With a year to go before California’s Privacy Rights Act (CPRA)—which aims to prevent businesses from sharing peoples’ data—comes into effect, big tech companies and their lobbyists are actively engaged in limiting the impact of the law.
In the public comments released by the state regulatory body California Privacy Protection Agency (CPPA), tech giants like Google and Pinterest, along with software and data-analytics companies like Workday and Insights Association, urged the Agency to narrow the rules of CPRA, specifically surrounding automated decision making, privacy audits and consumer requests for data information. The CPPA is still in the process of soliciting feedback from the public.
Ad targeting has intensified over the last few years to the point where people feel stalked across platforms, spurring the petition of the California Consumer Privacy Act 2018 (CCPA), which gave consumers more autonomy over the dissemination of personal information.
For marketers, the global push toward privacy is manifested through ad blocks and toggle-device settings that limit data sharing, followed by tech companies like Apple blocking third-party cookies, a move causing publishers and marketers more discomfort.
But those in digital advertising need to be aware of how CPRA changes the definition of sensitive data and peoples’ autonomy over the disclosure of such data, Forrester analyst Stephanie Liu told Adweek. CPRA also “lets you opt-out of data sharing, not just data selling, which has been a highly contentious topic, especially in the advertising world,” she said.
Big Tech vs. ‘automated decision making’ policy
A common concern shared by the public commenters is how the agency defines “automated decision making” and the consumer’s right to opt-out of being a part of this decision-making process. Also referred to as “profiling,” automated decision-making includes evaluating consumers based on their data, including work, health, interests and location-related information that helps businesses target ads. The rule advocated by CPPA can significantly reduce the nature of this type of targeting in the future.
“The reason Big Tech is concerned about this is that the real money is consumers’ data and monetizing it,” said David O. Klein, the managing partner at internet marketing, and consumer-privacy firm Klein Moynihan Turco.
In an attempt to streamline California’s privacy standards to Europe’s General Data Protection Regulation, as well as Colorado and Virginia’s privacy laws effective in 2023, Google urged the agency to focus on rules concerning “fully-automated decision making that produces legal effects or effects of a similar import, such as a consumer’s eligibility for credit, employment, insurance, rental housing, license or other government benefit,” wrote Google’s director of state policy, Cynthia Pantazis.
In other words, the company has asked CPPA to focus on rules that govern pure automated decision making, where there is no human involvement for data collection, which may have legal ramifications when it comes to a consumer’s ineligibility for benefits, like insurance or employment, based on the data collected.
“These laws’ focus on decision making that has the potential to produce substantial harm is well-considered,” she wrote.
Google and other tech giants’ opposition is expected.
Forrester’s Liu does not expect fundamental overhauls of the law, but predicts tech companies to lobby for clarifications and guidance they find favorable. “CPPA is in charge of implementing and enforcing the law, not changing it,” she said.
“This law is intended to put the power back in the hands of consumers. And in so doing it potentially curbs the ability of [tech platforms] to monetize the data and restricts their future potential insofar as consumers elect to delete or opt-out,” Klein said to Adweek.
Liu believes the policy alone will have a lesser impact on data accessibility. The decisions by tech giants like Apple and Google to no longer support third-party cookies, plus Apple’s decision to prompt consumers on whether they want to share their device ID with apps, will potentially impact all the consumers, not just California residents.
A world where tech companies charge for their services
CPRA will put certain restrictions on the data companies can collect on people as they use the internet.
According to Klein, tech companies can deploy other paid third-party tech services that read and follow online signals and make sure that consumers’ data is handled correctly in terms of opt-out requests.
Monetizing data collected from people was the bargain that tech companies made to ensure their services were free. With less data at platforms’ disposal, this could spur them to charge for their services.
While many companies are still unaware of this policy change, “they’re going to scream and yell that this is unfair,” said Klein.
With a year left for the policy to go into effect, Klein alerts the digital tech and marketing companies to promptly get ahead of this law.
“If [companies] don’t, they’re going to come within the crosshairs of California, and they’re one of the most aggressive jurisdictions in the nation,” he said.
This article was originally published in AdWeek on December 16th, 2021. To read the original article, click here.
If you are interested in learning more about this topic, please e-mail us at: info@kleinmoynihan.com, or call us at (212) 246-0900.
The material contained herein is provided for informational purposes only and is not legal advice, nor is it a substitute for obtaining legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.
Attorney Advertising
