5 ms·

Comparison of California Consumer Privacy Act (CCPA) and GDPR [pdf]

96 points by ed 7y ago

hiei 7y ago
CCPA is certainly a headache at work and brought in consulting to assist but I hope it spreads beyond California and more! As a consumer I want to be able to opt out of any/all data collection related to my personal details. Fully support it regardless of the "costs" it brings to the company. Data should have been regulated from the get go.
- toomuchtodo 7y ago
  Microsoft has stated they will honor CCPA nationwide. I would expect other tech companies to follow until national regulation catches up.
  - willy_ph 7y ago
    Many companies have adopted a one-size fits all approach, whereby the most restrictive legislation applies, regardless of jurisdiction where they do business. This reduces costs by minimizing duplication where possible. I suspect Microsoft's approach was likely driven in part by the additional costs needed to support two compliance regimes for their various products.
ed 7y ago
I thought CCPA was California's GDPR, but it seems to offer consumers very little protection. CCPA does not restrict the collection or processing of personal data for marketing purposes. You can't even opt-out. Companies like BounceX will still be able to deanonymize 40% of consumer web visitors for direct marketing. You can only opt-out from your data being sold. And how are you supposed to know when a company is selling your data? The company is not required to tell you – you have to ask. GDPR the other hand is entirely opt-in. Companies cannot collect or process personal information unless given explicit consent. And that's a big deal – the rate of consent is so low that many marketing projects have a negative ROI and companies stop working on them. Enforcement will likely be weak. CCPA introduces civil penalties so consumers can sue companies, or join class action suits, but it will be difficult for a consumer to know when a business is violating CCPA, so this will be rare. California's AG can bring action, but there isn't a very strong incentive for them to do so with the exception of high-profile, politicized cases.
- lmkg 7y ago
  ICO was not established by GDPR. It has been around since 1984, and was also the agency responsible for enforcing GDPR's predecessors. I agree that a regulatory agency specialized to these issues would increase their importance, but it's not the whole solution. ICO already existed, it just didn't have teeth.
- twobat 7y ago
  > GDPR the other hand is entirely opt-in. As an European I don't feel like it's opt-in. Last I've heard Google is still tracking me left and right.
  - novok 7y ago
    The GDPR add a regulatory hurdle to jump over that is hard to small businesses to do properly, and affordable to Google to do it right and have a similar status quo. I think most startup people would have no problem with the GDPR if it included the minimum limits that the CCPA has.
- ocdtrekkie 7y ago
  CCPA has enough common elements with GDPR that companies are likely to look for a set of practices that meets both in as many cases as possible. I'm hopeful that while the CCPA may lack the full width of GDPR's effect, it will push companies that were special-casing the EU to apply GDPR practices to the US as a whole as well or the entire world. Very few companies are going to want to maintain a separate GDPR strategy, a separate CCPA strategy, and an unregulated strategy, and then selectively apply each to various users. As more jurisdictions jump on board with privacy requirements, hopefully globally consumers will get the benefits of the strongest passed regulation in each category.
  - ed 7y ago
    But there is no CCPA strategy. CCPA is so weak that compliance is easy: offer data exports and stop selling data on behalf of the handful people who request it. No need to encrypt stored data, or restrict what you collect, or how you collect it.
lacker 7y ago
This law frequently refers to "selling consumers' personal information". But hardly any company actually sells personal information. Google doesn't sell your personal information, Facebook doesn't sell your personal information. Companies use your personal information to match you to advertising, not to sell the information directly. So laws forbidding the sale of personal information sort of pointless. At first I thought that this PDF was just describing the proposed law in an inaccurate manner. But no, the CCPA really does talk a lot about "selling your personal information". https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-proposed-regs.pdf https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-p...
- chipotle_coyote 7y ago
  This is a great point that often gets glossed over in these discussions. Facebook and Google primarily get value from your personal information by hoarding it and treating both it and the data they derive from it as proprietary.
  - gorgoiler 7y ago
    The last time I used Google Takeout to download my data I got all my emails, custom maps, YouTube uploads etc., as one might expect, but what I couldn’t find were: * all the URLs I’ve visited with my Google cookie loaded * all the searches I’ve ever done * all the ads I’ve clicked on. I know ad tech mechanics can be counter intuitive but I’m surprised they don’t have that information for me to download, especially when ads and search are the primary Google functions. Maybe these logs are pseudonymized in such a way that google can’t tie them to my identity?
    - judge2020 7y ago
      They're technically not linked to your Google account I believe, https://policies.google.com/technologies/anonymization?hl=en https://policies.google.com/technologies/anonymization?hl=en (although we've seen how anonymized data can still be de-anonymized https://news.ycombinator.com/item?id=20513521 https://news.ycombinator.com/item?id=20513521 )
mgoblu3 7y ago
I’m still struggling to find out what exactly is required for mobile apps in particular. Our legal team (very big company) told us we have to add a link to our Privacy Policy on every screen of our app, so hundreds. Where can I find things like requirements on those, or is it just really vague?
- kitotik 7y ago
  That sounds like overkill but IANAL. You should only need to post the disclosures before the info is collected, where the info is collected. Shameless plug: we put together a more readable version of the CCPA with all the amendments incorporated here [1] and an outline of the proposed enforcement regulations here [2] [1] https://hq.services/blog/ccpa-full-text-with-amendments/ https://hq.services/blog/ccpa-full-text-with-amendments/ [2] https://hq.services/blog/ccpa-proposed-regulations/ https://hq.services/blog/ccpa-proposed-regulations/

96 points by ed 7y ago

hiei 7y ago

CCPA is certainly a headache at work and brought in consulting to assist but I hope it spreads beyond California and more! As a consumer I want to be able to opt out of any/all data collection related to my personal details. Fully support it regardless of the "costs" it brings to the company. Data should have been regulated from the get go.

toomuchtodo 7y ago
Microsoft has stated they will honor CCPA nationwide. I would expect other tech companies to follow until national regulation catches up.
- willy_ph 7y ago
  Many companies have adopted a one-size fits all approach, whereby the most restrictive legislation applies, regardless of jurisdiction where they do business. This reduces costs by minimizing duplication where possible. I suspect Microsoft's approach was likely driven in part by the additional costs needed to support two compliance regimes for their various products.

ed 7y ago

I thought CCPA was California's GDPR, but it seems to offer consumers very little protection. CCPA does not restrict the collection or processing of personal data for marketing purposes. You can't even opt-out. Companies like BounceX will still be able to deanonymize 40% of consumer web visitors for direct marketing. You can only opt-out from your data being sold. And how are you supposed to know when a company is selling your data? The company is not required to tell you – you have to ask. GDPR the other hand is entirely opt-in. Companies cannot collect or process personal information unless given explicit consent. And that's a big deal – the rate of consent is so low that many marketing projects have a negative ROI and companies stop working on them. Enforcement will likely be weak. CCPA introduces civil penalties so consumers can sue companies, or join class action suits, but it will be difficult for a consumer to know when a business is violating CCPA, so this will be rare. California's AG can bring action, but there isn't a very strong incentive for them to do so with the exception of high-profile, politicized cases.

lmkg 7y ago
ICO was not established by GDPR. It has been around since 1984, and was also the agency responsible for enforcing GDPR's predecessors. I agree that a regulatory agency specialized to these issues would increase their importance, but it's not the whole solution. ICO already existed, it just didn't have teeth.
twobat 7y ago
> GDPR the other hand is entirely opt-in. As an European I don't feel like it's opt-in. Last I've heard Google is still tracking me left and right.
- novok 7y ago
  The GDPR add a regulatory hurdle to jump over that is hard to small businesses to do properly, and affordable to Google to do it right and have a similar status quo. I think most startup people would have no problem with the GDPR if it included the minimum limits that the CCPA has.
ocdtrekkie 7y ago
CCPA has enough common elements with GDPR that companies are likely to look for a set of practices that meets both in as many cases as possible. I'm hopeful that while the CCPA may lack the full width of GDPR's effect, it will push companies that were special-casing the EU to apply GDPR practices to the US as a whole as well or the entire world. Very few companies are going to want to maintain a separate GDPR strategy, a separate CCPA strategy, and an unregulated strategy, and then selectively apply each to various users. As more jurisdictions jump on board with privacy requirements, hopefully globally consumers will get the benefits of the strongest passed regulation in each category.
- ed 7y ago
  But there is no CCPA strategy. CCPA is so weak that compliance is easy: offer data exports and stop selling data on behalf of the handful people who request it. No need to encrypt stored data, or restrict what you collect, or how you collect it.

lacker 7y ago

This law frequently refers to "selling consumers' personal information". But hardly any company actually sells personal information. Google doesn't sell your personal information, Facebook doesn't sell your personal information. Companies use your personal information to match you to advertising, not to sell the information directly. So laws forbidding the sale of personal information sort of pointless. At first I thought that this PDF was just describing the proposed law in an inaccurate manner. But no, the CCPA really does talk a lot about "selling your personal information". https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-proposed-regs.pdf https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-p...

chipotle_coyote 7y ago
This is a great point that often gets glossed over in these discussions. Facebook and Google primarily get value from your personal information by hoarding it and treating both it and the data they derive from it as proprietary.
- gorgoiler 7y ago
  The last time I used Google Takeout to download my data I got all my emails, custom maps, YouTube uploads etc., as one might expect, but what I couldn’t find were: * all the URLs I’ve visited with my Google cookie loaded * all the searches I’ve ever done * all the ads I’ve clicked on. I know ad tech mechanics can be counter intuitive but I’m surprised they don’t have that information for me to download, especially when ads and search are the primary Google functions. Maybe these logs are pseudonymized in such a way that google can’t tie them to my identity?
  - judge2020 7y ago
    They're technically not linked to your Google account I believe, https://policies.google.com/technologies/anonymization?hl=en https://policies.google.com/technologies/anonymization?hl=en (although we've seen how anonymized data can still be de-anonymized https://news.ycombinator.com/item?id=20513521 https://news.ycombinator.com/item?id=20513521 )

mgoblu3 7y ago

I’m still struggling to find out what exactly is required for mobile apps in particular. Our legal team (very big company) told us we have to add a link to our Privacy Policy on every screen of our app, so hundreds. Where can I find things like requirements on those, or is it just really vague?

kitotik 7y ago
That sounds like overkill but IANAL. You should only need to post the disclosures before the info is collected, where the info is collected. Shameless plug: we put together a more readable version of the CCPA with all the amendments incorporated here [1] and an outline of the proposed enforcement regulations here [2] [1] https://hq.services/blog/ccpa-full-text-with-amendments/ https://hq.services/blog/ccpa-full-text-with-amendments/ [2] https://hq.services/blog/ccpa-proposed-regulations/ https://hq.services/blog/ccpa-proposed-regulations/