So, California’s Proposition 24 passed. What does it mean for privacy in the Golden State?
One of the down-ballot measures I was watching on Tuesday was California’s Proposition 24. The expansion of the state privacy law won comfortably, by nearly 1.7 million votes, but was overshadowed in media discussions by the more controversial Prop 22, which solidified ride share drivers as gig-economy workers.[1] Prop 24’s proponents promised the measure would expand the privacy rights of Californians and protect the state’s landmark privacy statute, the CCPA, from being watered down by a legislature in the pocket of big business.
Prop 24 has an interesting backstory. In 2018, rich man and policy hobbyist[2] Alastair Mactaggart spearheaded the effort to include “the Consumer Right to Privacy Act of 2018” on the ballot for the 2018 election.[3] California legislators, rightly alarmed by the prospect of passing a sea changing law by ballot measure, came together to write the nation’s toughest privacy law (the CCPA) in exchange for the removal of the initiative from the ballot.[4] Since the law’s passage, Mactaggart evidently believed that the CCPA needed some more juice, so he took it upon himself to pass this new measure.[5]
The new measure promised to enhance the CCPA in the following ways:
- By letting you tell businesses to limit the use of sensitive data, such as your exact location, health information, race and religion
- By prohibiting businesses from holding onto your data for longer than necessary
- By allowing the government to fine companies up to $7,500 for violating children’s privacy rights
- By creating a new state agency to enforce the privacy law, investigate violations and assess penalties
- By reducing the number of businesses that have to comply, making it apply only to companies that buy or sell data of at least 100,000 households a year[6]
Besides Mactaggart, the measure was supported by former presidential candidate Andrew Yang, Representative Ro Khanna, and consumer organizations such as Consumer Sense and Consumer Watchdog.[7] But those opposed make perhaps the most interesting group of bedfellows I’ve seen in a long time: the Green, Libertarian, and Republican parties of California; the ACLU; the Center for Digital Democracy; and the California Small Business Association.[8] The EFF sat this one out![9] The Electronic Frontier Foundation looked at a privacy proposal and shrugged it’s shoulders!
If Prop 24 is supposed to push privacy forward, or in the words of Mactaggart is, “so much better than existing law,”[10] why the ambivalence from the institutions we expect to advocate for Americans privacy? The answer is that the proposition is a victory for one side in a core fight over what privacy should mean in the 21st century.
More or less, Prop 24 is a victory for those who favor the status quo. The issue is one we’ve been grappling with for several years. Privacy advocates don’t like the initiative because it enshrines two key principles into law:
- You can put a monetary value on individual data;
- The onus is on the consumer to opt-out of the data collection system.
Number 1 is the most interesting, so I’ll cover it first. Prop 24 includes an exception that allows companies to charge users more if they opt-out of data collection. This is one of the main reasons the ACLU and the EFF oppose the law: it implicitly accepts a pay-for-privacy scheme.[11] In a pay-for-privacy world, we accept the premise that consumer data has value. Advocates (and some antitrust scholars)[12] have argued that in a world where internet products are free, the actual product is the consumer data companies harvest and sell to advertisers. One proposed solution, famously advocated for by Andrew Yang during his presidential campaign, is that companies should compensate users for the data they harvest in the form of a “data dividend.”[13] Advocates have argued against this proposal by stating privacy is a right, not a commodity, and privacy laws should protect data without encouraging its sale. By giving into the current system one iota, and admitting privacy has a price tag, it makes it that much harder to advocate for an overhaul of the system with user protection at the center of it.[14]
Number two, opt-outs, are opposed because they create for the consumer “Privacy Paperwork.”[15] Prop 24 also entrenches the current fractionalized and disparate internet by requiring consumers to manually opt-out of data collection at each site they wish to do so. Again, the EFF and ACLU prefer the alternative model, where consumers must opt-in to collection – a paradigm shattering reversal of the way business is done now that would likely significantly change how companies do business on the internet. Preserving opt-out culture is an implicit nod to the anti-privacy argument that people are not interested or don’t care about their internet privacy. Businesses may be forced to build systems to tolerate the few passionate privacy zealots or tin-hatters, but with opt-outs they know most people will accept the current system as it stands.
There are many other reasons advocates opposed the law – and I encourage you to read the ACLU and EFF arguments. The passage of this law is another important brick towards building the new model of data privacy in this century, one that cements the way things are done now.
Thanks for reading.
Good tweet of the week:
Originally tweeted by Favorite movie lines (@TitlesInMedia) on November 9, 2020.
[1] https://www.sfchronicle.com/projects/2020/california-election-results/#state
[2] This is how it is spelled!
[3] This is where I say: the way California allows this end-around lawmaking is batshit. Democracy is valuable, but arguably the whole point of a legislature is to have a group of people dedicated to resolving the inconsistencies and rounding the edges of new rules to make them fit well within the rulebook. In California you can just write a measure, dump a bunch of money in the advertising machine, and make the state constitution/code longer and more complicated. https://oag.ca.gov/initiatives.
[4]https://www.americanbar.org/groups/business_law/publications/committee_newsletters/bcl/2019/201902/fa_9/
[5] Mactaggart funded the Prop 24 effort to the tune of $6.2 million. His opponents spent $48,000.
[6] https://calmatters.org/election-2020-guide/proposition-24-data-privacy/
[7]https://ballotpedia.org/California_Proposition_24,_Consumer_Personal_Information_Law_and_Agency_Initiative_(2020)
[8] Id.
[9] “EFF does not support it; nor does EFF oppose it.” https://www.eff.org/deeplinks/2020/07/why-eff-doesnt-support-cal-prop-24
[10] https://calmatters.org/politics/2020/10/consumer-advocates-privacy-prop-24/
[11] https://www.eff.org/deeplinks/2020/07/why-eff-doesnt-support-cal-prop-24; https://www.aclunc.org/blog/californians-should-vote-no-prop-24
[12] https://dumbprivacy.com/2020/10/08/is-privacy-part-of-antitrust-now/. Every time I cite myself:
[13] This is the topic of my next blog! I was halfway through it and then the election happened. It’ll expand on the arguments for and against the dividend.
[14] Ironically Shoshanna Zuboff supported Prop 24? It seems like this entrenches the system she argues so ardently against in The Age of Surveillance Capitalism.
[15] Credit to the ACLU for that one. Hilarious and biting description. https://www.aclunc.org/blog/californians-should-vote-no-prop-24
Dumb Privacy Guy 