8 ms·
U.S. retailers rush to comply with CCPA
- guelo 7y agoThe privacy violation that infuriates me the most is that Visa and Mastercard sell your purchase data, and I don't believe CCPA applies to them. Like cell phone companies selling tower-based location data, the credit card's sale of data is unavoidable and completely hidden from consumers.
- JadeNB 7y agoWhile cell-phone companies could function without keeping records of my location, credit cards couldn't function without keeping records of my purchases—at least until the next billing cycle. Somehow this makes their abuse of that information less surprising to me—which doesn't mean I like it any better!
- zAy0LfpBZLC8mAC 7y agoThat isn't actually true. It would be perfectly possible to build a payment system where the participants by default don't know the identity of most other parties. Like, it would be perfectly possible for a merchant to encrypt the transaction description with a public key of the customer, and their bank only submitting the encrypted record with the amount and the account to debit to the card issuer, who would debit the account and pass on the encrypted record to their customer. That's just a random idea, but the point is that you could achieve much the same result with a lot less data collection if you actually cared to.
- reaperducer 7y agoIt would be perfectly possible to build a payment system where the participants by default don't know the identity of most other parties. It's been done. Cash. Checks. Travelers checks. Money orders. Cashiers checks. Gift cards. Pre-paid debt cards.
- reaperducer 7y agoI'm OK with the banks or even the card companies keeping a record of transactions. But Google boasts that it buys 80% of all the world's credit card transaction data for its profiling. That's just not cool.
- icedchai 7y agoLook at it this way: Would you prefer to received generic, un-targeted advertisements? Or would you rather something that is more likely suited to your interests? The truth is "profiling" / ad targeting is actually a benefit to the consumer.
- mindslight 7y ago... so insisted the Surveillance Valley reality distortion field of the late 2000's, leading to an ever-growing backlash now including this law. No, pervasive surveillance is not a benefit to me because it facilitates smoother attempts at psychological manipulation. It's generally a good thing when spam stands out as much as possible, making it easier to ignore.
- reaperducer 7y agoI can receive targeted advertisements without being surveilled and sold. It's been done for hundreds of years with billboards, newspapers, magazines, radio, and television. Heck, even web sites can do it, and did for many years before Google even existed.
- icedchai 7y agoThose aren't considered targeted advertising.
- reaperducer 7y agoAdvertising bird watching equipment in a bird watching magazine isn't targeted? "Targeted advertising" has been around longer than you think.
- reaperducer 7y agoOne of the reasons I use my Apple Card is because it's a step in the right direction. I don't remember exactly what Tim Cook said in the announcement, but I believe it was something to the effect that Goldman Sachs can't use the information for marketing. Whether that means internal marketing, or if they're selling it or not wasn't specified. It's not ideal, but it's a start; and other than cash, the only way to vote with my dollars.
- vageli 7y ago> The privacy violation that infuriates me the most is that Visa and Mastercard sell your purchase data, and I don't believe CCPA applies to them. Like cell phone companies selling tower-based location data, the credit card's sale of data is unavoidable and completely hidden from consumers. If they do business in CA, why wouldn't CCPA apply to them? Even for HIPAA-covered entities, the CCPA still applies, just not all the parts (specifically there are exceptions for health data).
- icedchai 7y agoThe consumer "opts in" by using the credit card. All of this is in the credit card agreements that nobody reads. You want to opt out? Use cash.
- fbonetti 7y agoBy the year 2030, the amount of fine print and opt-ins at the top of each website - in order to comply with every state and country's bespoke data regulations - will be larger than the warnings on cigarette packs.
- gpderetta 7y agoConsidering that the regulations are there to help websites getting rid of their addiction to personal details, it seems fitting!
- ginko 7y agoOr you know, websites could just stop collecting unnecessary amounts of data by default.
- CWuestefeld 7y agoThere would still need to be a link to a page that says that.
- remus 7y agoSorry if you're being sarcastic and it's totally gone over my head, but if you're not processing personal data you don't need to explain all the ways you don't process personal data. Otherwise you might as well explain all the other ways you're not breaking the law (which is going to be a long list).
- nerfhammer 7y agothis comment, its timestamp, your username, your browser cookie, your password all could easily count as personal data
- SpicyLemonZest 7y agoIt's impossible to build a website that doesn't process personal information at all, because the California law explicitly defines your IP address as personal information.
- Trias11 7y agoI want to explicitly opt-in, not to go through hassle to opt-out at every shitty website of every vendor. You want to sell my purchase/demographics data? No problem. Just let me know how much or what i'll get for it and i'll decide if it worth to opt-in. By default - no one should be able to share my data with anyone.
- slig 7y agoAny reason why this could not be implemented right in the browser? If the browser sends the specific header, either allowing it or disabling it, the server doesn't need to show the opt-in/out nag.
- JonathonW 7y agoThey tried that with Do Not Track. It just became another bit of potentially identifying data for browser fingerprinting (and tracking).
- ceejayoz 7y agoOnly because compliance with it was voluntary. There's no reason a government like California couldn't require honoring DNT (within their jurisdiction, of course, as with the CCPA) and provide penalties for violations.
- rebelde 7y agoMy phone has Google Fi VPN. This VPN doesn't do everything, but websites now think I'm in Mountain View. I am nowhere close. Is a VPN a better solution? I understand that Google might not be the best company to trust here, but they did give it to me for free and it is working fine.
- ApolloFortyNine 7y ago>You want to sell my purchase/demographics data? No problem. Just let me know how much or what i'll get for it and i'll decide if it worth to opt-in. It should be allowed to be the cost of admission to the site. If you don't like that the advertising and your own metadata allows you to view the site for free, you could just not visit (or when you click no to consent, they would block you). Websites shouldn't be required to provide you content for free.
- Despegar 7y ago>There is also lack of clarity on what constitutes “sale” of information, retail lobbyists and attorneys advising retailers said. It's embarrassing that the law isn't more explicit that this also covers "sharing" where money doesn't change hands, but I wouldn't expect any more from California's legislators where my default assumption is that they'll be captured by the industry in their backyard. I guess it will be up to courts to decide if sharing data counts as payment-in-kind.
- CWuestefeld 7y agothe law isn't more explicit that this also covers "sharing" where money doesn't change hands Our lawyers tell me that it does cover any in-kind exchange. For example, if we offered a customer summit in partnership with one of our product manufacturers (as we often do), and if that manufacturer helps underwrite the cost of the event, then us providing to them a list of attendees would count as a sale.
- geocar 7y agoYour particular concern seems to be addressed: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.140 https://leginfo.legislature.ca.gov/faces/codes_displaySectio.... (t) (1) “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.120 https://leginfo.legislature.ca.gov/faces/codes_displaySectio.... Even if Google doesn't pay you for your data, you still have the right (as a resident of California) to prevent Google from selling on your data directly, or in using your data as part of a sale (e.g. targeted advertising). My experience is the "confusion" is in what constitutes "other valuable consideration:" Can a company offer a personal data marketplace using credits that can only be used to obtain other personal data, and can only be obtained by sharing personal data? (e.g. the old data.com connect model). The code suggests maybe, but I suspect the Attorney General will take as broad a view as possible, so I'd steer clear from any startups that think this is a good idea.
- Orangeair 7y agoI think this should say [2019] It feels a bit pedantic to say that about a post from a week ago, but the whole point of the article was that they had until January 1st to comply, which has now passed. When I first saw the article title, I assumed it would be an article about how companies were out of compliance already since the date had passed, but it's not.
- lmkg 7y agoWell, kind of. The law technically goes into effect on Jan 1, but the CA Attorney General is not allowed to enforce it until July 1. This was part of a compromise brokered around the fact that it's taken a long while to nail down the final wording of the law. While some companies are already compliant, others are taking this as a grace period to get their act together. Which is necessary because of the short timeline. As far as I'm aware, the actual text of the regulation is still not finalized. The most recent update to the text was in October, but the AG office was gathering public feedback in early December. They still haven't released their findings from the feedback. The October version was more a Release Candidate, if you will.
- Wowfunhappy 7y agoHow can a law be simultaneously in effect but also not finalized? What rule is anyone supposed to follow? (I realize the fact it's not being enforced makes this moot, but...)
- nesky 7y agoI often think these efforts will just continue to empower the larger players and frustrate the user. No one is going to go to all these companies/websites/apps and ask them to delete their data and then do it again tomorrow, next week, next month, next year...when they collect more data. We need a mechanism that just creates so much data both legitimate and artificial that these systems prove worthless. Edit: Curious the effectiveness of browser extensions like Ad-Nauseum. I've used it on & off and became amused with how much I 'cost' the ad-companies but for all I know it just proves another data point that my machine clicks every add that comes across it.
- cbsmith 7y agoI so want to walk into a 7-11 and say, "delete my data".
- shadowgovt 7y ago""" A Walmart source with knowledge of the matter told Reuters the company is “working through a lot of ambiguities in the law, for example, the language around loyalty programs and if retail companies can offer them going forward.” """ If loyalty programs run afoul of the law, it'll be interesting to see if this creates a plane of competition between companies that kick out or forego loyalty programs in states outside of CA as well as inside CA and companies that continue to offer loyalty programs in states outside CA. Loyalty programs seem a mixed bag for consumers; some are actually into them, some hate them (seeing them as inefficiency that pushes labor onto the consumer).
- zAy0LfpBZLC8mAC 7y agoExcept there is absolutely no problem with loyalty programs. There is only a problem with collecting data for loyalty programs. Loyalty programs used to be done with stamps on paper cards, if you had a card full of stamps, you could get a rebate or whatever. Also, I don't hate them (the ones that collect data, that is) because they push inefficiency onto the customer, but because I have to pay more so other people get paid for helping corporations manipulate me more effectively.
- shadowgovt 7y agoStamps on paper cards are more prone to fraud, require more physical product be printed, and are less convenient for users than online solutions. I don't anticipate most stores going back to them (or staying that way as they grow; small stores will always do whatever).
- zAy0LfpBZLC8mAC 7y ago> Stamps on paper cards are more prone to fraud Given how much fraud is happening with customer data (that is: it being acquired under a pretense and then used for a different purpose), I very much doubt it. > require more physical product be printed, and are less convenient for users than online solutions. Except that's kinda orthogonal. The paper solution is easier to demonstrate to be free of back doors, but there is no reason why you couldn't build an "online solution" that doesn't do any tracking. You could just hand out random tokens without ever associating them with a transaction, and then accept sets of ten of those to redeem for a rebate, say.
- dlahoda 7y agoin jetdotcom, part of Walmart, we succefully rushed to be ccpa compliant