Agency Search 
Site Search Attention: Attorney General, State of California
Re: California Consumer Privacy Act
You’re killing us here.
Thanks,
The advertising industry
The California Consumer Privacy Act (CCPA) is set to take effect in 2020 and the advertising community is desperate for some clarification.
On Tuesday, a coalition of ad trade orgs sent a joint letter to the office of California Attorney General Xavier Becerra calling attention to what they call the “negative impact of certain sections” of the law.
The signatories include the Association of National Advertisers, the Interactive Advertising Bureau, the American Association of Advertising Agencies, the American Advertising Federation and the Network Advertising Initiative.
The letter coincides with a series of six public hearings being hosted by the AG’s office across California through early March as part of its preliminary rulemaking process to promulgate the law and solicit feedback. The next hearing is on Feb. 5 in Sacramento.
So, what are the particular bees buzzing in the ad industry’s bonnet?
At the top of the list are the scope of the CCPA’s definition of personal information, the potential elimination of loyalty programs due to the law’s “non-discrimination requirements” and confusion over how to accommodate users that choose to opt in to some forms of data collection but not others.
“Without clarification and adjustments, these and other ambiguities in the law could result in reduced choice and privacy for consumers, rather than expanding it, as the law intended,” the signees stated.
Excerpts outlining the trade orgs’ particular areas of concern are reprinted below. (Click here to read the whole shebang.)
***********************
Section 1798.115(d) of the CCPA prohibits a company from selling consumer personal information that it did not receive directly from the consumer unless the consumer has received “explicit notice” and is provided an opportunity to exercise the right to opt out of that sale. We urge the AG to recognize that a written assurance of CCPA compliance is sufficient and reasonable.
Sections 1798.105 and 1798.120 of the CCPA allow consumers entirely to opt out of the sale of their data or delete their data; but the law does not explicitly permit a business to offer a consumer the choice to delete or opt out regarding some, but not all, of their data. We request that the AG clarify that businesses may offer reasonable options to consumers to choose the types of “sales” they want to opt out of, the types of data they want deleted, or to completely opt out – and not have to just provide an all-or-nothing option.
Section 1798.110(c) of the CCPA arguably requires a business’ privacy policy to disclose to a consumer the specific pieces of personal information the business has collected about that consumer. We ask the AG to clarify that a business does not need to create individualized privacy policies for each consumer to comply with the law.