Welcome to 2020!
Today the California Consumer Privacy Act which was enacted in 2018 becomes effective. However, enforcement of the law is not expected until summer. Part of this delay is due to the fact that the Attorney General of California, who is responsible for enforcement has yet to release the finalized regulations, leaving businesses to prepare based on the proposed regulation and text of the bill.
As a result, a few things have become clear.
- December 2018 saw an avalanche of privacy policy updates for consumers, alerting them to changes in the policy in order for the companies to comply with changes due to the pending law becoming effective.
- The California Attorney General still needs to release finalized regulations to allow companies to properly align their business with the law as expected. In the mean time you can review the current status of the rule making on the government website.
- Many companies are not ready to comply with the law, as outstanding questions remain pending resolution of certain key concepts such as ‘Do Not Sell’ being understood differently by legal experts. The Verge did a good writeup on this point. As the New York Times put it – “No one agrees” on what it means to be compliant.
- We have companies predicting the future legal landscape, such as Microsoft, announcing plans to honor the core concepts of the CCPA across the USA.
- We have companies such as Facebook trying to cast themselves as ‘service providers’ and stating they already comply with the law and they won’t need to make changes to their web tracking. Vox consulted several legal experts who don’t think this will work in the context of CCPA, likely setting up Facebook for a battle with the Attorney General in 2020. While the AG’s budget is limited as NPR reports, I would venture it’s a good bet that the largest tech companies – such as Facebook are the most likely to face legal action in 2020.
We’re likely to see the first half of the year clarify some of the outstanding questions regarding the CCPA prior to enforcement starting. We’re also likely to continue to see other states introduce bills that mirror the CCPA, with a strong possibility of having a patchwork set of laws in place across the country failing any federal law being passed.
A federal bill was not adopted in 2019, despite both the House and Senate holding hearings on it, as no one can agree what it should actually do. As a result – the CCPA may become the de facto law adopted by businesses until Congress resumes in 2020 and manages to get a bill passed. I think this will likely be a major talking point this year as several presidential candidates have already released positions on the topic of Online Privacy so it’s bound to be a reoccurring theme this year in the run up to the election.
While we’re working out the CCPA and other legal concerns, the technical landscape will continue to shift. Over the next few months we’ll see Microsoft’s Edge browser start blocking various trackers by default. We’ll see Google enable changes to cookie handling in Chrome, which can affect advertisers. I’d also venture it’s a safe bet to realize Firefox and Safari will push their own privacy initiatives further in 2020.
Companies will on one side battle with the legal frameworks being put into place and on the other have to deal with browsers changing what data they can collect, and add in edge cases which make certain types of data questionable to use for any business critical context. We’re likely to see this play out in marketing, analytics, and modeling efforts going forward. Hopefully companies have been thinking about this and are not going to be caught flat footed.
It is a new year and a new world. Analytics collection and analysis will have to adjust and adapt to the changing legal and technical landscape in much the same way they did for the EU’s General Data Protection Regulation. Now we see who was ready for CCPA, who ends up fined and who gets crushed under a wave of Disclosure, Delete and “Do Not Sell” requests.
You could say that it will be an interesting year coming up at the very least.