Aurich Lawson / Getty Images
When state Senator Bob Hertzberg learned that an ambitious privacy initiative had received enough signatures to qualify for the California vote, he knew he had to act quickly.
"My goal," he says, "was to get the damn thing off the hook."
It was the spring of 2018. The emerging Cambridge Analytica scandal on Facebook had shed light on the data-gathering practices of tech giants and sparked calls for greater consumer privacy. The initiative was launched by Alastair Mactaggart, a wealthy real estate developer in San Francisco, who got the idea in the shower in 2015 and financed the effort out of pocket. Mactaggart hired his neighbor Rick Arney and Mary Stone Ross, a former CIA analyst and attorney, to work out the election measures. Nobody had any background on data protection or anything related to the tech industry.
"Nobody knew who Alastair was," says Hertzberg, a long-time member of California politics, whose district includes parts of Los Angeles. “Who is this guy and where is he from? All of a sudden he writes a check, spends a few years doing some homework and doing an election initiative. “If enough voters were to vote in favor of the initiative in the autumn, extensive new regulations would be introduced that could only be changed if the legislature were to raise a majority of 70 percent.
The prospect alarmed Hertzberg and some of his colleagues. "The reason we thought it was horrible wasn't because he didn't do a lot of good things for consumers. Of course he did. But he set a 70 percent threshold. And in my world there is one Threshold of 70 percent of the other party basically all power. "
Much better, he thought, to address the privacy issue through the legislative process. So Hertzberg reached out to Mactaggart with a deal: work with him to draw up an invoice and then withdraw the electoral initiative once it's passed. Mactaggart agreed. In June of this year, after a few months of intense negotiations, the legislature unanimously passed the California Consumer Protection Act. It was the country's most ambitious data protection law – but it quickly proved to be inadequate. The hasty and controversial drafting process left enormous legal loopholes and did not provide the resources necessary for its own enforcement. Legislators introduced bills in early 2019 to address these shortcomings before the law came into force but achieved nothing. (There were also a number of bills that tried and failed to push the law back further.)
About a year after the CCPA was passed – but before it came into force – Hertzberg, who had been the majority leader in the California Senate until then, presented a new idea to Mactaggart. In complete reversal of his previous position, Hertzberg asked Mactaggart to bypass the legislative process. Instead, he should fund and design a new electoral initiative to improve the CCPA. And this would not be a negotiation chip. It would get to a vote by the people of California. This is how the California Privacy Rights Act came about, and will appear as Proposition 24 on Californians' ballots this fall.
"We have to go back to the vote"
"The only way to do this is if we have to go back to the vote," Hertzberg recalls. The legislation looked like a dead end. “Because we made mistakes in CCPA – not terrible mistakes, but mistakes – all business people have damaged our credibility. The people in Washington said, "You see, California doesn't know what they're doing." Given the timing and speed, we realized we needed to take another initiative. "
Hertzberg's flip-flop on the election initiative is just one way Proposition 24 has messed up the political dynamics in California. The initiative has also shared privacy advocates who previously fought on the same side. Mactaggart's former ally Ross leads the opposition and has hired allies including the American Civil Liberties Union and consumer groups. "The CCPA was much weaker than the (original) initiative, but at the same time it was and is the strongest consumer protection law in the nation," she says. "And this initiative weakens it."
Whenever regulation is on the table, members of the industry concerned can be expected to stand in opposition. However, privacy advocates who oppose a privacy initiative are less intuitive. How did Proposition 24 turn these alliances on their head? The answer is: it's complicated. Not just the situation, but the measure itself.
You can't understand Proposition 24 without first understanding how lame the CCPA was.
The law should give Californians the right to know what data companies are collecting about them, refuse to sell that data, and get companies to delete the data they have already collected. However, these rights are largely theoretical, thanks to a handful of missteps by the drafters of the law. First, the CCPA states that users have the right to opt out of “selling” their data. However, technology firms argue that many transfers of user information that raise privacy concerns are no sales at all because nobody pays for data: websites typically share user data with third parties like Facebook to sell subscriptions and advertisements more effectively.
"We did all of this work and Google can still hold all of your information. Facebook can still put a pixel on a website."
Second, the CCPA included an exception for "service providers" who need user data to fulfill a "business purpose". Companies like Facebook and Google have taken up this language and argued that they offer the micro-targeted advertising service. Taken together, the two provisions essentially exempt targeted advertising from the Data Protection Act – which, given the centralized advertising for online tracking of users, is a bit like exempting coal-fired power plants from a clean air bill.
"Sales and service providers are two big loopholes that companies are exploiting right now," said Justin Brookman, director of consumer protection and technology policy at Consumer Reports. "If you say 'don't sell' today, a lot of companies are doing nothing."
Mactaggart criticizes the fact that, in his opinion, tech lobbyists have managed to include the service provider's clause in the bill. "I caught a few things that you tried, but I didn't catch these." As a result, when it comes to narrowing down the biggest sources of online tracking, he says, "We literally did nothing. We did all this work and Google can still hold all of your information, Facebook can still put a pixel on a website All they have to do is have a contract with this website and one of the business purposes is "promotion and marketing" and boom. "
The other major CCPA shortcoming is enforcement. The law's original election initiative would have allowed any Californian to sue a company that violated its regulations – a so-called private right of action. But this provision, which technology companies strongly opposed, was killed in the negotiation process. In the end, the law gives the attorney general the exclusive power to enforce it. (Ross disapproved of this concession so bitterly and gave up the 70 percent threshold that she and Mactaggart stopped talking.)
Enter the Attorney General
"One decision we made was that we would only give the California attorney general the authority to oversee this," says Hertzberg. This position is currently held by Xavier Becerra, a fellow Democrat. "I thought I was doing him a great favor by giving him the power to ultimately decide all these questions in private," says Hertzberg. In fact, Becerra has said his office only has the resources to bring in a handful of cases a year. Even if he had more, the law allows companies to avoid penalties for "curing" a violation that is reported. There is little reason for companies to take this very seriously.
Data from the first six months of the law's existence suggests it hasn't changed the privacy game for consumers too much, either. According to an analysis by DataGrail, a company that helps businesses comply with data protection laws, there were only 82 requests to sell in that time, not for every million consumer records.
The point of sentence 24 is to mend the holes that are currently making the CCPA a leaky privacy jar. If approved by California voters, the initiative would change the “do not sell” legal requirement to “do not sell or share” to allow for unpaid data transfers, and clarify that targeted advertising is not a “business purpose” This frees companies from complying with user opt-outs. It also aims to improve enforcement by asking lawmakers to allocate $ 10 million annually to an entirely new privacy agency. And in contrast to the 2018 election initiative, Proposition 24 allows lawmakers to make future changes by simple majority – but only if those changes improve rather than weaken the goals of the law.
"We're not trying to create a new ceiling, we're trying to raise the floor," said Andrew Yang, the former presidential candidate. Yang, Chairman of the Advisory Board of Mactaggart's Californians for Consumer Privacy, is one of several prominent supporters of the initiative alongside Congressman Ro Khanna and technology theorist Shoshana Zuboff. “It prevents tech companies from watering down the CCPA and rendering it toothless. And it is up to us all how we want to develop people's data protection and data rights further. If it doesn't have everything you want awesome – let's put this in place and then stand up for something else that will further raise the floor. "