California’s Privacy Law Goes Into Effect Today. Now What?
The CCPA applies to any company that operates in California and either makes at least $25 million in annual revenue, gathers data on more than 50 thousand users, or makes more than half its money off of user data. For California residents, it creates a handful of new rights over their data. The most significant categories are what Alastair Mactaggart, the California real estate magnate behind the ballot initiative that led to the law being passed, calls “the right to know” and “the right to say no.” That means users will, as of today, be able to see what data companies have gathered about them, have that data deleted, and opt out of those companies selling it to third parties from now on.
Well, WIRED doesn’t exactly “sell” your data right now—no one is giving us cash (or withholding military aid, for that matter) in exchange for dirt on our readers. But, like just about every site on the internet, we track your behavior—what articles you read, for how long, etc.—on Wired.com using cookies. We use that data internally for research and site improvements, but the information can also go to a third-party vendor, like Google AdSense, which combines it with similar data from other sites to create user profiles that advertisers can target. The infamous shoe ad that follows you across the internet long after you close out your Zappos tab? That’s how it works—and advertisers pay extra for the privilege of this personalized ad targeting.
The law grants Californians the right to sue companies for failing to take reasonable precautions to prevent data breaches. But apart from that, making sure companies comply with the CCPA is the sole province of the Attorney General’s office, which has indicated that it will only have the bandwidth to bring a handful of cases each year.
The initiative would create an independent agency focused just on the privacy law, with the power to audit companies for compliance. It would also restrict the legislature from watering the law down in the future—a serious concern given the amount of industry lobbying that has already taken place.