4 ms·

CCPA cannot kick in fast enough. We need consumer protection in the USA too.

PeterisP 7y ago
I haven't delved into a lot of detail of how CCPA works, but it seems to me as a step in the right direction that won't achieve much practical change. It's worth to look at this from the perspective of EU privacy legislation before GDPR - it already included all the things that data should be safeguarded, customers should be informed, that consent matters, etc. However, it didn't really have a meaningful effect on actual privacy before GDPR (and IMHO we'll need a GDPRv2 not that long in the future), because companies were able to comply simply by adding legalese, privacy policies and notifications without actually changing the privacy-relevant behavior. One aspect that I feel that CCPA is getting wrong and GDPR got right is the "default condition". According to GDPR, companies are prohibited to process your data unless they can provide a specific legal basis that allows them to do so, one of which is opt-in consent. According to CCPA (correct me if I'm wrong) the default position is that companies are allowed to do whatever they want with your data, but they are required to inform you and honor opt-out requests. This means that it's plausible for a company which currently is doing shady stuff to legally continue doing so, as long as they can write up some fancy words to 'inform' and ensure that most people don't do the opt-out process. The second difference is the distinction between having the data and using it for a specific purpose. It is a very common scenario where certain private data are clearly needed for a specific purpose (e.g. your address to deliver some goods), but we'd want to restrict the company's ability to use the same data for other purposes e.g. targeted advertising. With the way how GDPR is structured, this separation is built in; but CCPA doesn't make such a distinction, so (for example) the company is able to share data with a third party that's needed for fulfilling some business purpose (even if the customer had the opt-out for selling data, because it's not selling), then (as far as I understand - correct me if I'm wrong) according to CCPA the third party is legally free to use data for whatever other things it wants. And we should expect that business arrangements will be intentionally designed to 'accidentally' make transferring such data (without a sale) to be part of many deals, so that the big data aggregators would still continue to get all the same information that they had; that companies will be able to comply while continuing to do the same thing.
- lmkg 7y ago
  > This means that it's plausible for a company which currently is doing shady stuff to legally continue doing so, as long as they can write up some fancy words to 'inform' and ensure that most people don't do the opt-out process. CCPA requires you to have a link with the exact words "DO NOT SELL MY INFORMATION" visible on the homepage. That is an explicit provision. This somewhat limits company's ability to legalese their way around it.
  - mondoshawan 7y ago
    Still pretty crappy requiring users to take action to stop the selling of that information. Worse, it should be stopping the collection of it. Ugh. :-/
    - mgreg 7y ago
      While that is true - a consumer must take action to protect their individual information - it may be that if enough people do this that the cost of compliance (responding to the ccpa requests) will make it less profitable to hold on to a consumer's information. There are also lists with links and contact info of important businesses to exercise your CCPA opt-out or delete rights with like data brokers such as Experian, Epsilon, TransUnion as a start. Even ccpa email templates that may be easier to use rather than going through a form (not sure if they will work).
    - lidHanteyk 7y ago
      It actually is opt-in, not opt-out, by default. In order to do opt-out, a business has to demonstrate that their users are all above 13 and able to consent, which is a hard requirement that will force nearly all data brokers to do opt-in instead. To completely stop collection is difficult. But the legislative will is clearly manifest, so it might happen.
  - sparker72678 7y ago
    And yet... https://twitter.com/dhh/status/1216054342920200193 https://twitter.com/dhh/status/1216054342920200193 (thread)

I haven't delved into a lot of detail of how CCPA works, but it seems to me as a step in the right direction that won't achieve much practical change. It's worth to look at this from the perspective of EU privacy legislation before GDPR - it already included all the things that data should be safeguarded, customers should be informed, that consent matters, etc. However, it didn't really have a meaningful effect on actual privacy before GDPR (and IMHO we'll need a GDPRv2 not that long in the future), because companies were able to comply simply by adding legalese, privacy policies and notifications without actually changing the privacy-relevant behavior. One aspect that I feel that CCPA is getting wrong and GDPR got right is the "default condition". According to GDPR, companies are prohibited to process your data unless they can provide a specific legal basis that allows them to do so, one of which is opt-in consent. According to CCPA (correct me if I'm wrong) the default position is that companies are allowed to do whatever they want with your data, but they are required to inform you and honor opt-out requests. This means that it's plausible for a company which currently is doing shady stuff to legally continue doing so, as long as they can write up some fancy words to 'inform' and ensure that most people don't do the opt-out process. The second difference is the distinction between having the data and using it for a specific purpose. It is a very common scenario where certain private data are clearly needed for a specific purpose (e.g. your address to deliver some goods), but we'd want to restrict the company's ability to use the same data for other purposes e.g. targeted advertising. With the way how GDPR is structured, this separation is built in; but CCPA doesn't make such a distinction, so (for example) the company is able to share data with a third party that's needed for fulfilling some business purpose (even if the customer had the opt-out for selling data, because it's not selling), then (as far as I understand - correct me if I'm wrong) according to CCPA the third party is legally free to use data for whatever other things it wants. And we should expect that business arrangements will be intentionally designed to 'accidentally' make transferring such data (without a sale) to be part of many deals, so that the big data aggregators would still continue to get all the same information that they had; that companies will be able to comply while continuing to do the same thing.

lmkg 7y ago
> This means that it's plausible for a company which currently is doing shady stuff to legally continue doing so, as long as they can write up some fancy words to 'inform' and ensure that most people don't do the opt-out process. CCPA requires you to have a link with the exact words "DO NOT SELL MY INFORMATION" visible on the homepage. That is an explicit provision. This somewhat limits company's ability to legalese their way around it.
- mondoshawan 7y ago
  Still pretty crappy requiring users to take action to stop the selling of that information. Worse, it should be stopping the collection of it. Ugh. :-/
  - mgreg 7y ago
    While that is true - a consumer must take action to protect their individual information - it may be that if enough people do this that the cost of compliance (responding to the ccpa requests) will make it less profitable to hold on to a consumer's information. There are also lists with links and contact info of important businesses to exercise your CCPA opt-out or delete rights with like data brokers such as Experian, Epsilon, TransUnion as a start. Even ccpa email templates that may be easier to use rather than going through a form (not sure if they will work).
  - lidHanteyk 7y ago
    It actually is opt-in, not opt-out, by default. In order to do opt-out, a business has to demonstrate that their users are all above 13 and able to consent, which is a hard requirement that will force nearly all data brokers to do opt-in instead. To completely stop collection is difficult. But the legislative will is clearly manifest, so it might happen.
- sparker72678 7y ago
  And yet... https://twitter.com/dhh/status/1216054342920200193 https://twitter.com/dhh/status/1216054342920200193 (thread)