CCPA goes into effect January 1, but nobody’s sure how the new rules work

https://www.latimes.com/business/technology/story/2019-12-26/california-internet-data-privacy-law

by rschnalzer • 7 years ago

50 124 7 years ago

latimes.com

EGreg• 7 years ago

Where is a good overview of these laws?

CharlesW• 7 years ago

I searched for "CCPA FAQ", and here are two I read that were useful:

https://docs.microsoft.com/en-us/microsoft-365/compliance/cc...

https://www.adweek.com/programmatic/everything-you-need-to-k...

zbjornson• 7 years ago

The regulation itself is very short: https://leginfo.legislature.ca.gov/faces/codes_displaySectio...

thescriptkiddie• 7 years ago

Good.

derision• 7 years ago

It's good that one state can force it's hand over the other 49?

threatofrain• 7 years ago

It's good that each state should be able to go off and do its own experiment. IMO the state rules which are the most smelly are those over taxes and non-disclosure of financial information.

jasonhansel• 7 years ago

Yes.

epc• 7 years ago

It's good that each state can determine the laws applicable in its jurisdiction. If you don't want to comply, don't do business in California.

tomc1985• 7 years ago

When the other 49 stand still and do nothing regarding the business-data-orgy-that-needs-to-end, yes

Data should never have been a gold rush and we should be more keen to kill it

robbrown4515• 7 years ago

Personally I think it is appropriate. California has long been known to do such things, for instance having different requirements for cars regarding emissions.

In general I think California is using their huge size and role (obviously, as home to most of the dominant internet companies like Google and Apple and Facebook) to push the rest of the country forward.

moomin3• 7 years ago

They can always run a different website in other states. This is basic exercise of state’s rights.

r00fus2• 7 years ago

This single state contains Silicon Valley and is 14% of the US economy. Jurisdictionally, it could be challenged - but again, a business could just decline to do business with all customers in CA.

btw - nothing new here (fta): "Big companies are signing deals with firms that specialize in compliance".

Big companies already hire compliance companies for a large number of other regulatory requirements. This is just yet another such requirement - and it's still being hammered out in a public comment period prior to going into law.

Gibbon1• 7 years ago

We can start the conversation with state usury laws.

dang2• 7 years ago

Maybe so, but please don't post unsubstantive comments to Hacker News.

username90• 7 years ago

How are these different from GDPR? Most global companies should already have most of this in place, so it will just hurt the small businesses which has yet to expand outside the states. Is there some limit to company size here to avoid that?

pkaye• 7 years ago

The CCPA only applies to companies with more than $25 million in revenue or access to the personal information of more than 50,000 people.

sillysaurusx• 7 years ago

50,000 is not a lot. If you set up a YouTube competitor and the view counter on a video has more than 50,000 views, do you qualify? What if you use cookies? It’s a personal ID of all 50,000 viewers.

esotericn2• 7 years ago

You mean like all of the US news sites that just firewall off EU citizens at the moment?

BrandoElFollito• 7 years ago

I do not understand why they do that.

If a US news outlet has no presence in the EU there is nothing which can be done if they do not follow EU rules.

bsder2• 7 years ago

Then start an EU competitor that doesn't--most US news sites are simply repackaging content anyway.

You should clean up, no?

PeterisP• 7 years ago

For starters, one thing that the big global companies did was carefully internally segment EU/non-EU users so that they make the technical implementation and business processes to comply with GDPR, but apply these things only when necesseary, and keep the data processing of their (very profitable) USA users the same. A small or medium website most likely went either with privacy-for-everyone or ignore-the-GDPR, but any large global company can afford separate flows and has large enough financial incentives in mining that data so that it makes sense to differentiate.

For example, Equifax has a bunch of subsidiaries in EU who have to follow GDPR - and mostly are following it, or at least make a decent show in attempting so; but the main USA Equifax business could not bother with it, to great benefit of Equifax itself and detriment of all the USA citizens whose data Equifax mismanaged.

csydas• 7 years ago

Most companies do not comply with GDPR, and it's not about the minutia, it's about just very basic concepts regarding user data and privacy.

I'm a US expat and honestly its extremely frustrating to try to use sites I formerly was able to access (with µblock) due to either absolutely obtrusive and confusing opt-in/out policies (e.g., Oath) or complete rejections/refusal of anyone with an IP outside the US (this is exceptionally frustrating as I don't even live in the EU, but because the lazy solution of applying the GDPR block to any non-US address is often used, I cannot read many US new sites)

Global companies have __not__ adapted to GDPR, and instead have just dragged their feet. I'm curious if the EU is going to do anything about it for sites that frequently do business in the EU, or if they will start enforcing actual GDPR policies on the big players (for example, Google is a beast to use in any EU member nation if you choose not to grant consent for data collection by just using element blocking)

The idea that companies have complied with GDPR does not mesh with my experience actually trying to use websites in the Schengen Area. And I don't blame GDPR, I blame companies for the insane amount of data and tracking they want for viewing even a minute amount of content.

xenospn2• 7 years ago

This article makes it sound like this entire industry wasn’t deliberately set up and developed by corporations for years. They know exactly what they’re doing and they know exactly how to turn the whole thing off.

romanovcode• 7 years ago

they know exactly how to turn the whole thing off.

The problem is that no, they don't. Companies wrote infrastructure on premise that user would never ask/get/delete the info that is stored on him/her therefore now it's really difficult for companies to actually gather/delete data that is tied to a specific user in a safe matter.

manigandham14• 7 years ago

What entire industry? The internet affects everyone.

xenospn2• 7 years ago

The industry that sells your info to the highest bidder.

riffic• 7 years ago

Why use an abbreviation in the title when it wasn't used in the latimes.com headline? 'CA' on its own is ambiguous.

anonymfus2• 7 years ago

Because titles here are limited in length to 80 characters.

anonymfus2• 7 years ago

I would just remove the articles. So my version: "California is rewriting rules of internet. Businesses are scrambling to keep up". Does it look better or worse?

asdf21• 7 years ago

I was sure it was Certificate Authority.

dang2• 7 years ago

Submitted title was "CA is rewriting the rules of the internet. Businesses are scrambling to keep up". We've changed it now.

naringas• 7 years ago

so that's why I have been getting so many privacy policy updates

ailideex7• 7 years ago

I'm not confident that this is a good thing after the mess that resulted me in having to navigate dozens of cookie popups on most days.

dependenttypes6• 7 years ago

Never understood the cookie popups mess. I remember back in the ages of internet explorer it showed a popup when a site tried to use cookies, why do the sites need to implement the cookie popups rather than let the users configure it in their browsers?

oneplane2• 7 years ago

Because browsers make it an all or nothing setting (all, 1st party, none) and there are many more combinations. On top of that, the laws are there to prevent companies from tracking people at will, and the DNT header that was supposed to make that an easy browser setting completely failed.

manigandham14• 7 years ago

People don't understand or care about cookies maintaining state in browsers. It was complete folly for politicians to focus on them instead of actual personal data used.

GDPR rectified some of it but added much more granularity which is why cookie popups have now turned into giant selection windows.

cyphar2• 7 years ago

It's a classic example of a legislative loophole. What the cookie law was actually trying to do was provide a way for users to opt-out of cookie-based tracking. But, someone figured out that if you just ask for permission to use cookies (for any reason) and refuse service if the opt-out, you'd still be following the letter of law (but not the intent).

Arguably, this is one of the reasons why the GDPR was necessary.

FreakyT• 7 years ago

Agreed — CCPA makes the same primary mistake as GDPR, which is that while the spirit of the law (protecting users’ privacy) is reasonable, the ultimate consequence just ends up being bombarding users with popups, a worse UX for basically everyone.

To me, this indicates that the drafters of the law probably didn’t really think it through.

narag2• 7 years ago

This is not a good thing indeed, because it's terribly naive. Passing a law that more or less forbid huge companies the very same activity that gets them the bread and butter. What are they expecting to happen? That the companies will surrender their business, just as that?

ocdtrekkie• 7 years ago

Fundamentally, the solution to cookie warning spam is simple: Stop letting these companies disclaim their way out of unethical business practices. Start making those business practices illegal and shut down companies built around them.

Companies built on surveillance capitalism should be shut down. Full stop.

lidHanteyk3• 7 years ago

Yeah, that's basically how it should happen. In California, there's ample precedent for taking products off of the market when they're shown to harm consumers, and if that happens to kill off manufacturers who aren't diversified, then so be it. Are you really going to be sad if Facebook can't survive CCPA?

manigandham14• 7 years ago

A fundamental problem with CCPA (and GDPR and other similar state legislation) is the definition of personal information.

For example, IP addresses are not really personal, but including them as such creates layers of ambiguity that undermines other positive aspects of the law. It's the typical outcome of politicians not really knowing the domain they're affecting.

Also what's especially interesting is that CCPA was effectively bankrolled by a single person, which should raise some alarms about political power used by the people.

rudedogg2• 7 years ago

The CCPA only applies to companies with more than $25 million in revenue or access to the personal information of more than 50,000 people.

This is refreshing, I wish GDPR had a revenue threshold like this.

dependenttypes6• 7 years ago

Why is that? Surely if X is bad it should be bad for everyone rather than only for big companies.

helen___keller• 7 years ago

Policy trade-off. Small businesses can only do limited damage from a consumer privacy perspective. Navigating policy for small businesses can be toxic as they don't have teams of high powered lawyers, and considering California's startup industry the last thing policymakers want is to hurt small businesses. This is a compromise.

rudedogg2• 7 years ago

Surely if X is bad it should be bad for everyone rather than only for big companies.

I worry that regulations like GDPR benefit the existing monopolies, and make it too difficult/expensive for startups. The legal ambiguity of it, and the additional software requirements add a lot of roadblocks if you're a small company. I'd rather the burden be limited to established companies (but I guess that isn't quite fair either).

And for small/side projects, I just don't want to worry about this stuff.

throwaway2048• 7 years ago

It has an employee threshold, which is largely the same thing.

neonate• 7 years ago

http://archive.md/B9061

alkonaut5• 7 years ago

Regarding the GDPR:

95% of users choose to be tracked in exchange for access to websites and services

The GDPR explicitly disallows the practice of conditioning access to a site or service on acceptance. Without that it would be rather useless. Once that bit is also enforced (current fines for violation sadly week focused on poor data safety measures and similar) I think the online ad landscape actually may start to change.

ailideex7• 7 years ago

So if I run an online shop - and someone does not accept cookies - I still have to make it work for them somehow without cookies (or any equivalent technology)? Or am I misreading this? And if I'm not misreading this - how would you approach it?

alkonaut5• 7 years ago

No. Things you need to do to make the site/service function at all such as your login cookies or shopping carts don’t count. Non essential cookies is what it’s about.

Sadly, some sites seem to interpret that (incorrectly) as “well out business is to show news paid for by ads so the ad network cookies are essential”. These are the players I wish would be fined out of business.

SpicyLemonZest2• 7 years ago

I dunno, man. As you mentioned, all of the people who implement or enforce GDPR compliance seem to think that "our business model relies on ads" is a sufficient reason to require tracking. Maybe the regulators are just biding their time before pouncing, but I'm not sure why they'd want to do that or what they're waiting for after a year and a half. It seems more likely that GDPR as an ad industry killer was just a piece of HN lore that didn't end up panning out.

manigandham14• 7 years ago

It's more complicated than that for ads but GDPR is incredibly vague and contradictory to the point that it has major issues in effectiveness.

It can be costly to be in perfect compliance but nobody is really is afraid of GDPR risk anymore, especially since most internet companies are not in the EU anyway and are completely unaffected by regional legislation.

alkonaut5• 7 years ago

The wording was very clearly made to avoid any doubt about “we need to track people to survive on ads”. As I said I think it’s sad that so far the fines have been for data security and not yet for tracking-ads-without-opt-in.

I really do hope regulators will take a few high profile sites and make an example with a massive fine for blatant violations.

The rule is: if I visit a site then tracking is OFF until I switch it on. Seeing the content can’t be conditioned on accepting, and the default “ok close the popup and show me the article” should always result in the miminum cookies allowed - that is, typically no ad networks at all.

manigandham14• 7 years ago

No it doesn't. The "freely-given consent" clause is incredibly vague and cannot force a business to provide a value to consumers against their choice and/or for free.

There are also dozens of workarounds from legitimate use of data to contract-in-effect (like email newsletters). This is an example of the poor legislation aspects of GDPR and other privacy laws that are not based in technical reality.

gojomo• 7 years ago

Which will win the crown for destroying more Californian livelihoods & wasting more citizen time in 2020, CCPA or AB5?

(AB5 is the anti-freelancing bill whose intended targets, Uber & Lyft, may escape its application, while many other California freelancers have their traditional contract work patterns made illegal.)

unstatusthequo• 7 years ago

Some people understand it. We have dug in deep because companies are turning to us to interpret it. Here’s our resource to learn in case anyone is interested.

https://www.globalprivacywatch.com/tag/ccpa/

Note since these were originally published, the big thing that changed is that employees and employees of clients and vendors are now generally exempt from the CCPA. There is still a general notice obligation (think short privacy policy) for your employees, but that is about it. They also tightened up the FCRA and GLB exceptions, but those are not generally relied on by the majority of businesses out there.

vjktyu• 7 years ago

In its current form, ccpa is useless. The companies will just demand all personal data for any purpose or deny access.

joblessjunkie• 7 years ago

Under CCPA, businesses do not "demand" data because there is no restriction on its collection. Businesses simply need to provide notice of what they collect.

Consumers cannot opt out of this collection.

Consumers do have the option to opt out of having their personal information resold to third parties. The CCPA then specifically restricts businesses from withholding services or providing you with reduced services as penalty for this opt-out.

CCPA may not be perfect or even well-explained, but it's a first step in a positive direction within the United States. I think it's unfair to call it "useless".

RiOuseR• 7 years ago

Sounds like typical California legislation to me.

theshadowknows• 7 years ago

This is going to make a lot of class action lawyers even more rich than they already are. Just like TCPA is doing.

CCPA goes into effect January 1, but nobody’s sure how the new rules work

Related Stories