CCPA as a general-purpose activist tool?
06 June 2020
The final text of the
California Consumer Privacy Act (CCPA)
regulations
is up, along with the final statement of
reasons
from the Attorney General's office. So it might be a
good time to think about how the CCPA can be a useful
tool for connecting and sharing with brands
about policy issues on which you disagree.
CCPA is not just for privacy nerds. If you have a problem with a company over some other issue (pollution? wage theft? tax avoidance?) then the CCPA provides a way to register a complaint and make it stick. Companies do have to pay attention to CCPA requests.
A lot of ways to express alignment with a cause are things to not do, such as not buying or not crossing a picket line. CCPA requests can be almost as lightweight, but are unambiguously something to do.
There are three kinds of CCPA requests.
opt out (Do Not Sell).
Right to Know.
Right to Delete
Opt-outs are the easiest. They do not have to be verified. This is a fast, lightweight way to express that you have a problem with a company.
"A request to opt-out need not be a verifiable consumer request. If a business, however, has a good-faith, reasonable, and documented belief that a request to opt-out is fraudulent, the business may deny the request. The business shall inform the requestor that it will not comply with the request and shall provide an explanation why it believes the request is fraudulent."
If you just do an opt out, they can't go make you go fill out a bunch of web forms for ID verification while they shoot at your feet. They have only 2 choices.
Act on your opt-out
Send you an explanation of their "good-faith, reasonable, and documented belief" that your opt-out is fraudulent.
The other two require identify verification, so are time-consuming to do as an individual. They do more for you, and send a harder-to-ignore message, but they can make you do identity verification steps.
An opt-out is easy, but what does it really do? Most companies will say that they don't "sell" your personal info for money. However, CCPA has a broader definition of selling, which lawyers say is confusing, and service providers offer to help with. The CCPA defines "Sale" as
selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.
This definition covers some common marketing practices. Interestingly enough, while Facebook is trying to carve out a CCPA exemption for themselves, they do require their advertisers to honor opt-outs. The Facebook Custom Audiences Terms say
"You represent and warrant that the Hashed Data does not relate to data about any individual who has exercised an option that you have, directly or indirectly, committed to honoring or provided to opt out of having that data disclosed and used for targeted advertising. To the extent an individual exercises such an opt-out after you have used data relating to that individual to create a custom audience, you will remove that data subject from the custom audience."
From the privacy nerd point of view, it makes sense to get as many people as possible opted out everywhere. But from the point of view of influencing companies on other policy issues, can CCPA campaigns fill a niche between just Tweeting and more time-consuming actions?
Here's a CCPA opt-out email I have been working on. Put in your own cause and contact info. This is a little long because there has to be some explanatory material for now. A lot of companies are still learning CCPA, and they have a bunch of marketing stuff going on that they might not be aware of. (Maybe last summer's marketing intern uploaded a customer list to an account they don't have the password to any more?) For now the responses can be all over the place.
If you want to try CCPA-ing some companies to get a sense of how it works, try this:
Californians, did you know you can now opt-out of companies selling your personal information online? You have this right under a new CA privacy law, but we'd like your feedback. Sign up below for our volunteer study, and help us stand up for your privacy.
— Consumer Reports Advocacy (@CRAdvocacy) Twitter, May 14, 2020
Bonus links
The California Data Broker Registry’s Growing Significance For Ad Tech
Of course technology perpetuates racism. It was designed that way.
Take “racism” off your keyword blocklist
Civil rights leaders blast Facebook after meeting with Zuckerberg
Trump Is Doing All of This for Zuckerberg
Facebook's algorithm is a sociopath, and Facebook management is too greedy to stop it
Whistleblowers say Facebook has not warned investors about illegal activity, in new SEC complaint
WSJ: ‘Facebook Executives Shut Down Efforts to Make the Site Less Divisive’
