A crop of amendments to the California Consumer Privacy Act have been sent to the state Senate for a vote.
The bills, which aim to modify and clarify the regulation, were first approved in waves by the California Assembly throughout the month of May. The ones that receive the Senate’s eventual blessing will then head to the governor for his signature before being enacted into law.
Although these amendments are meant to explicate the hastily passed law, the timing is such – CCPA is slated to take effect on Jan. 1, 2020 – that there’s a possibility the changes will be ratified at just around the same time California Attorney General Xavier Becerra issues implementing regulations, said Gary Kibel, a partner at Gilbert & Davis LLP.
Under CCPA, the AG’s office is required to draft rules roughly three or four months before year’s end to help interpret the law and govern oversight and enforcement.
In other words, there are a heck of a lot of moving parts here.
“While the ad tech industry has been hoping that these regulations could provide much-needed insight on how many CCPA requirements impact the industry, the conflux of these two events could further cloud, as opposed to clarify, the situation,” Kibel said.
What passed?
A bunch of the amendments exempt certain types of businesses or data types from being subject to the law, including insurance companies, companies complying with government requests or dealing with security or fraud issues, vehicle repair data and employee and job application-related data. (AB 981, AB 1416, AB 1146 and AB 25).
Other of the amendments seek to tweak the definition of personal information under CCPA, such as AB 873, which broadens the language from data that is “capable of being associated” with a person or household, to data that is “reasonably capable” of being associated.
AB 1355 excludes de-identified and aggregated consumer information from the definition of personal information, while AB 874 tones down the definition by excluding info collected from public records.
Rounding out the bills, AB 1564 would allow businesses to only have one method of contact for consumers submitting information requests (either an email or a toll-free phone number, but no need for both); AB 1202 would require data brokers to honor opt outs; and AB 846 would ensure that the CCPA doesn’t apply to loyalty programs, rewards and coupons.
All in all, a mixed bag for the industry, Kibel said, some of which would be helpful to marketers and ad tech companies, and some that would be less so.
“It remains to be seen which way the pendulum will swing on this,” he said.
More to come?
Regardless, marketers need to pay close attention to these amendments as they wend their way through the California State Legislature, and also to whatever rule-making comes out of the AG’s office.
It’s becoming increasingly clear that the CCPA is going to set the tone and act as the “federal de facto standard for a while,” said Jonathan Lacoste, president and co-founder of Jebbit, a Boston-based startup that helps marketers collect opted-in data directly from consumers.
Not only would a Republican-controlled Senate and Democrat-controlled House need to compromise for federal legislation to pass, but House Speaker Nancy Pelosi is from California, Lacoste pointed out, and it’s hard to see her supporting the preemption of a state law passed by her constituents unless it’s to pass a far more comprehensive regulation.
“The impact? CCPA is here to stay for the foreseeable future,” Lacoste said.
Industry lobbyists will probably keep pushing for more changes right up until the law goes into effect in January 2020, Lacoste said, but it’s unlikely that the Assembly or the Senate will consider additional amendments, since companies need a fair and reasonable amount of time to get into compliance with what’s already and perhaps soon to be on the books.
