My reading is that basically any small sized email list, website, service etc that 'receives for the business’ commercial purposes' data on more than 50k 'devices' or 'consumers' must be compliant which is a very low bar. Like small business email lists would hit this, though maybe burden falls onto Mailchimp for most. It should be fairly easy to add a contact us address for delete and info requests to the bottom of websites. A lot harder and would take development time to automate a UI for a person to see all data associated automatically (e.g. lots of separate analytics; would have to build api to lookup ip/device/user data match across tables/dbs, and then how do I verify a user is requesting their data and not someone else's). Also harder to 'block' new data collection of device/consumer post delete request. What I'm less sure about is 'inform consumers before the point of collection.' Does a privacy policy link in footer count? If not what is required for compliance? What about advertising? Another big concern for me is that this is going to be weaponized in my industry (politics). I think a political campaign wont fit the bill's definition of 'business' (profit seeking for shareholders) but I think it will still be weaponized by opposition campaigns and service providers.

Sephr 7y ago
Sounds like you need a Data Privacy Infrastructure provider so you don't have to worry about the implementation details. The startup I'm working at, https://transcend.io https://transcend.io, offers that.

EGreg 7y ago

Can someone who has actually READ this law summarize the main provisions from it?

rpastuszak 7y ago

As much as most browsers have implemented a standardised payment API, a generic, browser-level Privacy related GUI would be helpful. By that I mean something less repetitive than the multitude of consent screens people have to deal with (not to mention dark UX patterns in the existing solutions).

ptest1 7y ago
Yes, please!!

calimac 7y ago

I love it! The big tech SJW Comifornian citizens finally are getting a taste of the effects of their burdensome heavy handed California legislature. Good riddens. They pushed their data analytics tech to the edge and it finally blew up with legislation.

calimac 7y ago

this is a result of data analytics pushing the bleeding edge and passing what is decent and allowing their tech to enter the invasive and creepy realm.

nicky19890202 7y ago

I think everyone's data must belong to their own.

systematical 7y ago

I wish I lived in California. I'd be requesting the deletion of my data ALL OVER the internet.

Aperocky 7y ago

LMAO, Google should just make itself unavailable in California due to 'involuntary violation' of this law to see it repealed real quick. Those who complain can use bing.

nickpp 7y ago

Well, the EU managed to destroy the websites' User Experience with their brain-dead GDPR - why should California be left behind?!

xhruso00 7y ago

Instead of complying with the law they are wasting time lobbying. If they don't comply on 1st of JAN what excuse are they going to have?

classified 7y ago

Project Gutenberg currently blocks users from Europe to avoid having to comply with GDPR. Logically the next step would be to block users from California as well.

tempodox 7y ago

Many comments here make the false dichotomy of paying for a service with money vs paying with your data. That ship has sailed. In the current market selling user data will win every time. Only laws can make sure that a company you pay for “premium service” or “no ads” won't turn around and sell your data anyway.