The State of California recently enacted into law the new, sweeping California Consumer Privacy Act of 2018, which will go into effect on January 1, 2020. Experts estimate that the Act will apply to more than 500,000 U.S. companies, reaching businesses of various sizes in virtually every sector. To be sure, the Act will have profound implications for the digital advertising industry, given its breadth and seeming extraterritorial reach.
Key takeaways:
- The Act has a very broad definition of “personal information” and a potentially unconstitutional extraterritorial reach.
- Businesses must include a “clear and conspicuous link” titled “Do Not Sell My Personal Information” on their homepage, in their privacy policies, and in any California-specific description of consumers’ privacy rights that enables consumers to opt out of the sale of their personal information.
- Business that collects a consumer’s personal information must, upon receipt of a verifiable request from that consumer, disclose the specific pieces of personal information the business has collected about that consumer.
- Deletion of data at the request of the consumer required by the Act imposes a material burden on publishers and downstream partners to no purposeful end.
- Restrictions on the sale of data present challenges because DSPs, SSPs, and exchanges do not have direct relationships with consumers.
- The Act permits businesses to charge different prices, but only if the differential approximates the value of the data withheld – an incredibly vague standard which will be very difficult to apply in practice.
