The landmark California Consumer Privacy Act (CCPA) is the only US-based online privacy law that gives consumers the right to access, delete, and stop the sale of their information — key rights that are particularly important in the context of federal inaction on privacy. But the promise of the CCPA has yet to be realized. Google, Facebook, and other companies have unilaterally declared that consumers can’t opt out of their harvesting data on other websites. As Consumer Reports has recently documented, this has interfered with consumers’ ability to exercise their privacy rights. And, despite the efforts of key political leaders in Sacramento, the legislature has failed to fix loopholes and strengthen the Act.
The proponents of the CCPA have put forward a new initiative, Prop. 24, to address some of the significant problems with the law’s implementation. As detailed in our previous analysis, the measure is not perfect, and until this point we have declined to take a position on the bill. After further study of the CCPA’s effectiveness, lack of successful action in the legislature, and a deep analysis of the proposition, we determined that the best option is for consumers to vote “yes.” It would close up some of the worst loopholes that companies have exploited to deny consumers’ opt-out requests, better ensuring that consumers can exercise their privacy rights. And we’ll continue to fight for even more safeguards, so that by default, consumers’ privacy is protected online.
Prop. 24 ensures that:
- Consumers can opt out of behavioral advertising. Under Prop. 24, once opted out, Google and Facebook can’t share your information with third parties to show you targeted ads. Nor can they claim that hundreds of adtech companies are “service providers” and exempt from the opt out. This is the core protection of the CCPA, but many companies have ignored it. Consumer Reports has called on the Attorney General for over a year to address this issue, but thus far they have failed to take action.
- No more “get-out-of-jail-free” card in the CCPA. Enforcement is essential to ensure that companies comply with the law, but the CCPA currently includes a provision, known as the “right to cure,” that prevents the Attorney General from taking action for violations if the company “cures” the issue in 30 days. This saps the AG’s meager enforcement resources and could incentivize companies to violate the law. Prop. 24 would remove this provision. Consumer Reports supported AG-sponsored legislation, SB 561 (2019), to remove the right to cure, but the bill ultimately failed to advance.
- Companies can’t trick you into sharing more data than you intended. Under the CCPA, kids under 16 have opt-in rights for the sale of their information to third parties — meaning that companies have to obtain prior permission to sell their information. Prop. 24 would ensure that companies can’t trick kids or their parents into providing consent through deceptive user interfaces known as “dark patterns.” This could help set an important legislative precedent, as companies have pushed back hard against efforts to rein in dark patterns. For example, tech industry groups opposed a CR-supported genetic privacy bill in California, SB 980 (2020), on the grounds that it would prohibit dark patterns (the bill was ultimately vetoed by Gov. Newsom).
- Prevents the legislature from weakening the CCPA. Prop. 24 holds that amendments can only be made if they are in keeping with intent of the measure. Based on the 2019 legislative session, in which industry introduced over a dozen bills to weaken the CCPA (and engaged in heavy lobbying in the last days of the legislative session, pushing for last-minute amendments), this could provide an important backstop against future industry efforts to undermine the CCPA.
Prop. 24 has generated opposition from a number of consumer and privacy groups, some of them our closest allies. We don’t break with them lightly and we agree that there are additional steps that must be taken to ensure CA consumers can fully exercise their right to privacy. We agree with opponents that certain of the new exemptions in Prop. 24 will cut against the progress made in this initiative. For example, the new definition of service provider explicitly gives these companies (which could be any company, including Facebook, or Google, or Netflix) the right to combine data they’ve collected from different clients, which is unnecessary and contrary to privacy interests (though arguably, this is already permitted under the CCPA). The exemption for publicly available information is significantly expanded under Prop. 24, which could make it even harder for consumers to access or ask data brokers to delete information scraped from the web (although this is already a problem under the CCPA). However, these changes should not be viewed in a vacuum. On the whole, consumers will have significantly stronger protections under Prop. 24 than under CCPA.
We disagree with opponents that the initiative will weaken protections with respect to pay-for-privacy schemes. Under the CCPA, as under Prop. 24, companies could provide consumers incentives for sharing their data with third parties, which is inappropriate. Privacy is a right, and consumers shouldn’t be charged for exercising their privacy rights. However, our analysis indicates that Prop. 24 does not meaningfully change the CCPA in that respect. Loyalty programs, and providing incentives for sharing information, are permitted by the CCPA. Prop. 24 missed an opportunity on pay-for-privacy, but is not a step backwards — and we will keep working with the California legislature to ensure that privacy doesn’t come with a price tag.
Prop. 24 is a step forward, but it isn’t the end goal. Ultimately, consumers deserve a strong privacy law that prohibits data sharing by default, without leaving it to the consumer to figure out how to submit an opt-out request. Consumer Reports will keep up the fight until all consumers have stronger protections. But Prop. 24 offers significant benefits to consumers seeking to protect their privacy online. This initiative will help to ensure that California consumers can stop some of the most privacy-invasive behaviors posed by the adtech ecosystem. To protect their right to privacy, Californians should vote yes on the measure, and we look forward to working together to continue to push for even stronger privacy protections in California, and throughout the nation.
