previously: News from Sacramento

AdExchanger just ran this, by me: Take A Break, Compliance Nerds. Privacy Is A Research Problem Now.

Some recent good news for the state of California is that we’re—clearly, now that the Legislature has spoken—not not reliant on regulators to protect privacy. Private right of action under CIPA is still a thing. And that’s good, because laws and regulations are always going to be a noisy, laggy version of people’s privacy norms. In California, regular people have a much more direct decision-making role on surveillance risks, as jurors.

More than 4,000 CIPA lawsuits have been filed, which makes the private right of action a bigger concern than CalPrivacy or the attorney general’s office. Müge Fazlioglu, a principal researcher at the IAPP, calls the situation a Multibillion-Dollar Privacy Problem, but from the point of view of a legit business, this is a big win. Lawyer letters might look scary, but CIPA lawsuits are directly addressing the issues consumers care about most—by targeting the inbound data flows to Google and Meta.icymi: Facts and Fiction on the California Invasion of Privacy Act and the problematic SB 690 on the Oakland Privacy site

Big Tech ML gets the info needed for adversarial personalization (such as price discrimination, scams, and political and health) largely from pixel/SDK/CAPI records passed in by legit companies. And, because for every positive outcome for a customer there’s a sale for a legit business, a win for customers is a win for the businesses that earn the money that would have gone to Big Tech and to deceptive sellers.

Anyway, please check it out.

Private right of action, so hot right now

(update 26 Sep 2026)

Besides Allison Schiff’s interview with Müge Fazlioglu—Ad Tech Has A Multibillion-Dollar Privacy Problem. It Started Decades Ago—IAPP has two sessions on PRA at their upcoming conference.

The second one covers “how regulatory compliance and litigation risk can diverge” which sounds like it’s related to my point that it’s now more important to understand what works for customers/jurors than to micromanage the regulatory details. (A lot of corporate “privacy” lawyers are like the kid in the back seat of the car moving their finger closer and closer to their brother’s side until their brother complains…and then they yell, “but I wasn’t on his side!” Juries are like Dad saying, “I don’t care, cut it out.”) More: The five stages of CIPA