Privacy Board Walks Back Some Pro-Consumer Regulations, Nears CPRA Finalization

Published on

Welcome to the latest Truth in Privacy dispatch, Consumer Watchdog’s tech and privacy newsletter.

Two years since the passage of the voter-approved California Privacy Rights Act (CPRA), the board tasked with drawing regulations for the law is nearing the finish line.

Over the weekend the California Privacy Protection Agency (CPPA) approved a package of modifications to the law, triggering a final 15-day comment period and bringing the public one step closer to being empowered with landmark data privacy protections. The amended California Consumer Privacy Act (CCPA) takes effect in just two months.

While the law gives unprecedented control to users over their personal data—from limiting its use to stopping third-parties from obtaining it—the agency walked back certain pro-user regulations and passed on addressing other shortcomings. For example, the board deleted the requirement under section 7012 that businesses identify third-party recipients of data. This move is worrisome, as it will help keep secret the largely incognito world of third-party data miners. However, third-parties must disclose that they receive the data via a link, although it is unclear how users would be notified. The board in its reasoning said the regulation change was to “simplify implementation at this time.”

The deletion garnered some discussion among board members, including Vinhcent Le, who floated the idea of users being informed as to the number of recipient third parties to “strike a balance.” At the end, Board Chair Jennifer Urban said the issue would be tabled for the future, although given the layers of bureaucracy that come with rule making, revisiting the regulation will likely be a drawn-out process.

In addition, the board deleted the requirement that businesses display to consumers whether they have exercised their privacy choices, including opting out of the sale/sharing of their personal information. This applies to whether the privacy choice is made individually on a web site or via a global privacy preference signal. With this deletion under sections 7025 and 7026, it is unclear how users will know where they have made their privacy choices in the sea of websites that are visited daily. The board said the “revision conforms the subsection to existing requirements for businesses.”

Board member Lydia de la Torre and Prop 24 founder Alastair MacTaggart, sitting in on his first meeting as board member, expressed concern about seeing the display requirement go. The board agreed to also address the modification in the future.

Maybe more alarmingly, a 15-day window for businesses to comply with requests to stop selling/sharing data and to limit data use remains on the books, a loophole that is contrary to the essence of the law and not supported by the statute. Data while browsing is sold to third parties in seconds, and if entities have over two weeks to comply with requests, personal data will still have plenty of time to get into the hands of others. As Consumer Watchdog recently highlighted in a new report, a person’s browsing habits are sold about 750 times a day, amounting to an industry worth billions built off our most sensitive information.

Although the 15-day regulation currently states that a business should honor a request “as soon as feasibly possible,” a business will cite 15 days as “soon as feasibly possible.” If a business can sell personal information in seconds, it should also be able to stop selling personal information in the same amount of time.

Following the end of the 15-day public comment period, a final packet of regulations will be submitted to the Office of Administrative Law. The agency has 30 days to approve or deny the regulations, but the CPPA said the timeline is looking more like 45-50 days. The attorney general’s office will begin enforcing the new amendments to the law beginning Jan. 1 2023, with the privacy board taking over enforcement in July 2023.

Justin Kloczko
Justin Kloczko
Justin Kloczko follows tech and privacy for Consumer Watchdog. He’s a recovering daily newspaper reporter whose work has also appeared in Vice, Daily Beast and KCRW.

Latest Privacy Videos

Video thumbnail
Consumer Alert: Wall Street using AI
01:48
Video thumbnail
KCBA (FOX) CA: Clearview AI Is Creating An AI Facial Recognition Software That Violates Privacy Laws
00:35
Video thumbnail
KGO CA: Consumer Watchdog Calls Attorney General to Investigate Clearview AI For Violating State Law
03:06
Video thumbnail
KNTV-SF (NBC) - San Francisco, CA: Tesla Recalls Millions of Cars
02:29
Video thumbnail
Consumer Alert: Clearview AI
01:19
Video thumbnail
Californians Now Have More Power Over Their Data
01:07
Video thumbnail
KPIX CBS TV-5 San Francisco, CA: Your Car's Computer Could Be Tracking And Reporting Your Every Move
00:48
Video thumbnail
California Votes YES on Privacy- Prop 24
13:14
Video thumbnail
Rage For Justice Report Podcast- Prop 24 For Your Privacy
19:18
Video thumbnail
Consumer Watchdog Hacks Tesla
02:00
Video thumbnail
FOX KSWB: New Internet-Connected Cars Could Get Hacked
01:05
Video thumbnail
ABC: Kill Switch Report Highlights Widespread Hacking Vulnerability of Connected Cars
02:12
Video thumbnail
KTTV FOX: Consumer Watchdog Report Warns That Hackers Can Take Over Your Car
05:02
Video thumbnail
SPECNEWS1: Watchdog Warns Cars With Internet Connection Vulnerable to Hacking
00:37
Video thumbnail
KBCW: Connected Cars Pose Risk to Driver Safety Due to Hacking Vulnerability
02:31
Video thumbnail
ABC KGO: Whistleblower Engineers Warn Connected Cars Need A Kill Switch to Stop Hacking
02:10
Video thumbnail
KCAL: Alarming Watchdog Report Shows Connected Cars Are Vulnerable to Hacking
02:51
Video thumbnail
ABC KGTV: Report Says Internet-Linked Cars Are Vulnerable To Hackers
00:30
Video thumbnail
KTTV Fox 11: Consumer Watchdog Report Shows How Vulnerable Connected Cars Are To Dangerous Hacking
01:05
Video thumbnail
NBC: Watchdog Report Show Connected Cars Lack of Cybersecurity Put Drivers at Risk
03:38
Video thumbnail
CBS KGPE: Connected Cars Pose A Cybersecurity Risk
03:05
Video thumbnail
Fox WDAF: High-Tech Cars Put Drivers At Risk Of Hacking Interference
00:47
Video thumbnail
ABC WXYZ: Connected Cars Can Be Hacked Says Kill Switch Report
01:36
Video thumbnail
KTTV GDLA: US Senators Write NHTSA About Connected Car Concerns
01:17
Video thumbnail
FOX KPTV: Kill Switch Report Details Cybersecurity Issues With Internet Connected Cars
02:28
Video thumbnail
CBS LA: Kill Switch Study Finds Connected Cars Are Vulnerable to Hacking
01:41
Video thumbnail
FOX KTTV: Consumer Watchdog on Privacy Issues, Hacking Risks With Internet-Connected Toys
03:00
Video thumbnail
CBS Evening News With Norah O'Donnell: Jamie Court Explains the Value of CA's Consumer Privacy Act
02:04
Video thumbnail
WAFF TV-48 Alabama: Watchdog Report Highlights Car-Hacking Risks
03:16
Video thumbnail
ABC KFSN: Internet-Connected Vehicles At Risk Of Being Hacked Says New Watchdog Report
00:33
Video thumbnail
KPIX CBS: Connected Cars Need A Kill Switch To Stop Dangerous Hacking
02:31
Video thumbnail
KCAL: Kill Switch Report Warns of Hacking Risk For Connected Cars
01:29
Video thumbnail
KTLA: Consumer Watchdog Report Warns of Hacking Risk For Internet Connected Cars
01:05
Video thumbnail
CBS This Morning: "Movie Pass Engages in Deceptive Data Mining" Says Consumer Watchdog
03:09
Video thumbnail
California Passes Strictest Privacy Law in Nation - Rising Up w/Sonali
13:09
Video thumbnail
Consumer Watchdog Exposes
04:20
Video thumbnail
How Google backs Backpage Sex-Trafficking, Press Conference Pt. 1
14:55
Video thumbnail
How Google backs Backpage Sex-Trafficking, Press Conference Pt. 3
14:57
Video thumbnail
Amazon Prime? Or Amazon Slime?
01:22
Video thumbnail
KMAX CBS Sacramento: Amazon shows deceptive prices to trick consumers, says Consumer Watchdog
00:31
Video thumbnail
KABC Los Angeles: Anti-Child Sex Trafficking Groups Call Out Google's Backing of Backpage
02:11
Video thumbnail
KPIX-CBS, San Francisco: DMV Investigates Uber After Consumer Watchdog report
00:28
Video thumbnail
KFMB CBS 8, San Diego: Amazon Prime Day Deals? Consumer Watchdog Says Beware
01:58
Video thumbnail
Asking about I AM JANE DOE at Google Shareholder Meeting
03:33
Video thumbnail
KNBC Los Angeles: Liza Tucker weighs in on regulators' failure to test camp for toxic waste
06:42
Video thumbnail
KNBC Los Angeles: Consumer Watchdog shows how Google helped fund defense of Backpage
01:58
Video thumbnail
KIRO CBS 7, Seattle, WA: Consumer Watchdog: Amazon Uses Fake "List Prices" to Trick Consumers
00:44
Video thumbnail
"I Am Jane Doe" introduction
01:42
Video thumbnail
WZZM ABC, Grand Rapids, MI: New Bill Would Put Driverless Cars In Legal Limbo Says Consumer Watchdog
00:34

Latest Privacy Releases

Privacy In The News

Latest Privacy Report

Support Consumer Watchdog

Subscribe to our newsletter

To be updated with all the latest news, press releases and special reports.

More Privacy Releases