GDPR is here, but people in the United States have only benefitted from this E.U. provision as a sort of side-effect of the law. But now new data privacy protection laws are on their way to at least one American state. The California Consumer Privacy Act (CCPA), scheduled to take effect in California in 2020, may have a significant impact on the digital media industry and the strategies used to engage with consumers. Despite being a California-specific law, the legislation is likely to “set a precedent for data collection and information security across the U.S., as well as the world,” according to Karthik Kannan, the Thomas Howatt Chaired Professor in Management at Purdue University and an expert in data analytics. After all, he points out, it’s unlikely that companies like Google and Facebook will “retain a separate set of policies for customers in California versus the rest of the country.”
What’s Required Under CCPA?
The CCPA, introduced by California Governor Jerry Brown ensures consumers know about the information that companies are collecting about them and what they’re doing with that information—e.g. who they are sharing it with. Consumers will also have the right to ask that their information be deleted and/or not sold to others.
“The CCPA requires businesses to include an easy-to-find way for consumers to opt-out of data-sharing, and a link on a company’s homepage to a page titled ‘Do Not Sell My Personal Information’,” says Vernhout. “If a consumer navigates there and requests his or her information is kept private, the business must suspend any selling of that consumer’s information for 12 months and obtain clear consent authorizing the sale of their data in the future—after the year is over.”
Who Will Be Impacted by CCPA?
The law, says Andy Sambandam, CEO of Clarip, a data privacy software company, “signals the end to the wild west of data driven marketing.” Why the dire prediction? “The biggest impact of the law will be on data brokers and digital marketers that buy and sell the personal information of California residents,” he says. “Because consumers will be able to opt out of the transfer of their data to third-parties who are not service providers, they will see the flow of data and money dwindle once people exercise their right to opt out.”
Companies that have direct relationships with consumers, but do not sell their data, will not see as big of an impact, says Sambandam. “They can collect the data themselves and will not be restricted in their use of it by the right to opt out. They will only be impacted if a consumer decides to exercise their right to delete their personal information, and in that event the company probably didn’t have a very good relationship with the person anyway.”
Some Unknowns About CCPA
There are some big unknowns about the law, though, says Kannan. It’s not clear, he says, whether consumers will be able to get access back to their data that has already been sold. It’s also not clear what steps consumers will be able to take if there are inaccuracies in the data that has been collected.
Another big unknown: whether the law will ever actually be enacted. It’s anticipated that companies will lobby the California legislature to challenge the proposed legislation. A JDSupra news release says: “Hastily passed by the Legislature after only a week of debate, the CCPA contains provisions that require further clarification and that may prompt additional revisions.”
Still, says Sambandam, the digital marketing industry needs to take privacy and cybersecurity seriously. “Companies that collect data, but fail to secure it, could see significant legal costs attached to any noncompliance with the law,” he says.
Vernhout agrees. “Marketers should not delay evaluating their business’s data collection and usage needs, especially if they’re reselling or buying data from a third party,” she says. “Consider what you need to disclose, how should it be disclosed, and how to manage consumer requests spurred by CCPA.”