Privacy Update: California and Federal Legislation

US trade body the Insights Association has filed comments with California's CPPA aiming to limit the negative impact of the state's privacy rules in the insights industry. Separately, the FTC has begun the process of drafting new privacy rules which are likely to restrict online data collection.

The pioneering California Privacy Rights Act (CPRA) was approved via ballot initiative in 2020 but will come into effect only on January 1st next year, replacing the existing California Consumer Privacy Act (CCPA). The CPPA has recently released draft rules for comment. The IA's Senior VP Advocacy Howard Fienberg says the association's recommendations 'would streamline and improve compliance with a complex privacy law and regulation without diminishing consumer privacy protection'. The IA is lobbying in Washington for a comprehensive federal privacy law, but in the meantime aims for the most helpful privacy environment in the state.

Specifically, among other points, the IA urges the CPPA to 'bring CPRA in line with draft federal privacy legislation and other state laws by adding audience measurement to the list of 'business purposes''; reduce the burden of administration, including from audit and risk assessments, for insight businesses; limit and define the concept of 'significant risk' to highly sensitive information, processed multiple times per year and with large numbers of records; and clarify research's exemptions and 'reasonable use' status.

Fienberg (pictured) comments: 'By aligning CPRA with federal legislation, and laws in Colorado, Connecticut and Utah, the CPPA can ensure the continued independent measurement and evaluation of advertising and content that brings transparency and understanding essential to the functioning of much of the modern U.S. economy. Also, by limiting opt-out preference signal adaptation to only larger businesses, the agency will protect the smallest insights companies from overly onerous regulatory requirements'. Full details are at www.insightsassociation.org/News-Updates/Articles/ArticleID/427/Insights-Association-Urges-California-Privacy-Regulator-to-Treat-Audience-Measurement-as-Business-Purpose-and-Limit-Opt-Out-Signal-Requirements .

Meanwhile at the federal level, www.mediapost.com reports that the FTC (Federal Trade Commission on) began on Thursday drawing up privacy rules that could restrict online data collection, a process 'likely to take years'. Initially, it seeks feedback from the public on issues including 'commercial surveillance' - seen by some as an emotive term indicating a partisan starting point, and defined as 'the collection, aggregation, analysis, retention, transfer, or monetization of consumer data and the direct derivatives of that information'.

In its preamble, the Commission notes that 'Whether they know it or not, most Americans today surrender their personal information to engage in the most basic aspects of modern life'; and suggests perhaps uncontroversially that current safeguards for online privacy by seeking consent on an opt-out or opt-in basis - 'may be inadequate' as permissions given by consumers 'may not always be meaningful or informed'.

The agency's three Democratic commissioners have said they support the initiative, while its two Republicans, Christine Wilson and Noah Phillips, dissent, the latter calling the notice 'vast and amorphous'. Consumer advocacy groups have weighed in in support.

The FTC will hold a virtual public forum on the initiative on September 8th.