California voters approve Prop. 24, ushering in new rules for online privacy
California chose to rewrite the rules of the internet this week, with a strong majority of voters supporting Proposition 24.
The ballot measure aims to reinforce and redefine parts of the California Consumer Privacy Act, a 2019 law that gave state residents new rights as to how companies collect and use their personal information. Proposition 24 establishes a new law, the California Privacy Rights Act, which will close several loopholes in existing privacy regulation and make it easier in some circumstances for people to opt out of having their data collected or processed.
To make sure companies follow the rules, the ballot measure creates a state agency to enforce the law, expanding the enforcement power that had been limited to the attorney general’s office. These changes will go into effect in 2023.
“We are at the beginning of a journey that will profoundly shape the fabric of our society by redefining who is in control of our most personal information and putting consumers back in charge of their own data,” Alastair Mactaggart, chair of Californians for Consumer Privacy and Proposition 24 sponsor, said in a statement.
The new privacy law brings California more closely in line with the European Union’s General Data Protection Regulation, and as the strongest law in the U.S. is likely to serve as the standard for companies across the nation. The next step in its implementation is assembling the new agency’s five-seat board, which will be appointed by the governor, state attorney general, state Senate rules committee, and speaker of the state Assembly.
Companies will be watching the composition of the board closely, said Lindsey Tonsager, who leads the West Coast privacy and cybersecurity practice for law firm Covington & Burling. “There is going to be a lot on the line depending on how this newly constituted board decides to interpret and enforce the new requirements of the CPRA,” Tonsager said.
Despite the ballot measure itself clocking in at 52 pages of dense technical language, many of the practical details of compliance and enforcement remain to be hashed out.
Many businesses will be affected by the law — from tech giants such as Facebook and Google to obscure ad brokers and small online businesses — but few came out as vocal opponents of the ballot measure. Companies had more pressing issues on their plates: The coronavirus lockdowns led to a devastating summer for the online advertising industry.
The strongest opposition to the ballot measure came from an unexpected quarter. A number of consumer rights and privacy advocacy groups, such as the American Civil Liberties Union and Consumer Federation of California, came out against Proposition 24, saying that it’s a step backward for privacy in some places and a missed opportunity in others.
Opponents pointed to a “pay-for-privacy” section that allows companies to charge users more for their services if they opt out of data-sharing. Privacy advocates also said the ballot measure should have allowed anyone to sue rule-breaking companies, rather than limiting enforcement to state officials, and that the initiative should have created a system in which users opt into having their data collected and sold, rather than opting out.
The ballot measure is intended to strengthen California’s landmark data privacy law — so why are privacy groups against it?
Campaign spending was heavily weighted in support of the ballot measure. The measure’s motivating force and largest proponent, Mactaggart, put up $5 million to support Proposition 24 himself, which represents nearly all of the money funneled into this race. Opponents contributed $45,000 total to oppose the measure, which came from the Consumer Federation of California and the progressive California Nurses Assn.
Privacy emerged as a key issue in the wake of the 2016 election, when a series of scandals, including hacks of the Democratic Party’s email servers and Cambridge Analytica’s political ad-targeting via deceptive Facebook quizzes, laid bare the significance of online data harvesting and data security.
The California Consumer Privacy Act stems from a conversation that Mactaggart, a Bay Area real estate developer, had in 2017 with a Google engineer at a cocktail party in the hills above Oakland. The engineer explained how the online advertising industry tracked users’ location, spending habits and political views to sell more valuable, targeted ads.
Mactaggart decided that something had to be done and wrote a ballot measure. When the initiative had gathered enough signatures to qualify for the ballot in 2018, the state Legislature moved to intervene. In a few frenzied weeks of bargaining and bill drafting, Sacramento produced the CCPA, which went into effect at the beginning of this year.
But as soon as the ink was dry on the new law, Mactaggart and Bob Hertzberg, the state Senate majority leader representing Van Nuys who had helped shepherd it through the Legislature, concluded that it had a number of major flaws. The attorney general’s office also made clear that it did not have the staff or expertise necessary to effectively enforce a law that aimed to police the entire internet. And over the course of 2019, companies subject to the law pushed for bill after bill to undermine its basic principles.
Proposition 24 was their bid to reinforce the foundation that they laid with the CCPA. The new law’s true effect will be difficult to measure before it goes into effect in 2023, but even the measure’s opponents see its success as an indicator that California’s voters have an appetite for stronger privacy protections.
“Now is the time for the California Legislature to build on Proposition 24,” ACLU attorney Jacob Snow said in a statement, “to make sure that companies get permission before using or sharing our personal information, prohibit companies from charging us more for exercising our fundamental rights, and impose substantial consequences on companies that break the law.”
