California’s big consumer privacy law goes into effect on Jan. 1. It’s the first law in the United States that demands that companies give consumers more control over their information and more power over what they can do with that information once they have it. 

On the consumer side, you can now ask companies to show you everything they have on you for free up to twice a year. You can ask companies to delete the data, and the law requires companies to give you an easy way to opt out of having your personal information sold.  

Are big tech companies and everyone else ready to comply with this law? Who is it meant to affect? When we have these questions, we call Jessica Lee, a partner at the law firm Loeb & Loeb and co-chair of the privacy, security and data innovations practice there. I asked her what sectors will be affected the most. The following is an edited transcript of our conversation.

Jessica Lee: This is a law, really, designed to address media and technology. This is a law that is aimed at restricting the use of data for targeted advertising. It’s not written or limited to just that industry or to that use case, but that’s really what it’s designed to address. I think if you’re in the space where you are either a publisher or you’re somewhere in the tech ecosystem, this law will impact you the most. 

Molly Wood: That’s a pretty big industry.

Lee: Yes, it is. We’re already starting to see shifts. We’re seeing platforms are changing their terms, they’re limiting the use of third-party cookies on the site. We have the regulation, but I think there’s going to be some changes to the business models as well.

Wood: From the consumer side, what difference will it make? How will this appear to consumers in California and potentially outside of California?

Lee: That should be interesting. I think there’s been a lot of press around this. Consumers who choose to take advantage of it will be able to limit how their data is used. They’ll be able to get access to information about how companies are using their data and to ask companies to delete their data if they want their data deleted. I think in January in February, and maybe even beyond that, we’ll see an uptick and all these requests coming in from California and beyond. After that, it remains to be seen. This could be something like the privacy policy where after the initial enthusiasm for it, it becomes another link at the bottom of the page that some people go to and exercise their rights. But some people just want to get to the content on the site, and they push forward and skip past it.

Wood: How important do you think it’s going to become? Because I think we’ve seen a lot of those changes just surfing the web. Now, it’s like every page that I go to has a cookie policy banner at the bottom, and I’m sure everybody’s just clicking the “x” like I am at this point. Do consumers understand the level of change? Is it transparent? Does it matter?

Lee: I’m not sure, I really don’t know that these regulations are the best way to address the changes that companies want to see or that regulators want to see. Say you get access to your information and you’re a consumer. I’m not quite sure what you do with that information, or if you even understand what it means once you have it. I think we’ll see real change when companies restrict themselves internally through their use policies, as opposed to maybe offering some of these rights. Now restricting sale and getting your data deleted will probably have a benefit, but I think there needs to be a consumer education piece that hasn’t been addressed yet.

Wood: How will we get a sense of whether this is actually affecting business models? I assume the ad tech industry is not going to go away?

Lee: No, I don’t think it will. I do think their business models will change. I should say that in the regulations, at least in the draft regulations, the attorney general wants businesses to publish their metrics — how many deletion requests they receive, how many did they respond to? You might at that point then get to see some numbers with respect to what impact this is really having on businesses. They’re requiring that to be in privacy policies for companies of a certain size, which means the information will be public.

Wood: That seems like it could be useful, actually. I mean, I know this law is controversial and contentious. The tech industry really didn’t want it to pass as is. Do you think that other states, though, are likely to take up similar legislation?

Lee: Oh, 100%. I know New York, Washington and many other states are looking at similar laws. I anticipate that those will come up in the next legislative session. There are multiple bills at the federal level that have been proposed. We’re going to see additional regulation, I think on the state level, until we get a federal bill in place.

Wood: You want to make any predictions about that in 2020? Any likelihood of a federal law in 2020?

Lee: I remain skeptical. I’m generally a hopeful person, but I remain skeptical about this. Partially because we’re heading into an election year, we’re in the middle of an impeachment, we have two divided houses. It doesn’t seem like the best political environment to pass substantial, groundbreaking privacy regulation. There’s a desire on both sides to see privacy regulation, but there are divergent, I think, missions. I think we’ll see federal privacy legislation, but I’m not sure it’s going to happen in the election year.

Related links: More insight from Molly Wood

One fun fact is that since the opt-out requirement in the law specifically says that consumers are opting out of companies selling their personal data, Facebook said late last week that it doesn’t have to let people opt out of anything. As the company likes to remind us often, it doesn’t technically sell our data to anyone. It just lets advertisers access the detailed profiles it has on us in order to precisely target us with ads. Facebook says individual businesses can make changes on their side to keep Facebook from collecting information on people who have opted out through those businesses. But the company maintains that based on its reading of the new law, it doesn’t have to change anything about how it collects information on you online.

Privacy experts, including the activist who got the law on the ballot in the first place, disagree. Google has said it will comply with the opt-out aspect of the law. Lawyers and ad experts told the Wall Street Journal that lots of smaller companies will probably take the Facebook approach at first. Enforcement of the legislation doesn’t start in earnest until 2020.

Stories You Might Like

Big Tech is prepping for California’s tough new privacy law

California’s new privacy law could create haves and have-nots

App privacy protections require more than new policies

Europe’s data-privacy law turns 2. Has it actually made our information safer?

The EU doesn’t trust its citizens’ data in the hands of the U.S.

3 years after Europe’s GDPR, what’s changed in tech privacy?