5 ms·

>There is also lack of clarity on what constitutes “sale” of information, retail lobbyists and attorneys advising retailers said. It's embarrassing that the la

>There is also lack of clarity on what constitutes “sale” of information, retail lobbyists and attorneys advising retailers said. It's embarrassing that the law isn't more explicit that this also covers "sharing" where money doesn't change hands, but I wouldn't expect any more from California's legislators where my default assumption is that they'll be captured by the industry in their backyard. I guess it will be up to courts to decide if sharing data counts as payment-in-kind.

CWuestefeld 7y ago
the law isn't more explicit that this also covers "sharing" where money doesn't change hands Our lawyers tell me that it does cover any in-kind exchange. For example, if we offered a customer summit in partnership with one of our product manufacturers (as we often do), and if that manufacturer helps underwrite the cost of the event, then us providing to them a list of attendees would count as a sale.
geocar 7y ago
Your particular concern seems to be addressed: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140 https://leginfo.legislature.ca.gov/faces/codes_displaySectio.... (t) (1) “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120 https://leginfo.legislature.ca.gov/faces/codes_displaySectio.... Even if Google doesn't pay you for your data, you still have the right (as a resident of California) to prevent Google from selling on your data directly, or in using your data as part of a sale (e.g. targeted advertising). My experience is the "confusion" is in what constitutes "other valuable consideration:" Can a company offer a personal data marketplace using credits that can only be used to obtain other personal data, and can only be obtained by sharing personal data? (e.g. the old data.com connect model). The code suggests maybe, but I suspect the Attorney General will take as broad a view as possible, so I'd steer clear from any startups that think this is a good idea.
- Despegar 7y ago
  >I suspect the Attorney General will take as broad a view as possible, so I'd steer clear from any startups that think this is a good idea. He was one of two AGs to not join other state AGs in their antitrust investigation of Facebook [1], so I'm not holding my breath. Private right of action is what's going to hold businesses accountable, even though it's also been crippled [2]. [1] https://www.nytimes.com/2019/10/31/technology/tech-investigations-california-attorney-general-becerra.html https://www.nytimes.com/2019/10/31/technology/tech-investiga... [2] https://www.jdsupra.com/legalnews/a-closer-look-at-the-ccpa-s-private-28984/ https://www.jdsupra.com/legalnews/a-closer-look-at-the-ccpa-...
- d1zzy 7y ago
  > Even if Google doesn't pay you for your data, you still have the right (as a resident of California) to prevent Google from selling on your data directly, or in using your data as part of a sale (e.g. targeted advertising). Except the definition you quoted doesn't say anything about "using" the information to provide a product (ie targeted advertising), it only talks about actually transferring that information to "another business or third party for monetary or other valuable consideration". So if the information doesn't leave Google's servers then it seems like it doesn't apply to Google.
  - geocar 7y ago
    It does leave Google's servers in several ways. 1. The ad tag Google delivers to publishers captures personal data like IP addresses and cookies, non-personal but potentially privacy-leaking data such as the URL the user is visiting, and somewhere in-between marketing segments that the user may belong to, and delivers that information (usually in JSON) to hundreds or even thousands of different advertisers using a protocol called OpenRTB. 2. The ad tag being served can also include an impression tracker. This is usually a pixel (literally an <img tag!) that refers to the advertisers' server where they record counts, sometimes media spend, and because it's a third-party server, that advertiser will receive (automatically) the IP addresses and cookies, the URL the user is visiting, and so on. 3. One of Google's products includes custom segments which contain IP addresses and cookies for one or more ad exchange. This is actually delivered in a flat file to buyers, and while Google themselves do not offer this service publicly (so conceivably the contracts could be updated to be CCPA-compliant), other exchanges that are like Google in other ways certainly do not. It is entirely possible your point is accurate for someone who doesn't provide ad exchange services or impression trackers or custom segments (such as Facebook), but it is also likely that some party selling a product that is derived from the use of this data will be considered in-scope. I would steer clear of companies that favor an alternate interpretation until the Attorney General has had a say.

CWuestefeld 7y ago

the law isn't more explicit that this also covers "sharing" where money doesn't change hands Our lawyers tell me that it does cover any in-kind exchange. For example, if we offered a customer summit in partnership with one of our product manufacturers (as we often do), and if that manufacturer helps underwrite the cost of the event, then us providing to them a list of attendees would count as a sale.

geocar 7y ago

Your particular concern seems to be addressed: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140 https://leginfo.legislature.ca.gov/faces/codes_displaySectio.... (t) (1) “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120 https://leginfo.legislature.ca.gov/faces/codes_displaySectio.... Even if Google doesn't pay you for your data, you still have the right (as a resident of California) to prevent Google from selling on your data directly, or in using your data as part of a sale (e.g. targeted advertising). My experience is the "confusion" is in what constitutes "other valuable consideration:" Can a company offer a personal data marketplace using credits that can only be used to obtain other personal data, and can only be obtained by sharing personal data? (e.g. the old data.com connect model). The code suggests maybe, but I suspect the Attorney General will take as broad a view as possible, so I'd steer clear from any startups that think this is a good idea.

Despegar 7y ago
>I suspect the Attorney General will take as broad a view as possible, so I'd steer clear from any startups that think this is a good idea. He was one of two AGs to not join other state AGs in their antitrust investigation of Facebook [1], so I'm not holding my breath. Private right of action is what's going to hold businesses accountable, even though it's also been crippled [2]. [1] https://www.nytimes.com/2019/10/31/technology/tech-investigations-california-attorney-general-becerra.html https://www.nytimes.com/2019/10/31/technology/tech-investiga... [2] https://www.jdsupra.com/legalnews/a-closer-look-at-the-ccpa-s-private-28984/ https://www.jdsupra.com/legalnews/a-closer-look-at-the-ccpa-...
d1zzy 7y ago
> Even if Google doesn't pay you for your data, you still have the right (as a resident of California) to prevent Google from selling on your data directly, or in using your data as part of a sale (e.g. targeted advertising). Except the definition you quoted doesn't say anything about "using" the information to provide a product (ie targeted advertising), it only talks about actually transferring that information to "another business or third party for monetary or other valuable consideration". So if the information doesn't leave Google's servers then it seems like it doesn't apply to Google.
- geocar 7y ago
  It does leave Google's servers in several ways. 1. The ad tag Google delivers to publishers captures personal data like IP addresses and cookies, non-personal but potentially privacy-leaking data such as the URL the user is visiting, and somewhere in-between marketing segments that the user may belong to, and delivers that information (usually in JSON) to hundreds or even thousands of different advertisers using a protocol called OpenRTB. 2. The ad tag being served can also include an impression tracker. This is usually a pixel (literally an <img tag!) that refers to the advertisers' server where they record counts, sometimes media spend, and because it's a third-party server, that advertiser will receive (automatically) the IP addresses and cookies, the URL the user is visiting, and so on. 3. One of Google's products includes custom segments which contain IP addresses and cookies for one or more ad exchange. This is actually delivered in a flat file to buyers, and while Google themselves do not offer this service publicly (so conceivably the contracts could be updated to be CCPA-compliant), other exchanges that are like Google in other ways certainly do not. It is entirely possible your point is accurate for someone who doesn't provide ad exchange services or impression trackers or custom segments (such as Facebook), but it is also likely that some party selling a product that is derived from the use of this data will be considered in-scope. I would steer clear of companies that favor an alternate interpretation until the Attorney General has had a say.