The ad industry is telling California officials that the state is layering confusion upon confusion when it comes to trying to comply with new privacy laws, which they suggest are a moving target that is virtually impossible to hit.

That came in comments to California Attorney General Xavier Becerra on a third set of modifications to the California Consumer Privacy Act, modifications on top of changes proposed in a Nov. 3 ballot initiative that is likely to pass, the ad groups concede.

Related: CCPA Enforcement Begins Without Final Rules

The groups claim the modifications threaten businesses' free speech rights because they "(1) unreasonably restrict consumers from receiving important information about their privacy choices, (2) prescriptively describe how businesses must provide offline notices, and (3) unfairly fail to hold authorized agents to the same consumer notice standards as businesses."

Related: Consumer Groups Have Issues with CCPA

They argue that the changes would do nothing to help consumers, while impinging on businesses' free speech rights. They want the modifications further modified, including by "clarify[ing] that businesses communicating with consumers via telephone may direct them to an online website containing the required opt out notice as an acceptable way of communicating the right to opt out."

Related: Ad Agencies Say California Law Threatens Commercial Speech

Joining in the comments were the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, Network Advertising Initiative, American Advertising Federation, and the Digital Advertising Alliance.

ANA's Dan Jaffe said the new modifications on top of the old modifications on top of the ballot initiative will lead to a "never-ending fight to comply with privacy law in California."

The Senate Commerce Committee waded into the longstanding issue of a national privacy law Wednesday (Sept. 23) with an assist from four former top Federal Trade Commission members and through the new lens of the COVID-19 pandemic.

The committee was holding a hearing on "Revisiting the Need for Federal Privacy Legislation." The revisit was driven in part by the increased use of broadband data during the pandemic, including for telehealth and contact tracing.

Related: Republicans Introduce COVID-19 Tracing Privacy Bill

Sen. Roger Wicker (R-Miss.), chairman of the committee, has joined with other Republicans to introduce the American Framework to Ensure Data Access, Transparency, and Accountability Act (SAFE DATA Act).

That bill is a revise of the United States Consumer Data Privacy Act, a draft of which was released in November 2019.

At the hearing, Wicker said that legislation was two years in the making, with input from a variety of stakeholders, and came even as California adopted its own privacy legislation, the California Consumer Privacy Act. Wicker said that CCPA is difficult to understand and could become more so, arguing that was one reason that federal legislation was needed.

Related: CCPA Enforcement Begins Without Final Rules

Wicker said that the pandemic has shown that national privacy legislation is more necessary than even, including as more data is collected to do contract tracing.

Wicker said the bill gave them a chance to pass privacy law. He asked his colleagues to look seriously at the bill and work together to pass it.

Ranking member Sen. Maria Cantwell (D-Wash.) agreed COVID-19 had put a spotlight on privacy and Congress needs to establish privacy protections. Her version of that is the Consumer Online Privacy Act. She suggested Republican legislation would maintain the status quo, with loopholes that weaken rights by preempting state laws, like the CCPA--California Attorney General Xavier Becerra appeared at the hearing in defense of the law. He said it was the first time people in the state had the ability to tell businesses not to share their information. He called the states "laboratories of democracy."

One of the things she said needs to be in privacy legislation is a private right of action, which the Wicker bill does not include.

Wicker pointed out that other important national privacy litigation including COPPA (the Children's Online Privacy Protection Act) and HIPPA (the Health Insurance Portability and Accountability Act) contain no private rights of action and that CCPA's right is only for a breach. He said that the push for that private right of action is a stumbling block that may prevent overarching national legislation from being enacted. 

The divergence that still remained between Cantwell and Wicker on what should and should not be in a privacy bill is emblematic of the divide between political parties on the issue despite the fact that both agree a national privacy bill is necessary.

But there were signs of a thaw. Former FTC commissioner Julie Brill said there were enough similarities among various privacy bills that she was hopeful a bipartisan national privacy law was achievable. Former Chairman Jon Leibowitz agreed that he was heartened by the similarities.

Sen. Wicker said he agreed there is much to be said for Sen. Cantwell's approach and appreciated Brill and Leibowitz for praising both approaches. He said they needed to remember those similarities as they try to iron out "what differences remain."

Among the takeaways from the hearing:

1. Sen. Cantwell said that the committee Democrats would be issuing a minority report next week on the value of local journalism, particularly in the time of COVID-19.

2. Cantwell also said that whether/how the government violates privacy rights is something the committee should also be looking at.

3. Sen. Wicker said he planned to hold a hearing on the invalidated Privacy Shield, the regime that had allowed U.S. companies to meet the EU's data protection standards, but was thrown out by the EU Court of Justice because it did not feel that the U.S. could hold up its end of the data protection agreement to protect data transferred from the EU to the U.S. given the current state of privacy protections, or lack of them.

4. The FTC either needs more authority, or perhaps a new data privacy protection agency should be created. Currently the FTC can not impose civil penalties for first-time offenses and little rulemaking authority, instead enforcing through lawsuits and settlements.

5. Former FTC chairman Jon Leibowitz said that the fact that he is opposed to preempting state laws does not mean it passing a weaker federal law. He said any new federal law should be at least as strong as the CCPA. Wicker agreed that preemption did not mean weaker protections.

6. Asked by Sen. John Thune (R-S.D.) whether they think that greater transparency from internet platforms about how they filter content is something congress should "address," all four of the former FTC officials said "yes."

An apparent casualty of California's imposition of the California Consumer Privacy Act (CCPA)is a guide to streaming radio sites, at least according to a message on the now-shuttered site.

StreamingRadioGuide.com was not able to provide any info on a Georgia radio station whose license the FCC has just revoked over nonpayment of regulatory fees. That was because it has shut down, leaving the following message parked at the url:

Welcome to the former StreamingRadioGuide.com

I have decided to cease operations rather than face the potential legal threats from the California Consumer Privacy Act (CCPA), which goes into effect at midnight on January 1st, 2020.

You can read about the law here

This web site had no advertising and no third party tracking for 14 years, with the expenses paid for by me. My web hosting service has incorporated compliance with CCPA and GDPR [Europe's General Data Protection Rules] into their terms of service, leaving few options. Google and Facebook have won, which is ironic since they are the real abusers of consumer privacy.

Thank you for allowing me to hand out free fish, but the era of an individual operating a free service has come and gone.

Fred Stiening
December 31, 2019

Radio World has called the site a rich resource that "comprehensively lists broadcast radio stations that stream on the internet."

The law went into effect Jan. 1. It established a consumer right of privacy based on disclosure and the right to opt out of data collection or third-party sharing, and to have their data deleted if they chose.

Related: Amazon Slams California Privacy Law

Opponents of the California law, adopted to fill what the state saw as a void in online privacy protections, have warned that web site shutdowns could result.

WASHINGTON — Advertisers are pushing for a national privacy bill, but with little chance of comprehensive legislation in the near term, they are pushing back on efforts by states to push for privacy legislation. State-level laws, they argue, are a Balkanized approach that could boost the power of the Big Tech players that both states and the federal government are looking to rein in.

Dan Jaffe, group executive vice president of government relations for the Association of National Advertisers, has been a point man in this pushback, notably against the California Consumer Privacy Act (CCPA). The CCPA becomes law on Jan. 1 and compliance will cost businesses billions — that is, when they can figure out what to comply with, which Jaffe said remains a moving target.

Jaffe spoke with Multichannel News about the implications of privacy by design, if that design is a patchwork of state approaches. Here’s an edited transcript of that conversation.

MCN: What are ANA’s main problems with the California Consumer Privacy Act?
Dan Jaffe: At the most fundamental level, it is that it is a single state law. We don’t think that privacy rules work on a state-by-state basis. The business has already gone through a substantial amount of fragmentation and that is only going to increase in 2020 unless there is a federal law passed that pre-empts state laws.

MCN: You say “laws,” so clearly the problem isn’t just California.
DJ: Let me give you the quick list of what I know, and I may not be covering everything. There is CCPA, as well as a [California] data-broker registration bill that is not the same as a Vermont databroker bill. Nevada’s new law goes into effect today [Sept. 30]. Maine has an ISP law and New Jersey has a major piece of privacy legislation with private-rights-of-action provisions in it. The attorney general of Ohio is talking about holding privacy hearings. … You get the general gist.

Overlaying all of this is the [European Union’s] General Data Protection Rules [which apply to any business over a certain size doing business in the EU, just as the CCPA applies to any business over a certain size doing business in the state].

I know a number of companies who have spent multi, multimillions of dollars to become GDPR compliant and are now spending millions on becoming CCPA compliant because of the differences in definitions.

MCN: Speaking of big money, the California attorney general’s office has put out a regulatory impact statement. What trouble signs are in that report?
DJ: I have said since the outset that this was going to be a major tax on California consumers because I could see there were going to be major regulatory compliance requirements. Now the attorney general’s report is talking about as much as $55 billion dollars in costs from the CCPA, and a further $16.9 billion in costs for compliance with the attorney general’s [rules].

I don’t want to be hyperventilating here, but the report says this is going to fall particularly hard on small business. Because of the way the act is designed, a relatively large number of relatively small businesses will be covered.

Big companies are going to be able to do well in this situation because they have compliance lawyers and IT experts and advertising experts. Companies midsize and below are going to have a very much harder time — and that is if everything goes smoothly.

Now, people may say that the privacy protections people have gotten outweigh all of these costs. I don’t necessarily think that that’s true.

MCN: Obviously, you don’t want this Balkanized model, but if it develops, is the free web content model sustainable?
DJ: For some, yes. The Tyrannosaurus Rexes survive, at least in the short run. But I don’t know how Google and Amazon and all these other companies that started out in garages and dorm rooms would have done if they had faced all these restrictions.

MCN: But an already divided Congress fighting over impeachment is unlikely to come together on privacy legislation anytime soon.
DJ: To pass any major legislation when they don’t like each other and they don’t work well together is very hard. I don’t know what’s possible. I just know what’s needed. We are going to make every effort to move [federal legislation] as far and as fast as we can. There is nothing more important that we are working on than privacy and data security issues.

A very large proportion of companies will say the same thing. And the situation is only going to get more difficult because there are 22 more states that seriously considered privacy legislation in 2019.

Unlike data security, where disparate laws still deal with a limited set of issues and, if you are complying with those requirements, you are likely complying with most data-security laws, this isn’t the case with privacy. It has a large range of issues over billions and billions of transactions and an enormous number of parties from first parties to third parties to data suppliers to data trackers to publishers.

MCN: So the answer is national legislation.
DJ: Yes, and for the first time the industry is not split on that. I don’t hear anybody say, “Oh, we don’t need national legislation.”

One more thing, and this I think is a grenade that has been thrown into the process. Before the law takes effect and even before the attorney general has finished his rulemaking, Alastair Mactaggart [the California resident who pushed for the initial ballot initiative] is putting forward a new ballot initiative that will completely alter and add to the existing [CCPA]. We are in a never-ending compliance race. To use a legal term: It’s a mess, and it’s likely to get messier.