2020 needs to be the year in which a vigorous debate about online privacy takes center stage. If that happens, it will be at least partly because California's pioneering online privacy law went into effect this year. It gives residents the right to be informed about what data is being collected on them; to request that the information be deleted; and to opt out of letting companies sell this information. Businesses with annual sales of less than $25 million that obtain little online information are exempt.
As often happens, the Golden State's law is likely to be copied by many states and perhaps Congress as well. Unfortunately, the California Consumer Privacy Act is so murky that it is unclear what will result from its implementation. A recent analysis in the Los Angeles Times noted all the unanswered questions about the law: "What does 'sell' mean? How can companies be sure they're deleting the right person's data? And does simply having a website that keeps track of how many people visit each year mean you must wade into the regulatory thicket?" It's also plain that the state doesn't remotely have the resources to monitor the internet and the trillions of interactions that Californians will have online in 2020.
This vagueness — and its traditional corporate arrogance — has already inspired Facebook to announce it won't change its data-collection policies one bit. But in enforcing the new law, California Attorney General Xavier Becerra shouldn't be fazed by any company's deep pockets. A recent series by the New York Times showed that online privacy is a myth. Using information provided by a worker at one of the dozens of companies that track the every movement of consumers to get hints of what they might want to buy, the Times showed how it could track 12 million Americans.
The newspaper's reporting showed that contrary to claims of companies that the information is anonymized, it's easy to quickly determine the names of those being tracked by their phones. The Times raised the prospect that controls on this information are so weak that authoritarian governments — or vengeful ex-spouses — could use this data to bully or terrorize people.
What will check the emergence of Google and Facebook as de facto global superpowers, seemingly answerable to no one? The world shall see. But at the least, the California Consumer Privacy Act is a landmark sign that tech companies can no longer count on the complacency of those they surveil.
FROM AN EDITORIAL IN THE SAN DIEGO UNION-TRIBUNE
