How Consumers Lose If California’s Landmark Privacy Law is Preempted

Published on

California lawmakers enacted the nation’s strongest online privacy law in 2018 with the California Consumer Privacy Act (CCPA), and voters strengthened that law’s protections at the ballot in 2020 with the California Privacy Rights Act (CPRA). In many areas, the law gives consumers greater protections than the federal proposal currently moving through the House, the American Data Protection and Privacy Act (ADPPA).

Federal preemption in ADPPA would override California’s protections: exempting companies that provide data to government agencies from consumers’ privacy choices, leaving the law vulnerable to weakening by industry lobbyists, and swiftly canceling years of progress in California that has even spurred some large companies to expand those rights to consumers nationally.

It will also handicap the fight for reproductive rights.

That was the conclusion of the California Privacy Protection Agency, charged with enforcing our state law, in this letter opposing preemption sent to House Speaker Pelosi this week.

It was also one of Congresswoman Anna Eshoo’s main reasons for voting against the ADPPA in the House Energy and Commerce Committee last month.

The legislation should take head on the new world women are living in since June 24th the date of the disastrous Dobbs decision, which stripped the rights of women in our nation and potentially criminalized routine health care procedures,” said Eshoo in a statement.

“The bill before us has a major loophole that could allow law enforcement to access private data to go after women. For example, under this bill, a sinister prosecutor in a state that criminalizes abortion could use against women their intimate data from search histories or from reproductive health apps. That loophole must be addressed.”

Here are some key takeaways:

  • California law protects against government surveillance. Governments and law enforcement agencies are using data brokers to avoid obtaining warrants for location and other information about Americans. California’s law applies to companies who contract with the government, allowing people to opt-out of data collection and stop their sensitive information from getting into the hands of the government. A major loophole in the ADPPA allows companies who contract with a local, state or federal government for data collection to avoid compliance with the law. That means unfettered access by governments to mass data collection by tech companies like Google as long as they have a contract.
  • California’s law cannot be weakened – except by Congress. CPRA sets in stone a guaranteed minimum for privacy protections and cannot be weakened by the legislature without the direct consent of California voters. That means privacy in California has nowhere to go but up – unless Congress decides to preempt the law. ADPPA would replace California’s floor with a federal ceiling that stops states from enacting stronger protections. No matter how strong a federal law is, industry lobbyists will seek to weaken or even eliminate it with future legislation.
  • Californians who are protected now would face a 2+ year delay. CCPA is already in effect, and 2020 amendments making the bill even more protective of sensitive data like race, sexual orientation and location will be implemented in less than 6 months. ADPPA overrides those rules and will put privacy on hold for at least two years as the Federal Trade Commission writes regulations.
  • Preemption is a false choice. State and federal laws do not have to be binary. Strong federal privacy laws already co-exist with stronger state privacy laws. Many other federal laws, like the Clean Air Act, set a federal floor, not ceiling.
    • For example: The Gramm-Leach-Bliley Act (GLB) and the Health Insurance Portability and Accountability Act (HIPAA) both established national policy “floors” and let states enact more privacy-protective legislation. Thanks to GLB’s policy floor, not ceiling, the CPRA built on it to give Californians stronger financial privacy protections. For banks that could mean, for example, any personal information collected and inferences made about a consumer as they consider a bank but before they sign up for financial services. 
  • Audits and enforcement. The California Privacy Protection Agency can audit companies’ compliance with the law; ADPPA would eliminate these audits. While amendments to ADPPA nominally allow California to enforce the law, the Agency cites “significant uncertainties” in its ability to do so. State enforcement matters because, while the FTC receives no new enforcement funding, the California Agency has a guaranteed $10 million annual budget. 
  • More protection against coercive pricing. California’s law has stronger protections when a company imposes differential pricing on consumers who exercise their privacy rights. It prohibits such charges from being “unjust, unreasonable, coercive or usurious” and requires companies to prove a different price for those who choose privacy is “reasonably related to the value provided to the business by the consumer’s data.” ADDPA would override these provisions.
  • Direct opt-out of discriminatory profiling and automated decision-making. California’s law creates a right to opt-out of profiling and automated decision-making, allowing consumers to prevent discrimination in access to jobs, housing, loans, etc. that occurs when biased algorithms go to work and ignore civil rights. This broad opt-out from automated decision-making is in some ways more protective than the ADPPA’s bar on racial discrimination, because the ADPPA relies on companies to decide if their algorithms are biased. California’s law will allow consumers to simply say, “don’t profile me at all.”
  • Broader right to delete data. California allows consumers to view and delete all of the data a company has collected about them since the law was enacted. Data deletion is limited to a two-year look-back in the ADPPA.

Don’t get us wrong: Everyone in America deserves strong privacy protections. We especially like the piece of ADPPA’s bar on discrimination that prohibits “disparate impacts” not just intentional bias when determining if a company’s practices – and its algorithms’ results – are fair. That’s crucial to making discrimination laws work. But setting this up as one or the other is a false choice. American privacy laws have long created a national floor, above which nimble states can innovate to enact stronger protections as the need arises. ADPPA would be a ceiling. 

There’s one reason the tech industry likes the dichotomy: They don’t want to comply with California’s more stringent protections. Once Congress locks in a law we may not see movement again on the issue for decades. That’s why it’s incumbent on this Congress to get it right.

Interested in a comparison of the provisions of California’s law and the federal proposal? See the chart below, or download here as a pdf.

chart comparing CCPA to ADPPA

Carmen Balber
Carmen Balber
Consumer Watchdog executive director Carmen Balber has been with the organization for nearly two decades. She spent four years directing the group’s Washington, D.C. office where she advocated for key health insurance market reforms that were ultimately enacted into law as part of the Affordable Care Act.

Latest Privacy Videos

Video thumbnail
Consumer Alert: Wall Street using AI
01:48
Video thumbnail
KCBA (FOX) CA: Clearview AI Is Creating An AI Facial Recognition Software That Violates Privacy Laws
00:35
Video thumbnail
KGO CA: Consumer Watchdog Calls Attorney General to Investigate Clearview AI For Violating State Law
03:06
Video thumbnail
KNTV-SF (NBC) - San Francisco, CA: Tesla Recalls Millions of Cars
02:29
Video thumbnail
Consumer Alert: Clearview AI
01:19
Video thumbnail
Californians Now Have More Power Over Their Data
01:07
Video thumbnail
KPIX CBS TV-5 San Francisco, CA: Your Car's Computer Could Be Tracking And Reporting Your Every Move
00:48
Video thumbnail
California Votes YES on Privacy- Prop 24
13:14
Video thumbnail
Rage For Justice Report Podcast- Prop 24 For Your Privacy
19:18
Video thumbnail
Consumer Watchdog Hacks Tesla
02:00
Video thumbnail
FOX KSWB: New Internet-Connected Cars Could Get Hacked
01:05
Video thumbnail
ABC: Kill Switch Report Highlights Widespread Hacking Vulnerability of Connected Cars
02:12
Video thumbnail
KTTV FOX: Consumer Watchdog Report Warns That Hackers Can Take Over Your Car
05:02
Video thumbnail
SPECNEWS1: Watchdog Warns Cars With Internet Connection Vulnerable to Hacking
00:37
Video thumbnail
KBCW: Connected Cars Pose Risk to Driver Safety Due to Hacking Vulnerability
02:31
Video thumbnail
ABC KGO: Whistleblower Engineers Warn Connected Cars Need A Kill Switch to Stop Hacking
02:10
Video thumbnail
KCAL: Alarming Watchdog Report Shows Connected Cars Are Vulnerable to Hacking
02:51
Video thumbnail
ABC KGTV: Report Says Internet-Linked Cars Are Vulnerable To Hackers
00:30
Video thumbnail
KTTV Fox 11: Consumer Watchdog Report Shows How Vulnerable Connected Cars Are To Dangerous Hacking
01:05
Video thumbnail
NBC: Watchdog Report Show Connected Cars Lack of Cybersecurity Put Drivers at Risk
03:38
Video thumbnail
CBS KGPE: Connected Cars Pose A Cybersecurity Risk
03:05
Video thumbnail
Fox WDAF: High-Tech Cars Put Drivers At Risk Of Hacking Interference
00:47
Video thumbnail
ABC WXYZ: Connected Cars Can Be Hacked Says Kill Switch Report
01:36
Video thumbnail
KTTV GDLA: US Senators Write NHTSA About Connected Car Concerns
01:17
Video thumbnail
FOX KPTV: Kill Switch Report Details Cybersecurity Issues With Internet Connected Cars
02:28
Video thumbnail
CBS LA: Kill Switch Study Finds Connected Cars Are Vulnerable to Hacking
01:41
Video thumbnail
FOX KTTV: Consumer Watchdog on Privacy Issues, Hacking Risks With Internet-Connected Toys
03:00
Video thumbnail
CBS Evening News With Norah O'Donnell: Jamie Court Explains the Value of CA's Consumer Privacy Act
02:04
Video thumbnail
WAFF TV-48 Alabama: Watchdog Report Highlights Car-Hacking Risks
03:16
Video thumbnail
ABC KFSN: Internet-Connected Vehicles At Risk Of Being Hacked Says New Watchdog Report
00:33
Video thumbnail
KPIX CBS: Connected Cars Need A Kill Switch To Stop Dangerous Hacking
02:31
Video thumbnail
KCAL: Kill Switch Report Warns of Hacking Risk For Connected Cars
01:29
Video thumbnail
KTLA: Consumer Watchdog Report Warns of Hacking Risk For Internet Connected Cars
01:05
Video thumbnail
CBS This Morning: "Movie Pass Engages in Deceptive Data Mining" Says Consumer Watchdog
03:09
Video thumbnail
California Passes Strictest Privacy Law in Nation - Rising Up w/Sonali
13:09
Video thumbnail
Consumer Watchdog Exposes
04:20
Video thumbnail
How Google backs Backpage Sex-Trafficking, Press Conference Pt. 1
14:55
Video thumbnail
How Google backs Backpage Sex-Trafficking, Press Conference Pt. 3
14:57
Video thumbnail
Amazon Prime? Or Amazon Slime?
01:22
Video thumbnail
KMAX CBS Sacramento: Amazon shows deceptive prices to trick consumers, says Consumer Watchdog
00:31
Video thumbnail
KABC Los Angeles: Anti-Child Sex Trafficking Groups Call Out Google's Backing of Backpage
02:11
Video thumbnail
KPIX-CBS, San Francisco: DMV Investigates Uber After Consumer Watchdog report
00:28
Video thumbnail
KFMB CBS 8, San Diego: Amazon Prime Day Deals? Consumer Watchdog Says Beware
01:58
Video thumbnail
Asking about I AM JANE DOE at Google Shareholder Meeting
03:33
Video thumbnail
KNBC Los Angeles: Liza Tucker weighs in on regulators' failure to test camp for toxic waste
06:42
Video thumbnail
KNBC Los Angeles: Consumer Watchdog shows how Google helped fund defense of Backpage
01:58
Video thumbnail
KIRO CBS 7, Seattle, WA: Consumer Watchdog: Amazon Uses Fake "List Prices" to Trick Consumers
00:44
Video thumbnail
"I Am Jane Doe" introduction
01:42
Video thumbnail
WZZM ABC, Grand Rapids, MI: New Bill Would Put Driverless Cars In Legal Limbo Says Consumer Watchdog
00:34

Latest Privacy Releases

Privacy In The News

Latest Privacy Report

Support Consumer Watchdog

Subscribe to our newsletter

To be updated with all the latest news, press releases and special reports.

More Privacy Releases