Category Archives: Behavioral Advertising

Google and Facebook’s Privacy Long Game May Pay Off

On September 13, 2019, the California Legislature adjourned with numerous CCPA amendments ready for the signature of Gov. Gavin Newsom.  Two amendments that ultimately passed, AB 25 – which provides a one-year moratorium on CCPA’s application to employee, beneficiary and emergency contact information,  and AB 1355 – a broad-ranging amendment to the law, are particularly helpful for business owners. Other changes to CCPA, including AB 1146, AB 874, and AB 1564 either do not alter in any material way the spirit or intent of the law or are redundant to changes found in AB 1355. There was also one proposed amendment – AB 846, that was withdrawn for consideration until next year but would have greatly enhanced the protections found in CCPA by creating a private right of action for notification and data usage failures. 

Three of the changes found in AB 1355 are noteworthy given in some very real ways they chip away from the consumer-first thrust of CCPA.  First, by modifying the definition of “personal information” to mean “reasonably capable of being associated with” a particular consumer or household, instead of just “capable of being [so] associated”, CCPA may get a reasonableness component that would give companies a strong new argument when defending a private action breach claim.  Moreover, the AB 1355 amendments explicitly state that deidentified and aggregate information are exempt from CCPA – in effect, potentially giving social media platforms a sought-after CCPA safety hatch. 

And finally, the AB 1355 Amendment states that the reasonableness of charging a different price or rate or providing a different level or quality of goods or services for the use of data should be measured in relation to the value of the personal information to the business and not to the consumer – as it was initially drafted.  Given that most social media platforms and data brokers actually place very low values on specific consumer data, this change is of obvious great significance.  Not surprising given the heavy lobbying, these and other changes actually benefit data merchants to the detriment of consumers.

AB 1355 is significant for other reasons.

On September 10, 2019, fifty-one CEOs wrote a letter to Congressional leaders asking them “to pass, as soon as possible, a comprehensive consumer data privacy law that strengthens protections for consumers and establishes a national privacy framework to enable continued innovation and growth in the digital economy.”  The signatories to this letter come from a broad range of industries, including retail (Walmart, Amazon, Target, Macy’s), banking (JPMorgan Chase, Bank of America, Citigroup), card brands (American Express, Visa, Mastercard), technology (Salesforce, SAP, SAS Institute, IBM, Dell, Qualcomm), as well as consumer goods and pharmaceutical (Bristol-Myers Squibb, Johnson & Johnson, Procter & Gamble), insurance (Chubb, New York Life Insurance, Principal, State Farm, USAA), and media-rich telecommunications (AT&T, Comcast). 

Conspicuously absent from this list of companies are the two largest beneficiaries of Business Roundtable’s privacy initiative – Facebook and Google. 

As set forth in their CEO letter:  “Business Roundtable has released a Framework for Consumer Privacy Legislation (attached to this letter), which provides a detailed roadmap of issues that a federal consumer privacy law should address.”  If one takes a look at this proposed Business Roundtable Framework, Facebook and Google’s sought-after end game comes better into focus – which is especially impressive given that neither company is even a current member of the Business Roundtable.   

Business Roundtable’s Framework proposes that a new federal law “establish a national standard for breach notification that preempts state laws” and prevents the “state-by-state approach to regulating consumer privacy.”  As well, the Business Roundtable Framework specifically also states that “[a] national consumer privacy law should not provide for a private right of action.”

Apparently, everything may fall into place for those who feast on consumer data.  First, CCPA may have been weakened sufficiently to make 2020 not nearly the onerous compliance year most companies expected – especially since the tabling of AB 856 and its creation of a new right of action for breach of CCPA’s consumer notification and use provisions.  Given California’s privacy statutes may very well end up being the model for a federal law, weakening CCPA before pushing for a federal law was the necessary initial step in this two-step dance. 

And secondly, as shown by the September 10, 2019 CEO letter to Congressional leaders, there is a broad coalition of companies seeking both federal preemption as well as the express killing of a private right of action – the two requirements needed to push back consumer-friendly state initiatives and class action lawyers.  Class action lawyers and fiercely independent states – such as Maine and Vermont, are largely immune to lobbyists.

While others may have publicly taken up their fight, Google and Facebook are smoking cigars in a dark backroom somewhere laughing at how brilliantly their plan may ultimately play out. 

UPDATE:  October 16, 2019

Without any fanfare or even a mention on the California Governor’s website, Governor Newsom quietly signed into law all of the CCPA amendments put on his table, including AB 1355 which amends § 1798.140(o)(2) of the CCPA, to provide that personal information “does not include consumer information that is deidentified or aggregate consumer information” – making all social media platforms raise a toast to their victory, and amends Cal. Civ. Code § 1798.150(a)(1) of the CCPA to reaffirm that class-action lawsuits may be brought only for data breaches when personal information is “nonencrypted and nonredacted” and thereby shut out wide swaths of potential claims. 

In addition, the Governor signed into law the following amendments – some of which further weakened CCPA’s reach:  AB 874, AB 25, AB 1146, AB 1564, AB 1130, and AB 1202.  Coupled with the Attorney General’s Office releasing the day before its twenty-four pages of guidance – which many have correctly interpreted as providing little real guidance, it is clear why all eyes should now be squarely focused on Alastair Mactaggart and his November 2020 Ballot Initiative

Facebook Dodges Potential FTC Bullet

On July 24, 2019, the FTC filed its Stipulated Order requiring that Facebook comply with newly-imposed privacy requirements for a period of twenty years.  The most noteworthy aspect of this Order, however, does not relate to the specifics of this compliance framework – which can easily be addressed with the right counsel. Rather, the requirement that is more challenging for Facebook is the one creating an “Independent Privacy Committee” within Facebook’s Board of Directors “consisting of Independent Directors, all of whom” have “(1) the ability to understand corporate compliance and accountability programs and to read and understand data protection and privacy policies and procedures, and (2) such other relevant privacy and compliance experience reasonably necessary to exercise his or her duties on the Independent Privacy Committee.” 

Such specific requirements regarding the capabilities of a Board member are more than a bit unusual.    Given the fiduciary responsibilities of Board members as well as the reputations of those willing to become members of this “Independent Privacy Committee”, this novel requirement may actually do something to curtail future privacy transgressions.

There is no doubt the FTC resolution was Facebook’s well-orchestrated attempt at rehabilitating its tattered reputation.  As stated in Facebook’s blog response:  “Billions of people around the world use our products to make their lives richer and to help their organizations thrive. That makes it especially important that the people who use our platform can trust that their information is protected. This agreement is an unambiguous commitment to do that.”  Indeed, this agreement may even be marketed as a way of bolstering dwindling user engagement.

It remains to be seen, however, whether or not the Stipulated Order provides an “unambiguous commitment” to do anything other than resolve specific violations of a prior FTC Decision and Order, In re Facebook, Inc., C-4365, 2012 FTC LEXIS 135 (F.T.C. July 27, 2012). Indeed, Commissioner Rohit Chopra – who assumed office on May 2, 2018, filed a forceful dissent objecting to the lax settlement of this violated Order: “Facebook flagrantly violated the FTC’s 2012 order by deceiving its users and allowing pay-for-play data harvesting by developers” and this settlement “imposes no meaningful changes to the company’s structure or financial incentives, which led to these violations.”

Facebook’s regulatory problems are far from over – the DOJ just announced a wide-ranging antitrust probe that includes Facebook.  Specifically, the Department of Justice’s Antitrust Division will review “whether and how market-leading online platforms have achieved market power and are engaging in practices that have reduced competition, stifled innovation, or otherwise harmed consumers.” This antitrust probe will likely end up being much more interesting and potentially damaging to Facebook than the recent FTC settlement – especially depending on what road is taken by its potential privacy-killing Calibra business unit.

Senate Banking Committee Focuses on Libra Privacy Issues

On July 16, 2019, a Senate Panel lobbed missives across the Libra bow when questioning David Marcus, the head of Facebook’s Calibra subsidiary.   As suggested by the title of the hearing – “Examining Facebook’s Proposed Digital Currency and Data Privacy Considerations”, today’s hearing was really all about Facebook and not about digital currencies or blockchain technologies in any broader context.

Using a tone that permeated for much of the hearing, Sen. John Kennedy ignored Facebook’s participation in a Swiss Association that purportedly leaves Facebook with little control over Libra and instead mocked: “Facebook wants to control the monetary supply. What could possibly go wrong?” Sen. Sherrod Brown (D-OH) reinforced this lack of trust when he said that Facebook was dangerous because it did not “respect the power of the technologies they are playing with, like a toddler who has gotten his hands on a book of matches, Facebook has burned down the house over and over, and called every arson a ‘learning experience.'”

Sen. Brian Schatz summed up the mood nicely when he recognized: “You’re making an argument for cryptocurrencies generally. The question is not, ‘Should the U.S. lead in this?’ Why in the world, of all companies, given the last couple of years, should [Facebook] do this?” 

On a more substantive side, the hearing was driven by a concern for privacy rights. As reported in The Wall Street Journal,  Mr. Marcus suggested that Facebook would not monetize users’ data related to Libra because no financial or account data from the Libra network would be shared with Facebook:  “We’ve heard loud and clear from people, they don’t want those two types of data streams connected.”

Even though it did not garner much public analysis, Chairman Crapo’s Statement provides an important privacy perspective that may also set the table for future legislative action: “Individuals are the rightful owners of their data. They should be granted a certain set of privacy rights, and the ability to protect those rights through informed consent, including full disclosure of the data that is being gathered and how it is being used.”

And, despite all of his protestations to the contrary, in his own prepared testimony, Mr. Marcus actually provides a rough roadmap detailing how the financial and transactional data obtained by Calibra could directly bolster Facebook’s data surveillance revenue.

Specifically, Mr. Marcus states: “The Calibra wallet will let users send Libra to almost anyone with a smartphone, similar to how they might send a text message, and at low-to-no cost.  We expect that the Calibra wallet will ultimately be one of many services, and one of many digital wallets, available to consumers on the Libra network.   We do not expect Calibra to make money at the outset, and Calibra customers’ account and financial information will not be shared with Facebook, Inc., and as a result cannot be used for ad targeting. Our first goal is to create utility and adoption, enabling people around the world— especially the unbanked and underbanked—to take part in the financial ecosystem.  But we expect that the Calibra wallet will be immediately beneficial to Facebook more broadly because it will allow many of the 90 million small- and medium-sized businesses that use the Facebook platform to transact more directly with Facebook’s many users, which we hope will result in consumers and businesses using Facebook more. That increased usage is likely to yield greater advertising revenue for Facebook.

To suggest that the mere ancillary use of Facebook’s platforms by Calibra users will alone cause an increase in advertising revenue makes little sense.  The only way Calibra will yield greater “advertising revenue” to Facebook is directly related to the well-understood increase in value user data would have after alignment takes place between transaction data and the other data obtained from Facebook’s platforms and services.  Indeed, advertisers have long recognized that personalization data is not nearly as useful as relevance data.

A long-term goal of Facebook’s Libra project, namely combining user data with associated financial and transactional data, should not be considered well-hidden. Mr. Marcus’ written testimony all but confirms Facebook will eventually harvest transactional and KYC data:  “Calibra will not share customers’ account information or financial data with Facebook unless people agree to permit such sharing.”  Indeed, Sen. Pat Toomey specifically asked Mr. Marcus whether Facebook intended to seek user consent to monetize Calibra-derived financial data and Mr. Marcus incredibly responded: “I can’t think of any reason right now for us to do this.” Really?

Facebook likely only has to ask and it will get whatever user permissions necessary to satisfy existing regulatory and statutory requirements.  Depending on the ultimate success of Amazon’s recent $10 offer for tracking data, Facebook may not even need to give much in return for such consent. In other words, once this particular genie is let out of the bottle there will likely be no turning back and any unencumbered launch of Libra might very well be the death knell for data privacy as we know it.

UPDATE: July 18, 2019

House Financial Services Committee Hearing of July 17, 2019

One major difference between the Senate hearing conducted on July 16, 2019 and the House Financial Services Committee hearing of July 17, 2019 was the sort of testimony provided by industry experts.  Even though the Senate smartly sought testimony from Wall Street and blockchain industry expert Caitlin Long, unlike with the House, there were no one educating the Senate on Calibra’s privacy issues.

For example, MIT Professor Gary Gensler’s prepared House testimony lays out a number of questions regarding privacy that Facebook should answer at some point:  “We know that many of the most intrusive privacy practices of concern to privacy regulators have actually been subject to some form of consumer consent. So, it will be essential to conduct a more thorough analysis of what uses of Libra data should be allowed and which uses should be prohibited. How would such restrictions be monitored and enforced? What are the limited exceptions and might Calibra broadly seek customer consent in the form of standard user agreements? It would be likely that Calibra would want to commercialize this data. At a minimum, without sharing the raw transaction data from customers’ Calibra Wallets, it would still likely analyze such data to earn money either through advertisements or by offering targeted services to wallet holders.”  

As well, in the prepared written testimony of Robert Weissman, President of Public Citizen, there is a long discussion explaining why Facebook is a “Corporate Surveillance Leviathan” that cannot be trusted with the proposed Calibra wallet.

The House Hearing also raised the issue of whether Facebook would be able to pick and choose users of the Calibra wallet – potentially forcing persons to conform their behavior to Facebook standards. In one highlight of the House Hearing, Congressman Sean Duffy waved a twenty-dollar bill in the air while making the point that anyone, including persons who say horrible things, can use a twenty-dollar bill but: “Who can use Calibra?”  In response, Mr. Marcus pointed out anyone who could satisfy Calibra KYC requirements – which then begged the loaded follow-up question from Congressman Duffy:  “Could Milo Yiannopoulos and Louis Farrakhan use Calibra [given they are both banned from Facebook]?”  In response, Mr. Marcus said that an applicable policy hasn’t yet been written but that it was “an important question that [Facebook] needed to be thoughtful about.”  

Given Facebook’s poor track record – indeed, former Facebook executives readily acknowledge Facebook holds too much market power and should not be trusted going forward, these and other “important questions” must be answered as soon as possible.

Will Libra Coin Kill Off Privacy For Good?

In January 2018, Facebook publicly announced it was going to take a deep dive into cryptocurrencies.   That same month, Facebook removed all ads from its platform that promote “initial coin offerings or cryptocurrency”.   Facebook’s policy was “intentionally broad” and banned “all ads related to cryptocurrencies — not just those directly trying to sell cryptocurrencies or cryptographic tokens.”  One example of a banned ad was provided by Facebook:  “Click here to learn more about our no-risk cryptocurrency that enables payments to anyone in the world”. 

In other words, Facebook’s “Libra Coin” – described as a “low-volatility cryptocurrency” for global payments in the sort of White Paper written for every ICO ever launched, began percolating at the very exact time Facebook banned ads about ICOs and cryptocurrency.  

Facebook’s crypto advertising ban and duopolistic reach pretty much sums up why potential users should be careful before jumping on the Libra bandwagon.  In what can only be considered ironic, the “Libra Coin” is not even a true cryptocurrency or even built on a blockchain – it is apparently the token for a permissioned payment network that is partially decentralized while requiring the disclosure of sensitive authentication data as well as use of the Calibra wallet owned and operated by Facebook itself.  Most importantly, as a node on the network Facebook will also have access to all consumer transaction data flowing on the network.  Like icing on a global cake, by being part owner of a de facto bank, Facebook will also get to share in any float interest.

Those premier venture firms and companies who have anted up to align with Facebook’s project may believe in the collective end game but to align now with Facebook simply because of its tremendous reach will likely be a mistake for them as well as the consuming public.

UPDATE: October 13, 2019

On October 4, 2019, PayPal withdrew its participation in the Libra Association. And, on October 11, 2019, Visa, Mastercard, eBay, and Stripe joined with Paypal in also withdrawing their participation in the Libra Association. Some have suggested these major payment industry defections spell the death knell for Facebook’s Libra project. In response, Facebook publicly stated the defections were “liberating” and understands why these companies chose not to continue taking the regulatory pressure. Given the significant regulatory hurdles that stand in the way of Libra’s successful launch, Facebook’s proposed privacy-killing “new global currency” will thankfully never see the light of day in its current form.

Maine Bans ISPs From Selling Personal Information Lacking in Consent

On June 6, 2019, Maine joined a chorus of state legislatures moving on data privacy – this time requiring providers of broadband Internet services to obtain express consent before using a consumer’s personal information.  Specifically, the new Maine law reads:  “A provider may use, disclose, sell or permit access to a customer’s customer personal information if the customer gives the provider express, affirmative consent to such use, disclosure, sale or access. A customer may revoke the customer’s consent under this paragraph at any time.”  

Maine’s law is even more restrictive than California’s Consumer Privacy Act which will deploy an “opt out” mechanism requiring the consumer to inform data processors of their preference.   Both Californians and Mainers will have to wait until 2020 to benefit from their respective data privacy laws – with the Maine statute taking effect on July 1, 2020. 

As reported in The Hill, tech lobbyists are now exerting their best efforts on obtaining a federal law that will moderate this and other consumer privacy state gains – which is not surprising given even stricter data privacy laws percolating in other states.   Whether or not certain data privacy provisions die in a preemption skirmish, data rights will continue their reimagination by market forces so lobbyists alone can never prevail in their clients’ war against true individual data ownership.

Will Proposed NY and NJ Data Privacy Laws Lead to Federal Preemption?

On June 5, 2019, the NY State Senate passed the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) to beef up its data breach notification law whereas a month earlier the New Jersey Governor signed into law an amendment to the New Jersey data breach notification law.  This is the first act in what may lead to significant new privacy laws emerging from these sister states.

New York now is now moving on a bill, S5642, that is even more protective than the California Consumer Privacy Act while New Jersey is in the process of merging two proposed bills that may lead in the same direction. There has been opposition to these proposed laws by those companies who have the most to lose by stringent data privacy controls.  

If passed, however, these new laws may actually prod Congress to finally move on a comprehensive privacy framework – one that might preempt aggressive laws such as the ones proposed by New York and New Jersey and the one already passed in California, in favor of a much more tempered approach.  

In other words, the Internet Association and its lobbying partners may actually win the war if these bills are enacted and it can just get Congress to act in a preemptive manner.  Thankfully, the momentum has been consistently on the side of consumer protection and any hope of bipartisan action on the part of Congress remains a long-shot given the current political environment.

Is Facebook Dead Man Walking?

Whether Facebook survives as a social media platform may eventually hinge on a metric that has not been widely reported – which is ironic given what has recently been reported is hardly good news.   

On April 24, 2019, Facebook, Inc. estimated that it would incur a loss in the range of $3.0 billion to $5.0 billion as a result of privacy violations investigated by the Federal Trade Commission – which does not even take into account other pending privacy investigations including a report released on April 25, 2019 by Canadian privacy regulators.  Also, paying the FTC up to $5 billion will not save the company from the onslaught savvy class action lawyers will unleash the day after the FTC settles.  

Almost comically, on April 29, 2019, Facebook, Inc. announced what it likely thought was a successful PR coup, namely the funding of privacy research shepherded by two partner organizations, Social Science One and the Social Science Research Council.  Not surprisingly, there was no mention that Facebook would be provided specific recommendations from these organizations let alone have such recommendations eventually adopted by the company.  

Facebook’s privacy regulatory threats are not limited to those found in North America – Germany is attacking the core of Facebook, Inc.’s advertising business model and there are several potentially ruinous GDPR complaints that were filed against it the day that privacy regime became effective.   As previously stated with regards GDPR:  “Facebook will soon be in uncharted and unpredictable privacy waters where disclaimers and popup consent forms may not easily tread.”  

A different sort of threat to Facebook can be found in the decentralized Internet currently being built by start-ups such as Blockstack– which recently filed a SEC Reg A+ offering for $50 million by way of a subsidiary.  Blockstack looks to leapfrog centralized platforms such as Facebook by building tools for a “decentralized computing network and app ecosystem” that includes decentralized storage allowing for porting of app data across social media platforms as well as self-sovereign user IDs that would allow for single user identities and passwords across every online application.  

More than likely, however, the most damaging threat to Facebook in the near term is the platform’s continued drop in customer engagement.  As recognized by Lou Kerner:  “On April 24th, 2019, Facebook reported Q1 ’19 earning, and once again, Wall street applauded, sending the shares up 8%, adding another $45 billion in value. While some saw triumph, and others saw further reason to break Facebook up, all I saw was continued decline in the only metric that matters, engagement.”  

Kerner’s graphic on the steady decline of daily and monthly active Facebook users is ominous:

Notwithstanding its many privacy transgressions and current regulatory/litigation challenges as well as the future advent of a decentralized Internet, what likely will be the most direct cause of Facebook’s downfall as a platform stems from the simple fact users have been steadily moving away from using it.

Apparently, users have taken the advice of WhatsApp co-founder Brian Acton and have chosen to “delete Facebook.”  Even though Facebook, Inc.’s present cash reserve and its other popular applications would likely allow the company to continue as a viable entity for many years even without its eponymous platform, those present users who spend hours each day on Facebook – and have no desire to ever abandon it, might just not be enough to sustain the Facebook platform in the long term.  

Simply put, with shrinking levels of engagement the Facebook platform may eventually go from a MySpace to Vine.

Google Cy Pres Fund Case Goes Back to District Court

On March 20, 2019, the Supreme Court deferred ruling on the settlement of a class action brought against Google.  The underlying action was based on Google’s transmission of a users’ search terms, i.e., “referrer headers”, to its actual clients.   Class counsel argued that the transmission and storage of these referrer headers was in violation of both federal and state law given those conducting the searches never gave proper consent.  

In remanding the case to address a potential lack of standing, the Court ruled “[b]ecause there remain substantial questions about whether any of the named plaintiffs has standing to sue in light of our decision in Spokeo, Inc. v. Robins, 578 U. S. ___ (2016), we vacate the judgment of the Ninth Circuit and remand for further proceedings.”  This was obviously the correct ruling given a court cannot even hear a matter unless there is proper standing to sue. Given that the Supreme Court only decides matters properly on appeal and the question of standing was not put before it, the matter required a remand.

Disregarding the tortious procedural history of this near-decade old case or the reasons why standing may not exist, this case will hopefully substantively address the court-approved settlement that would require “Google to include certain disclosures on some of its webpages and would distribute more than $5 million to cy pres recipients, more than $2 million to class counsel, and no money to absent class members.”  In other words, the Court will hopefully decide whether the lower court improperly approved the settlement given the individuals purportedly harmed would not have received a penny and the alleged improper conduct described in the complaint would have still continued unabated.  

In his Dissent, Justice Thomas believed the bare minimum threshold of standing was met and the case should have been reversed on substantive grounds because the cy pres fund settlement was violative of the Rules as it offered no compensation to the certified class.  As previously discussedcy pres fund settlements – which can provide millions to advocacy groups approved by the defendant, hardly evoke the hallmark of justice given those purportedly harmed actually receive nothing.  Indeed, the use of cy pres funds has long been “a troublesome trend in privacy class action settlements given it allows plaintiffs’ counsel to quickly file and resolve class actions before  actual damages can be made readily apparent.” It is no surprise various Attorney Generals have pushed hard against these sort of settlements.

As pointed out by one of the attorneys who appealed this Google case to the Supreme Court, today’s ruling likely “simply delays the day of reckoning for this unfair practice.”  Justice Thomas recognized today that there was something particularly odious about a settlement that only benefited lawyers and those third-party organizations acceptable to the Defendant.  Hopefully, in the near future the full Court will reach the same conclusion and put an end to this unsavory practice of rewarding a defendant’s “non-profit partners” rather than the actual litigants.

California Continues to Lead the data privacy Way

On February 22, 2019, an amendment to the CCPA – S.B. 561, was proposed that would do away with a cure provision, expand the statutory damages provision to any violation of the law, and limit the role of the Attorney General in policing violations by directly passing along greater rights to consumers.  If passed, these changes will significantly alter the reach of the law by making the plaintiff’s bar’s arsenal even wider and the law’s penalties that much stronger.   Previously, the California Consumer Privacy Act – which will come online in 2020, was the first major privacy initiative to provide for statutory damages in the event of a data breach.

California’s Governor also recently said that he was “now convening a team to look into the creation of a new law requiring technology giants to kick back some of their billions in earnings in the form of a Data Dividend for Californians.” California is not waiting around for federal privacy action – it is outright looking to lead the world when it comes to the creation of statutory privacy rights.

UPDATE: April 4, 2019

On April 4, 2019, Senate Bill 753 was proposed to amend CCPA and provide for a major new exception to the law’s reach. If passed, “a business does not sell personal information” under CCPA if the following applies:

(E) (i) Pursuant to a written contract, the business shares, discloses, or otherwise communicates to another business or third party an online identifier, an Internet Protocol address, a cookie identifier, a device identifier, or any unique identifier only to the extent necessary to deliver, show, measure, or otherwise serve or audit a specific advertisement to the consumer. (ii) The contract specified in clause (i) shall prohibit the other business or third party from sharing, selling, or otherwise communicating the information except as necessary to deliver, show, measure, or otherwise serve or audit an advertisement from the business.

In effect, there would be a Google and Facebook exception to CCPA.

It remains to be seen whether this amendment proposed by State Senator Henry Stern will ever be enacted but the mere fact it was proposed is a stark reminder that those companies with the most to lose have not stopped fighting this battle – whether by way of this proposed amendment to CCPA or by way of a broad preemption quest in Congress.

UPDATE: April 24, 2019

In opposition to S.B. 753, a coalition of privacy advocates wrote: “In sum, this new exception would remove the ability of consumers to prevent the dissemination of their personal information from the website they are visiting to any third party, allowing their personal information to flow unchecked into the ad-exchange system, after which a consumer can never regain future control. ”

As reported by DLA’s Jim Halpert, during the Senate Judiciary Committee Meeting of April 23, 2019, State Sen. Stern apparently bowed to the pressure and withdrew S.B. 753 from further consideration.

In addition to S.B. 561, the other amendment most likely to see success is State Assemblywoman Jacqui Irwin’s A.B. 873 – which places parameters on de-identified information and limits the present potentially unbounded scope of “personal information”. Thankfully, given the attention being placed on these issues, it is very likely that the ambiguities rushed into the statute’s initial draft will be sorted out and corrected before CCPA comes online in 2020.

UPDATE: September 16, 2019

On September 13, 2019, the California Legislature adjourned with significant amendments to the California Consumer Privacy Act firmly ready for the signature of Gov. Gavin Newsom.  There were two noteworthy amendment bills that ultimately passed, AB 25 – which provides a one-year moratorium on CCPA’s application to employee, beneficiary and emergency contact information,  and AB 1355. One proposed amendment was withdrawn for consideration until next session.  Other changes to CCPA, including AB 1146, AB 874, and AB 1564 either do not alter in any material way the spirit or intent of the law or are redundant to changes found in AB 1355.

Three of the changes found in AB 1355 are noteworthy given in some very real ways they cut away from the meat of the law.  First, by modifying the definition of “personal information” to mean “reasonably capable of being associated with” a particular consumer or household, instead of just “capable of being [so] associated”, CCPA now has a reasonableness component that gives companies a strong new argument that can be used when defending a breach claim brought in a private action.  Moreover, the AB 1355 amendments clarify that deidentified and aggregate information are exempt from CCPA – in effect, giving most social media platforms their sought-after CCPA safety hatch. 

And finally, the AB 1355 Amendment states that the reasonableness of charging a different price or rate or providing a different level or quality of goods or services for the use of data should be measured in relation to the value of the personal information to the business, not to the consumer as it was previously written.  Given most social media platforms and data brokers actually place very low values on consumer data, this change is of obvious great significance.  Overall, these and other minor changes only benefited data merchants to the detriment of consumers.

Facebook’s utility chicken has come home to roost

On February 7, 2019– in a devastating blow to global surveillance advertising, Germany’s antitrust arm, the Federal Cartel Office, ruled that Facebook’s tying of its data collection practices to usage of its services was unlawful.  In the public announcement of this ruling, the FCO president Andreas Mundt said:  “Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user accounts.” 

Not surprisingly, Facebook immediately blogged that it would file an appeal of this potentially ruinous ruling.  Though not ultimately based on the lack of “freely given” consent under GDPR, the ruling may ultimately have the same impact as if it were.  Interestingly, Facebook has previously shouted from the roofs that it was compliant with GDPR but never warned of a potential antitrust exposure – including in its most recent Annual Report.  

Other countries may also choose to use the antitrust route rather than wait on the pending Complaints filed against Facebook.  None of this should come as any surprise to Facebook given its own CEO saw the company as a “social utility” well over a decade ago.   

Interestingly, the FCO ruling considers the harm derived from Facebook’s data collection practices as the user’s “loss of control” rather than any specific pecuniary harm.  If affirmed, this novel antitrust ruling could be a watershed in surveillance advertising sufficient to crack the existing digital ad ecosystem and allowing for new business models to finally take hold.