1 In Business: New California privacy law goes into effect Wednesday, but companies are interpreting compliance in different ways.
Some confusion over new California mandate
Millions of people in California are now seeing notices on many of the apps and websites they use. “Do Not Sell My Personal Information,” the notices may say, or just “Do Not Sell My Info.”
But what those messages mean depends on which company you ask.
Stopping the sale of personal data is just one of the new rights that people in California may exercise under a state privacy law that takes effect Wednesday. Yet many of the new requirements are so novel that some companies disagree about how to comply with them.
Even now, privacy and security experts from different companies are debating compliance issues over private messaging channels like Slack.
The provision about selling data, for example, applies to companies that exchange the data for money or other compensation. Evite, an online invitation service that discloses some customer information for advertising purposes, said it would give people a chance to opt out if they do not want their data shared with third parties. By contrast, Indeed, a job search engine that shares users’ resumes and other information, posted a notice saying that people seeking to opt out “will be asked to delete their account.”
The issue of selling consumer data is so fraught that many companies are unwilling to discuss it publicly. Redwood City’s Oracle, which has sold consumer information collected by dozens of thirdparty data brokers, declined to answer questions. TMobile, which
has sold its customers’ location details, said it would comply with the law but refused to provide details.
“Companies have different interpretations, and depending on which lawyer they are using, they’re going to get different advice,” said Kabir Barday, chief executive of OneTrust, a privacy management software service that has worked with more than 4,000 companies to prepare for the law. “I’ll call it a religious war.”
The new law has national implications because many companies, like Microsoft, say they will apply their changes to all U.S. users rather than give Californians special treatment. Federal privacy bills that could override the state’s law are stalled in Congress.
The California privacy law applies to businesses that operate in the state, collect personal data for commercial purposes, and meet other criteria like generating annual revenue above $25 million. It gives Californians the right to see, delete and stop the sale of the personal details that all kinds of companies — app developers, retailers, restaurant chains — have on them.
“Businesses will have to treat that information more like it’s information that belongs (to), is owned by and controlled by the consumer,” said state Attorney General Xavier Becerra, “rather than data that, because it’s in possession of the company, belongs to the company.”
Some issues, like the practices that qualify as data selling, may be resolved by mid2020, when Becerra’s office plans to publish the final rules spelling out how companies must comply with the law. His office issued draft regulations for the law in October. Other issues may become clearer if the attorney general sues companies for violating the privacy law.
For now, even the biggest tech companies have different interpretations of the law, especially over what it means to stop selling or sharing consumers’ personal details.
Google recently introduced a system for its advertising clients that restricts the use of consumer data to business purposes like fraud detection and ad measurement. Google said advertisers might choose to limit the uses of personal information for individual consumers who selected the don’tsellmydataoption — or for all users in California.
Facebook, which provides millions of sites with software that tracks users for advertising purposes, is taking a different tack. In a recent blog post, Facebook said “we do not sell people’s data,” and it encouraged advertisers and sites that used its services “to reach their own decisions on how to best comply with the law.”
Uber responded to Facebook’s notice by offering its users around the world the ability to opt out of having the ridehailing service share their data with Facebook for ad targeting purposes.
“Although we do not sell data, we felt like the spirit of the law encompassed this kind of advertising,” said Melanie Ensign, head of security and privacy communications at Uber.
Evite, the online invitation service, decided in 2018 to stop selling marketing data that grouped its customers by preferences like food enthusiast or alcohol enthusiast. Since then, the company has spent more than $1 million and worked with two firms to help it understand its obligations under the privacy law and set up an automated system to comply, said Perry Evoniuk, the company’s chief technology officer.
Although Evite no longer sells personal information, the site has posted a “do not sell my info” link. Starting Wednesday, Evoniuk said, that notice will explain to users that Evite shares some user details — under ID codes, not real names — with other companies for advertising purposes. Evite will allow users to make specific choices about sharing that data, he said. Customers will also be able to make general or granular requests to see their data or delete it.
“We took a very aggressive stance,” Evoniuk said. “It’s beneficial to put mechanisms in place to give people very good control of their data across the board.”
Companies are wrangling with a part in the law that gives Californians the right to see the specific details that companies have compiled on them, like precise location information and facial recognition data. Residents may also obtain the inferences that companies have made about their behavior, attitudes, activities, psychology or predispositions.
Apple, Facebook, Google, Microsoft, Twitter and many other large tech companies already have automated services enabling users to log in and download certain personal data. Amazon said it would introduce a system to allow all customers of its U.S. site to automatically download their records.
But the types and extent of personal data that companies currently make available vary widely.
Apple said its privacy portal allows people whose identities it can verify to see all of the data associated with their Apple IDs — including their App Store activities and AppleCare support history.
Microsoft said its selfservice system enables users to see the most “relevant” personal information associated with their accounts, including their Bing search history and any interest categories the company had assigned them.
San Francisco’s Lyft said it would introduce a tool Wednesday allowing users to request and delete their data.
A reporter who requested data from the Apple portal received it more than a week later; the company said its system might need about a week to verify the identity of a person seeking to see their data.
Microsoft said it was unable to provide a reporter with a list of the categories it uses to classify people’s interests. And Lyft would not say whether it will show riders the ratings that drivers give them after each ride.
Experian Marketing Services, a division of the Experian credit reporting agency that segments consumers into socioeconomic categories like “platinum prosperity” and “tough times,” is staking out a tougher position. In recent comments filed with Becerra’s office, Experian objected to the idea that companies would need to disclose “internally generated data about consumers.” Experian did not return emails seeking comment.
The wide variation in companies’ datadisclosure practices may not last. California’s attorney general said the law clearly requires companies to show consumers the personal data that has been compiled about them.
“That consumer, so long as they follow the process, should be given access to their information,” Becerra said. “It could be detailed information, if a consumer makes a very specific request about a particular type of information that might be stored or dispersed, or it could be a general request: ‘Give me everything you’ve got about me.’ ”