The California Consumer Privacy Act (CCPA) goes into effect on January 1, 2020, but it won’t be enforced until July. There has been much hand-wringing, anticipation and attempts to dilute the legislation by industry.
Anticipating a major change
The consensus among marketers and experts is that CCPA represents a major shift for U.S. digital privacy law that will make it tougher for companies to obtain and use data – especially third-party data brokers and programmatic networks. There’s also an expectation that consumers will exercise their new privacy rights under CCPA.
A brief summary of those rights is as follows:
- The right to obtain disclosure of the categories and specifics of any personal information collected by the site
- An explanation of how the consumer’s data is used and whether it is being sold
- The right to opt-out of a sale of the personal data to third parties
- The right to request that a business delete any personal information
- The right to not be discriminated against because the consumer has exercised his/her rights under CCPA
GDPR experience a preview of burdensome forms
CCPA is often discussed in the same breath as Europe’s GDPR. At the highest level, the key difference between CCPA and GDPR is the latter’s opt-in requirement for data collection and usage, while CCPA is an opt-out framework. I was recently in Europe and have seen the many and varied GDPR opt-in, cookie permission forms that one encounters upon every visit to a new website.
They’re confusing, sometimes painful and, according to my informal discussions with people in Europe, often met by indifference from consumers simply seeking to get to a desired piece of content. This is not to say that people don’t care about privacy – it’s just that many publishers are putting a significant burden on consumers who don’t fully understand all the cookie categories and their functions.
Cookie choice screens under GDPR
One sees a range of choices, including, “accept all,” “reject all” and “manage third party cookies,” among others. The statements and presentation of options are far from uniform. The above graphic offers a few examples of US publishers and how they present cookie options to visitors in Europe.
Worn down by complexity and confusion
The way pages are written suggests an effort to get consumers to click “OK” or “accept all.” But those who drill into their options are often confronted with multiple screens that look like the ones below. These screengrabs from a single site are part of a much longer list of options by cookie category.
Confronting something like this is both confusing and exhausting. Not all sites present the “manage cookie options” in this way. But this type of thing is a huge burden for consumers who just want to read an article or watch a video. Consumers prefer simpler, more binary choices not a menu of options that exceed their levels of comprehension.
GDPR cookie management screens
What’s presented to consumers in a post-CCPA environment will matter in terms of their willingness and ability to exercise their rights. Many publishers, platforms and others will likely replicate the GDPR choice complexity under the theory that most consumers won’t want to pay close attention or have the stamina to exercise their rights. It’s much easier to click “OK” and move on.
Usability will matter, but enforcement will still happen
But if the choices and language are simple, more consumers will likely block the sale or transfer of their data to third parties. That would have a significant impact on the market. By contrast, if it’s too difficult to figure out and execute that choice, most consumers will skip it.
The wild cards in all this are the California Attorney General and plaintiffs lawyers. The attorney general has the independent authority to enforce the law and consumers have a private right of action under CCPA, which class-action plaintiffs’ lawyers will likely enforce. Every business has a 30-day right to cure the alleged problem before any action can proceed or any penalty can be assessed. So, even if individual consumers give up and “accept all” there are other enforcement mechanisms with teeth.
But putting aside the lawyers and attorney general, my guess is that most U.S. consumers are going to react like many of their European counterparts: not pay close attention, not exercise their rights and simply “accept all.”
