A Privacy Measure That’s Hard to Like

In 2018, California lawmakers passed a data privacy bill that gave consumers back some control over the reams of personal information they share with tech firms. The legislation became a model for the rest of the country.

But less than a year after the law, known as the California Consumer Privacy Act, took effect, it is showing some cracks. Charged with enforcing the law, the state attorney general’s office said it can handle just a few cases per year and that tech companies have exploited loopholes.

Californians now have the chance to vote on an initiative, Prop 24, that is meant to update the law by giving consumers more control over how companies use their data and by establishing a new enforcement agency.

Home to the headquarters of Facebook, Google and Apple, California has the opportunity and a responsibility to continue leading the way on consumers’ online privacy. Unfortunately, Prop 24’s well-intended advancements are clouded by business-friendly concessions that make the initiative hard to fully support. Voters should reject Prop 24 and hold out for a less muddled solution that both closes the law’s loopholes and sets a proper baseline standard for other states.

The proposal has split groups that otherwise would be able to offer voters guidance. Pushing for a yes vote are Common Sense Media and the N.A.A.C.P.’s California unit, while those who oppose it include the American Civil Liberties Union and Public Citizen. The Electronic Frontier Foundation took a neutral position.

Adding to the intrigue, two members of the team who helped write the privacy law are now on opposing sides of the Prop 24 fight. With just about $6 million raised in support of the proposition, it’s nowhere near California’s most costly ballot initiative — one addressing gig workers’ employment status is approaching $200 million — but its impact could be felt far beyond the state.

Prop 24 helps solve the enforcement piece of the privacy law with the creation of a stand-alone agency, initially funded with $10 million, to issue fines or citations to companies that abuse consumers’ data and pursue penalties over violations. City and district attorneys also would also be newly enabled to sue companies over violations under Prop 24, said Jim Steyer, head of Common Sense Media. A dedicated enforcement arm would take the burden away from the state attorney general’s office, though $10 million seems awfully low.

Current law entitles Californians to demand companies turn over the personal data they collect about them and to halt the sale of that information. Prop 24 would broaden what data can be and how it could be used, particularly sensitive details such as race, sexual orientation and location. Notably, it gives Californians the right to seek to prohibit sharing of their data, as opposed to just prohibiting its sale — a loophole tech firms have been using to keep distributing personal information.

But, in what appears to be a concession to business interests, Prop 24 would not make opting out of data collection the default — meaning consumers would have to go through dozens or hundreds of websites to register their preferences on data harvesting, say opponents. An opt-in default for data collection should be a baseline for consumer privacy protections.

Jacob Snow, a lawyer with the A.C.L.U. of California, pointed to a provision in Prop 24 that adds shopper loyalty clubs to the list of entities that can withhold discounts for customers who ask that personal data be withheld from collection. He said that amounts to a tax on lower-income consumers, who may feel more pressure to effectively sell their data in exchange for discounts. And the measure may allow businesses to gobble up data from devices once Californians leave the state, he said.

Also missing from Prop 24 is what’s known as a private right of action, meaning consumers aren’t given explicit permission to sue directly over privacy violations, leaving that largely up the new agency.

Generally tech firms oppose broad privacy regulations because such measures hamper their ability to sell the lucrative targeted advertising that is the underpinning of free services like Google and Facebook. To try to outsmart regulators, tech companies have dreamed up new services like voice assistants that may be a step ahead of existing laws.

But voters won’t find any clarity from the tech companies that would be most affected by Prop 24. None have come out for or against the measure. It’s politically fraught on both sides — Big Tech publicly supporting it is tantamount to declaring the proposition insufficiently strong, whereas opposing it would be viewed as protecting the tech companies’ own interests.

Voters also seem ambivalent about Prop 24, which at 52 pages is more difficult to parse than even tech companies’ legalese-laden privacy policies. Some Californians are organizing “prop parties” over video chat for friends and family to research this and other ballot initiatives and present arguments on both sides.

California can and should lead the way for the rest of the nation on privacy, but if there is any hope for a federal law, it needs to be easier for voters to understand and needs to be unambiguously pro-consumer.

The existing California privacy law isn’t a panacea, but it took a big leap forward for consumer privacy. Ensuring the loopholes are closed should be a goal, but not at the cost of opening up new ones.

The Times is committed to publishing a diversity of letters to the editor. We’d like to hear what you think about this or any of our articles. Here are some tips. And here’s our email: [email protected].

Follow The New York Times Opinion section on Facebook, Twitter (@NYTopinion) and Instagram.

Leave a Reply

Your email address will not be published. Required fields are marked *

Back to top button