Answering the call of the California attorney general (AG), ad industry groups are voicing their concerns about the forthcoming California Consumer Privacy Act (CCPA), set to take effect in 2020.
Passed last year, the nation’s strictest consumer privacy and data protection measure requires covered entities to provide consumers with access to the data collected and the ability to opt out of the sale of their information to third parties, among many other changes.
The law also tasked the AG with creating and implementing regulations on issues such as definitions, exceptions and procedures. Earlier this year, AG Xavier Becerra asked stakeholders for input to help guide the rule-making, and his call was answered by the Association of National Advertisers (ANA), the American Advertising Federation (AAF), the Interactive Advertising Bureau (IAB), the American Association of Advertising Agencies (4As) and the Network Advertising Initiative (NAI).
“We strongly support the objectives of the [CCPA], but we have notable concerns around the likely negative impact on California consumers and businesses from some of the specific language in the law,” the groups wrote.
The ANA, AAF, IAB, 4As and NAI highlighted specific issues with the CCPA, including the scope of the personal information definition and the potential elimination of loyalty programs due to the nondiscrimination requirements.
In addition, the statute permits consumers to entirely opt out of the sale of their data or to have their data deleted, but the law does not explicitly permit a business to offer a consumer the choice to delete or opt out regarding some—but not all—of their data, according to the letter.
“We request that the AG clarify that businesses may offer reasonable options to consumers to choose the types of ‘sales’ they want to opt out of, the types of data they want deleted, or to completely opt out—and not have to just provide an all-or-nothing option,” the groups wrote. “Without clarification and adjustments, these and other ambiguities in the law could result in reduced choice and privacy for consumers, rather than expanding it, as the law intended.”
The letter also asked for clarification that businesses need not create individualized consumer privacy policies to comply with their requirement to disclose the specific pieces of personal information they have collected about each consumer, and urged the AG to recognize that a written assurance of CCPA compliance is sufficient and reasonable to satisfy the “explicit notice” requirement when a company sells a consumer’s personal data that the company did not receive directly from the consumer.
To read the letter from the ad industry groups, click here.
Why it matters: The series of forums to gather input on the CCPA has come to an end, but the Attorney General’s Office will continue to accept written comments until March 8. Regulations are expected to be released in the fall of 2019.