SAN FRANCISCO (AP) — Forty million Californians will soon have sweeping digital-privacy rights stronger than any seen before in the United States, posing a significant challenge to Big Tech and the data economy it helped create.
So long as state residents don't mind shouldering much of the burden of exercising those rights, that is.
Come Wednesday, roughly one in 10 Americans will gain the power to review their personal information collected by large companies around the world, from purchase histories and location tracking to compiled "profiles" that slot people into categories such as religion, ethnicity and sexual orientation. Starting Jan. 1, they can also force these companies — including banks, retailers and, of course, tech companies — to stop selling that information or even to delete it in bulk.
The law defines data sales so broadly that it covers almost any information-sharing that provides a benefit to business, including data transfers between corporate affiliates and with third-party data brokers — middlemen who trade in personal information.
It remains unclear how it will affect the business of targeted advertising, in which companies such as Facebook amass reams of personal data and use it to direct ads to specific groups of people. Facebook says it does not share that personal information with advertisers.
Still, because it applies to any company that meets a threshold for interacting with state residents, the California law might end up serving as a de facto national standard. Early signs of compliance have already started cropping up in the form of "Don't sell my personal information" links at the bottom of many corporate websites.
"If we do this right in California," says Attorney General Xavier Becerra, the state will "put the capital P back into privacy for all Americans."
California's law is the biggest U.S. effort yet to confront " surveillance capitalism," the business of profiting from the data that most Americans give up — often unknowingly — for access to free and often ad-supported services. The law is for anyone ever weirded out when an ad popped up for the product they were just searching, or who wondered just how much privacy they were giving up by signing into the briefly popular face-changing tool FaceApp.
But there are catches galore. The law — formally known as the California Consumer Privacy Act, or CCPA — seems likely to draw legal challenges, some of which could raise constitutional objections to its broad scope. It's also filled with exceptions that could turn some seemingly broad protections into coarse sieves, and affects only information collected by business, not government.
For instance, if you're alarmed after examining the data that Lyft holds on you, you can ask the company to delete it. It will legally have to do so — unless it claims some information meets one of the law’s many exceptions, among them provisions that allow companies to continue holding information needed to finish a transaction or to keep it in a way you would "reasonably expect" them to.
"It's more of a 'right to request and hope for deletion,'" says Joseph Jerome, a policy director at privacy group Common Sense Media/Kids Action.
