<hl>How will this new privacy legislation affect the lives of Californians, Americans, and maybe even regulations worldwide?<hl>

The California Consumer Privacy Act (CCPA) hasn’t even celebrated its first anniversary, and a new set of rules is already joining the Californian privacy party. Prop. 24, which recently passed, has been praised and criticized by many. The proposition, which will come into effect in 2023, establishes a dedicated agency to handle the compliance of these privacy regulations. The California Privacy Protection Agency will take over the responsibilities from the CA Attorney General to enforce the law and fine companies that fail to adhere to it. This new law will also give users additional privacy rights, including the ability to opt-out of cross-web tracking.  

Prop. 24 will allow internet users to limit companies’ use of sensitive data such as location or religion and prevent businesses from keeping user data longer than necessary.

At the same time, only businesses conducting transactions involving at least 100K consumers or households would have to comply with the new regulation. The new regulation also allows companies to track more information that is now considered public, such as social media posts, and offers companies the possibility to refuse users who ask to delete their data if they deem it necessary for their platform’s security. Since this Californian legislation sets the tone for privacy discussions and regulations on a federal level and maybe even worldwide, it’s crucial to understand how it will affect Californians’ lives. It may come with no surprise that everyone seems to have something to say about Prop. 24, from tech companies, civil organizations, private users, and yours truly.

Much remains unknown

As I’ve mentioned, the proposition will only go into effect in 2023. As we’ve all learned in the past year, a lot can change by then. Considering the pace at which technology evolves, chances are that there will be additional work to do on the legislators’ part. Perhaps that’s why we’re witnessing this new regulation that is said to practically replace the CCPA less than a year after the highly-anticipated law was initiated. Now that digital procedures are accelerated worldwide due to COVID-19, we’ll see many more issues regarding online privacy joining the debate, like location tracking, which will also impact the law’s relevancy a couple of years from now.

Another thing we don’t know is how, exactly, the state agency created by the law will choose to manage this critical task. This could make or break its impact, and we’ve seen important regulations fail to make a difference because of poor enforcement. In a sense, that’s why Prop. 24 was needed in the first place; CCPA set high standards but could not execute them and deliver on its promise because of the limited resources and time at the hands of the CA Attorney General.

Internet users cannot be expected to wait years for an actionable solution, nor should they be expected to place the future of their data in the hands of an agency that may or may not protect it. The need for independent information monitoring has not diminished one bit, at least not at this point.

Is this a step back in terms of data ownership?

The problem with online privacy regulation is that it is often built on certain assumptions we don’t want to cement. Legislators who failed to consult with online privacy experts may think they’re doing the right thing when in fact, they harm years of delicate educational efforts.

Our goal at Mine is to change the conversation around privacy to data ownership. We want people everywhere to know that their information is undeniably theirs and that they have a choice when it comes to their data. It doesn’t belong to tech giants, nor is it government property. Proposition 24 is ambiguous about that assumption: On the one hand, it redefines important data rights and is a step in the right direction when it comes to compliance; on the other hand, it misses some big points in allowing small companies to escape regulation. It may come as no surprise that some of the notable critics of the proposition were not tech companies, as one might expect, but instead privacy groups like the Electronic Frontier Foundation and the American Civil Liberties Union of North Carolina.  

When legislators mention expanding our right to opt-out, what they’re actually saying is that the default will continue to be opt-in. They also send the alarming message that a state agency can define whether certain information is considered private. Some of the notions upon which Prop. 24 is based pull the carpet from under the feet of online privacy advocacy. Every person should decide for themselves what data is deemed private and which information they are <hl>willing to share with businesses and organizations<hl>. That is what I believe is the real data ownership.

A penny (or many) for your data?

Another issue is the law’s enablement of data-based incentives offered by companies. It is more than possible that online businesses will offer a discount in exchange for their consent to share data with the company and 3rd parties. If we genuinely consider data to be sacred, it should not be traded this way. Privacy groups rightfully argue that low-income users will not have the freedom to refuse these offers and will be forced to give up their data ownership.

Excited for the future of data ownership

Despite these critical questions, we at Mine are definitely happy to welcome new discussions and regulations around online privacy. We believe that additional legislative and public awareness is important and that together, internet users can direct the conversation towards a better outcome. More specifically, Proposition 24 provides a solution to one of the major problems of CCPA, which is the lack of enforcement and budget, and might pave the way for a much needed federal privacy regulation. Prop. 24 fixed one hole in the bucket and created a few new ones, but Rome wasn’t built in a day and we’re hopeful for the future.

We at Mine promise to continue our efforts in encouraging people to take ownership of their data and lead this social movement. Let’s get involved and steer the public process to win back people’s freedom of choice over their data. It’s time for the future of data ownership.