With Prop. 24, California takes on internet privacy. Again

State Sen. Bob Hertzberg, Alastair Mactaggart and Assemblyman Ed Chau

By Sam DeanStaff Writer

Oct. 15, 2020 6 AM PT

Proposition 24 aims to refine and expand the rules of the California Consumer Privacy Act, the 2019 law that gave Californians more power over how companies collect and sell their information.

But a scan of the measure’s supporters and opponents raises questions. If this proposal is meant to give people more privacy and more rights over how their data are used, why is it opposed by the American Civil Liberties Union and the Consumer Federation of California? And if it’s meant to stop online businesses from making money by exploiting personal data, why aren’t internet companies lining up to try to kill it?

A quick read of the measure itself proves impossible. Proposition 24 clocks in at 52 pages of dense technical language concerning the intricacies of online data collection, as intelligible to a layperson as the user manual of an aircraft carrier.

In broad strokes, the 2019 consumer privacy law gave Californians the right to know what data companies collect on them, the right to get the data deleted and the right to tell companies not to package and sell the data to other companies.

Proposition 24 would create a dedicated state agency to enforce the law and add dozens of specifics and exceptions for privacy in certain business cases. If it passes next month, the state will have until 2023 to spin up the agency and figure out how to put the law into action.

To really understand what Proposition 24 would do — and how it made enemies among privacy advocates — it helps to start in 2017 when a Bay Area real estate developer named Alastair Mactaggart started worrying about his privacy.

After a cocktail party conversation with a Google engineer, who explained how the industry tracked users’ location, spending habits and political views, then spun that collected information into money by using it to sell targeted advertising, Mactaggart decided to write a law.

When he went to draft this first ballot measure in 2017, Mactaggart had two significant choices to make: How would Californians tell companies not to monetize their data, and how would companies that broke the law be investigated and punished?

For the first question, he had to pick between an opt-in or opt-out system. Opt-in means that companies have to expressly ask for permission before collecting and selling a user’s data. Opt-out means that companies collect and sell data as a default, but Californians have the right to tell companies to stop.

For the second question, he had to decide between what’s known as a “private right of action” — letting anyone sue a company that they believed violated their new rights — and limiting enforcement to a state agency.

Mactaggart picked opt-out, arguing that opt-in would be too harsh for the companies that collect and sell data, and decided on a private right of action, believing that a flurry of lawsuits would do more to keep companies in line.

But when Mactaggart’s measure gathered enough signatures to get on the ballot in 2018, the state Legislature jumped to intervene. Sacramento lawmakers told Mactaggart that they’d pass the law themselves, saving him the trouble of an expensive election campaign — on the condition that he drop the private right of action and give that power to the attorney general instead.

The law passed, but when the dust settled in early 2019, Mactaggart looked upon what he had wrought and concluded there were some major flaws in the final product.

Mactaggart saw one bit of language that was introduced in the legislative process, in particular, as fatal to his original intent. The loophole created an exception for “service providers,” allowing the online ad machine to hum along largely uninterrupted, as long as every company that handled a person’s data signed a contract saying that it was doing so to provide other companies a service. The law also failed to put guardrails around sharing data, as opposed to selling it, and companies took advantage of that ambiguity.

Then he watched as tech companies tried to blow even more holes in the California Consumer Privacy Act
over the course of 2019, backing bill after bill to undermine it. On top of that, the attorney general’s office, in his opinion, was simply too small to effectively police the internet.

So along with Bob Hertzberg, the state Senate majority leader from Van Nuys who initially shepherded Mactaggart’s ballot measure off the ballot and into Sacramento, he drafted a new ballot measure that would, in his view, close these loopholes and provide a backstop that couldn’t be easily eroded by the tech industry’s lobbyists: Proposition 24.

Here’s where the politics get complicated.

Some groups that initially backed the California Consumer Privacy Act wanted the new measure to come back stronger than the original attempt: If you’re going to put a new law in front of voters, at a time when there’s a public awareness of the need for privacy, why not make it opt-in, rather than opt-out, and include a private right of action to let the people of California do their own enforcement?

The ACLU of Northern California, which has spearheaded a number of privacy initiatives, came out strongly against Proposition 24. “We believe that there should be an opt-in framework for collection and use of people’s personal information,” said Jacob Snow, an attorney with the group, “and we believe there should be strong enforceable rights backed up by a private right of action, and we have fought for them in the past.”

Adam Schwartz, staff attorney with the digital rights group Electronic Frontier Foundation, said that he sees Proposition 24 as “a mixed bag of partial steps backward and partial steps forward, and a lot of missed opportunities.”

“One of our north stars is a private right of action,” Schwartz said. “If you don’t have effective enforcement, then you just have a piece of paper, and no matter what agency you put in charge of enforcement, it’s not going to have enough resources to bring an action against every company that violates the law.”

Schwartz also believes that opt-in should be the norm, given that most people don’t have the time or expertise to figure out how to adjust the settings on every service they use to maximize their privacy.

“What we really need is a new paradigm,” Schwartz said. “We are better off having the right to opt out of the sale, plus a government agency to enforce it, than we were before, but it is not adequate to the task.”

The Electronic Frontier Foundation, which has often led the charge for new privacy regulation in California, decided to neither support nor oppose the measure as a result.

Mactaggart has answers to these critiques.

“I had private right of action in the first draft” of the original ballot measure, Mactaggart said, but he feels obliged to stick to the terms of his compromise with Sacramento. “Whether I’m misguided or naive or whatever, I figure we had a deal,” Mactaggart said. “I know this is a new initiative, but it felt like the basic premises were that I had sort of given my word.”

He noted that Proposition 24 would allow district and city attorneys to bring actions against companies that violate the law, along with the new agency.

Mactaggart’s rebuttal to the opt-in critique is more complicated. He’s concerned that opt-in might face constitutional challenges, citing a 2011 Supreme Court ruling that found a Vermont opt-in requirement violated companies’ 1st Amendment rights.

And he just thinks the opt-out system will work better in the long run. The goal, Mactaggart said, is to create a world in which everyone can just set their digital lives to “do not sell” and opt out of the entire system at a click, rather than picking and choosing where and when to opt in. To that effect, the text of Proposition 24 requires the state to create a universal “do not sell” signal that coders can build into browsers, phones or independent apps, and that every business subject to the law would need to respect.

Opponents argue that Proposition 24 isn’t just a missed opportunity — it actually would make things worse. The ACLU points to a proviso in the ballot measure for “loyalty card” systems in particular, calling it a brand-new “pay-for-privacy” loophole that could threaten the rights that Californians already enjoy.

This part of the measure would allow companies to charge more or alter their business experience depending on whether people decide to share their data with them. This would make it legal for Starbucks (or any other business) to keep offering loyalty card programs, which offer discounts in exchange for a customer’s contact information and spending habits. But on the flip side, it also would make it legal for websites to limit access for people who don’t want their data tracked or sold — for instance, a news website asking users to turn off an ad blocker before they can read free articles.

Mactaggart frames this section as a concession to the reality of widespread loyalty card systems and a sop to online publishers. The measure says the gap between prices offered to people who share data and people who don’t can’t be larger than the value to the business of the data itself, which is generally measured in cents or single-digit dollars. Anyway, Mactaggart says, this is currently legal under the California Consumer Privacy Act, since it’s not explicitly disallowed — Proposition 24 just adds clarity.

The ACLU disagrees. “Prop. 24 reinforces this notion that companies should be allowed to charge people for their privacy,” ACLU attorney Snow argued. He said that privacy-minded opponents of the measure aren’t pitting the perfect — a measure with a private right of action and opt-in requirements — against the good in this situation. “We think it’s overall a step backward.”

That puts groups like the ACLU in the unusual position of siding with the online data industry — and actually working harder to oppose Proposition 24 than the businesses that would be affected by it.

A coalition of progressive groups that includes the California League of Women Voters and the California Nurses Assn. created a “No on 24” political committee to advocate against the measure but has raised only $20,000 to Mactaggart’s more than $5 million in support. The online advertising industry, which took a major financial hit in the pandemic, hasn’t contributed at all.

“Leadership at companies are dealing with a lot of challenges — survival being a primary one,” said Alex Propes, vice president of public policy at the Interactive Advertising Bureau, an online advertising industry group. “Companies are as resource-constrained as they’ve been in modern history, and it takes time and energy to both interpret what impact it’ll have on their companies and what their position should be.”

With more pressing problems on their hands, companies that rely on consumer data are sitting out the fight over this complex measure that wouldn’t go into effect until 2023, if voters approve it.

With Prop. 24, California is trying to rewrite the rules of online privacy. Again.

More to Read

More From the Los Angeles Times

Most Read in Business