Response to California Consumer Privacy Act of 2018

I offer this feedback on the California Consumer Privacy Act of 2018, as a member of civil society.

Overall, the current draft of the CCPA is written to protect businesses and government entities by default, enabling them to collect, share and sell people’s data without our knowledge or consent. “Consumer Privacy” is a misnomer, since our data is not protected by the California Consumer Privacy Act. The lack of transparency into data usage practices has led to an economy of exploitation and targeting that goes far beyond business use cases and also extends to government research which we are not made aware of, and which the CCPA itself acknowledges is problematic. People are not proactively informed in a meaningful manner, of the specific use cases of these trades, nor are we given an easy way to opt out, nor are we properly compensated for the use of our data.

The CCPA does a good job of addressing the themes related to privacy, and those should remain in its final iteration. But the current draft conceptualizes people as consumers, and consumers as passive entities. This is problematic given that people use the internet for reasons other than commerce, and that we live in a democracy, and democracies rely on active participation. If the CCPA’s purpose is to protect people’s privacy, it should take a human-centric approach, not a business-centric or government-centric approach. It must be written in plain language that’s easy for people to understand so we can use it; it must not have any loopholes; and it must, above all, avoid negating itself.

Given the fact that most technology companies are headquartered in California yet the people who use the technologies live throughout the United States and far beyond our country’s borders, I recommend that members of Congress work with their colleagues to make federal privacy protections. Many of the most extreme harms caused by data collection, use, sharing and selling are addressed in the EU AI Act, which was stress-tested in a policy sandbox before being ratified. I recommend US lawmakers review it before drafting federal law. Finally, the US should form an alliance for mutual defense.