California privacy law is Facebook’s next ‘nightmare’

The CCPA officially became California law on January 1 and began being enforced by California Attorney General Xavier Becerra on July 1 after a six-month grace period. Asked about it near the end of the company’s earnings conference call last month, CFO David Wehner launched into a lengthy speech about its impact on advertising, the lifeblood of Facebook.

“You know, in the short term, it’s really around the implementation of the CCAC. And in the longer term, there is more potential for similar regulation around the world, ”Wehner said. “Today we are seeing an impact on CCPA’s activities. We don’t know what the impact will be. How things go will depend on the advertiser’s implementation, adoption rates in terms of opting out of tracking. So there is a lot of uncertainty as to how it will unfold.

Wehner did not offer details, but Facebook has taken several steps over the years to comply with the CCPA. Indeed, the depth and tone of his response showed greater concern for him than the July advertising boycott of more than 1,100 companies for objectionable content on the social network. The boycott, which included Coca-Cola Co. KO,
+ 0.49%
and Ford Motor Co. F,
-0.57%
, should have minimal impact on Facebook sales.

Learn more: Boycott of Facebook advertising could be more profitable for businesses than Facebook advertising

The CCPA’s ominous legal cloud, which a data security expert calls the most ambitious law affecting California businesses, goes far beyond Facebook. According to Kimball Parker, CEO of SixFifty, the technology arm of prominent Silicon Valley law firm Wilson Sonsini Goodrich & Rosati, some 500,000 companies across the country that process data in the Golden State are affected by the general rules. of the law.

CCPA gives Internet users the ability to see what information is collected about them and to prevent the sale of that data. It empowers the California Attorney General to punish the worst offenders, with fines of $ 2,500 to $ 7,500 for each offense. The law applies globally to businesses that meet one of these three criteria: annual sales of $ 25 million; more than half of its income from the sale of consumer personal information; or processing the personal information of more than 50,000 California residents.

“For businesses, it’s a nightmare,” Parker told MarketWatch.

See also: What Google and Amazon are doing to comply with California’s new privacy law

In addition to a legal process that alone costs $ 150,000, businesses must invest in technological tools to adhere to the new rules. “It’s the small businesses, like a Sacramento Natural Food Co-op supermarket that is one of our customers,” Parker said.

Of course, Facebook and Alphabet are the most at risk because they affect billions of people and each violation of the law is punished with a fine of $ 2,500 to $ 7,500. “The fines add up,” Parker said.

The law has already taken a heavy financial toll on Facebook. The social media giant claims it has spent billions of dollars to beef up its privacy and security features to comply with laws such as the CCPA in the United States and the General Data Protection Regulation, or GDPR, in the ‘EU.

At the same time, Google and Amazon.com Inc. AMZN,
+ 3.53%
– which, along with Facebook, hold more than 60% of the U.S. digital advertising market – have taken significant steps to enforce the new law.

Facebook maintains that its data policy, with updates related to the CCPA, includes information on the different types of data it collects, how the company’s products work, and an update on what California consumers must do to exercise their CCPA rights. In June, the company released a feature, Limited Data Use, which limits how Facebook uses partner data by requiring Facebook to act as a service provider when processing information from California residents. .

“We have created dozens of teams, both technical and non-technical, that focus only on privacy, and we currently have thousands of people working on privacy related projects and we are hiring many more,” a Facebook spokesperson told MarketWatch. “For example, we have created self-service tools that allow people to access, download and delete the information they share on our service. We make these tools available to everyone on Facebook, wherever they are. “

The impact of the law is rumored in Facebook’s Form 10-Q for its recently completed second quarter. The CCPA is mentioned seven times, compared to 40 mentions of COVID-19 and nothing on the boycott.

“These laws and regulations [in particular, CCPA and GDPR] evolve and are subject to interpretation, and the resulting limitations on our advertising services, or advertising reductions by marketers, have to some extent negatively affected and will continue to negatively affect our advertising activities, “according to the 10-Q report. “Each of these events could have a material adverse effect on our business, reputation and financial results.”

There is little debate about the law’s most significant impact on the digital advertising ecosystem, warns Julian Baring, general manager of the Americas at Adform.

“The CCPA is the latest example of a slow march of regulation encroaching on their business models,” Baring told MarketWatch.

Learn more about the CCPA: what it does, what’s changed and what it means for investors

The parade of data privacy laws was largely sparked by Facebook’s Cambridge Analytica scandal, when the London-based political consultancy acquired and used the personal data of 87 million Facebook users without their permission.

“It was a watershed moment for consumers and for privacy,” says Pam Dixon, founder of the World Privacy Forum, a nonprofit public interest research group. “We have [the European Union’s GDPR], CCPA and a suite of CCPA. The cost to businesses has been considerable [financially], and takes time for individuals to participate. “

Formed by real estate millionaire Alastair Mactaggart, the CCPA is widely applied to any business with an annual turnover of $ 25 million; derives more than half of its income from the sale of consumers’ personal information; or processes the personal information of more than 50,000 California residents.

See Also: Millionaire Behind California’s Privacy Law Wants To Be Even Tough On Big Tech

If that doesn’t complicate operations for Facebook and others, its November ballot successor, the California Privacy Rights Act of 2020, or CPRA, could make matters more difficult. This would give consumers more control over what he calls “sensitive personal information” such as a person’s race, health, social security number, and recent locations using GPS technology. If adopted, consumers would have the right to prevent the sale or use of this data for advertising purposes.

More importantly, the ACPL includes the creation of a five member state agency to enforce privacy protections, instead of the state attorney general under the CCPA.

“Under [CPRA], a consumer can limit the use of their sensitive information to stop Uber UBER,
+ 0.56%
to profile them according to their race, stop Spotify SPOT,
-1.19%
to use their precise geolocation and to prevent Facebook from using their sexual orientation, health or religion in its algorithms, ”said Carmen Balber, executive director of the nonprofit Consumer Watchdog, in a comment. communicated.

“CAPL is coming in another year, and that’s another barrier that is completely prohibitively expensive for most companies,” Parker says.

Businesses should expect privacy to be a central concern for years to come, warn data experts.

“Facebook and Google are under so much regulatory pressure, they have the resources, the money and the lawyers to be on top,” says Richy Glassberg, CEO of Safeguard Privacy, which helps hundreds of businesses meet CCPA guidelines. “Everyone’s fucked up. It’s a continuum to stay one step ahead of privacy regulation. A year from now, Mactaggart’s new law will look more like GDPR. We will talk about it in a year, if that passes.

See also: This California lawmaker attacks SmileDirectClub

For now, in a new world order of CCPA, most companies are content to comply as much as the law requires without reorganizing their business operations at a high cost and possibly weakening their product lines, say experts in security.

“They sidestep or respect the line while continuing the same old business model,” says Fredrick “Flee” Lee, director of security at Gusto, who has written extensively on CCPA, most recently for Harvard Business Review.

“There is an inverse monotonous relationship between privacy and value,” Vasant Dhar, professor at the NYU Stern School of Business, where he is director of the Center for Data Science, told MarketWatch. “The more someone knows about you (less privacy), the more valuable they are. CCPA introduces friction (you now have to MANAGE being RESPONSIBLE etc compared to the Old West days so that’s a cost), and it’s more difficult to tie the data together, which is where it is. finds great value. “