Enacted in 2018 over the vigorous objections of Silicon Valley tech giants, California’s first-in-the-nation online privacy law took effect Jan. 1, 2020. But with the staff of state Attorney General Xavier Becerra still far short of finalizing an enforcement framework, it’s unclear what effect the California Consumer Privacy Act will have in the short term.

The law’s most important provisions appear straightforward. Californians can ask companies which collect information online what information they have on them. Companies must delete this information upon request. Websites with third-party trackers must make it easy for consumers to opt out of having their information sold by having a visible button allowing them to quickly do so on their home pages.

But echoing the warnings of the California Chamber of Commerce, there’s confusion on how much information companies can retain on their customers – as opposed to information on those who have visited websites or use phone applications. There are also questions about what constitutes the sort of data that consumers should be able to control.

Facebook, Google have different view of law’s scope

“Companies have different interpretations, and depending on which lawyer they are using, they’re going to get different advice,” privacy software executive Kabir Barday told the New York Times.

This is plain in the contrasting plans of California’s two most high-profile tech firms.

Facebook told advertisers in early December that it had no plans to change data-collection policies because it doesn’t believe that “routine data transfers” about consumers fit the definition of selling data contained in the California law, according to a Wall Street Journal report.

Google, however, has put up a website that says the company welcomes the California law and will fully adhere to its intent of letting consumers control their personal data. The company is telling advertisers that consumer data can only be used for fraud detection or to measure online views of ads – and never to try to ascertain the buying habits or product searches of individuals.

Meanwhile, the Experian credit-reporting service told Becerra’s office that it strongly objected to having to provide consumers with “internally generated data” about them, arguing that such information is proprietary and isn’t akin to snooping on individuals’ online search habits and histories.

The Evite company that lets people send out personalized online invitations to parties or events has taken a different tack: using its privacy policy page to make the case to users that the information it collects is used in benign ways that benefit users and improves the services Evite offers.

The law does not apply to businesses with annual revenue of less than $25 million that do not buy or sell personal information on at least 50,000 people a year.

Becerra expects to have guidelines finished by summer

Becerra issued draft guidelines for how the law would be implemented in October. His office is now evaluating the complaints and comments it got from privacy activists, affected companies and others. The goal is to have the regulations in place by the middle of the year.

A key question going forward is how hard Becerra will come down on the 100-plus “data broker” firms in the U.S. which accumulate and sell the most personal of information yet have managed to escape much attention. An investigation posted by the Fast Company media website last March detailed how “if you use a smartphone or a credit card, it’s not difficult for a company to determine if you’ve just gone through a break-up, if you’re pregnant or trying to lose weight, whether you’re an extrovert [and] what medicine you take.” Jewelry sellers, for example, can get customized lists of which consumers have a history of buying expensive gifts on Valentine’s Day.

The firms’ ability to provide such detailed, specific information could be widely curtailed if enough consumers opt out of sharing their personal information – at least if they’re based in California or a state or nation with similar rules. But since such data mining can be done about Americans by companies based in nations with no such rules, it’s certain to continue. A likely future policy fight is over whether California companies should be banned from obtaining such personal information from firms that don’t honor online privacy laws like the Golden State’s.

After keeping quiet for more than a year about the investigation, California Attorney General Xavier Becerra confirmed last week that California is suing Facebook after a state probe found it had allegedly violated privacy laws.

In documents filed with the Superior Court in San Francisco, Becerra’s office said the probe began in June 2018 in response to the scandal involving the Cambridge Analytica political consulting firm, which had been given access to the online activities of 87 million Facebook users without their knowledge. The most prominent client of the firm, which closed last year, was the Trump presidential campaign in 2015-16.

“What initially began as an inquiry into the Cambridge Analytica scandal expanded over time to become an investigation into whether Facebook has violated California law by, among other things, deceiving users and ignoring its own policies,” the court filing noted.

The possibility that California was pursuing its own probe was detailed in an Oct. 31 story in the New York Times about Becerra’s absence from a meeting of state attorneys general in September in Washington in which they discussed a coordinated probe of Facebook and Google. Becerra continues to decline to answer if his office is investigating Google.

And the attorney general said the Facebook probe would still be unrevealed if it wasn’t for the fact that the Menlo Park-based company had stopped cooperating when given subpoenas. “If Facebook had complied with our legitimate investigative requests, we would not be making this announcement today. But we must move our investigation forward,” he said at a news conference.

The state’s complaints about Facebook not following its own policies and stonewalling investigations echoed those made by officials of the Obama and Trump administrations. These practices were cited in July when the Federal Trade Commission announced it had fined the social media giant $5 billion for privacy violations.

Probe seen as foreshadowing new state online privacy law

Becerra’s announcement was followed closely on tech websites not just because it ended the mystery about what his office was doing about Facebook when so many other states were pursuing the company. It’s also because the Golden State’s lawsuit is seen as a harbinger of how aggressively Becerra will act when the state’s landmark online privacy law – the California Consumer Privacy Act – takes effect on Jan. 1, 2020. The law was signed into law by then-Gov. Jerry Brown in summer 2018.

The state law is similar to a measure adopted by the European Union that took effect earlier in 2018. The EU law says consumers can opt out from having information collected about them. If they don’t opt out, consumers must be told upon request what information has been harvested from their online browsing.

Data companies are deeply worried that California’s standards will become the model for a future federal online privacy law and for measures adopted in other states. But many other firms are worried as well.

This summer, as CalWatchdog reported, the California Chamber of Commerce and the state chapter of the National Federation of Independent Business launched a long-shot bid to get lawmakers to change their minds and either repeal or revise the state online privacy law.

Among the business groups’ complaints: The law is written so broadly that it may prevent businesses from using basic information gathered from repeat customers; and the law is so poorly crafted that it appears to bar businesses from using vast swaths of anonymized data showing online trends from a macro level. Such information is considered a crucial marketing tool.

Lawmakers passed on making any changes.

A far-reaching online privacy bill that got next-to-no vetting or legislative debate was

Assembly Bill 375 – the California Consumer Privacy Act of 2018 – would change the playing field in the relationship between users of some online services and the companies that provide the services. It would allow users to ask companies to delete their personal information and to be informed what information about them that the companies were collecting and selling. It would also allow online consumers to sue over some unauthorized breaches of their information – but only for up to $750.

The San Francisco developer who reportedly spent more than $3 million to gather signatures for his ballot measure told the Sacramento Bee that AB375 – while not as far-reaching as his proposal – was more than good enough. Alastair Mactaggart said he was willing to compromise and gain “certainty” of online privacy reforms rather than take on tech giants in a heavy spending free-for-all in the fall election. He pulled his initiative after AB375 was signed by Gov. Jerry Brown on Thursday afternoon – just before the deadline for its possible withdrawal with the Secretary of State’s Office. Brown’s signing came after the bill won unanimous approval from both the Assembly and Senate.

The process under which a measure that qualified for the ballot could be pulled if proponents were satisfied with the Legislature’s alternative was established in a 2014 state law that was billed as an important refinement to the state’s system of direct democracy. The bill was championed by then-Senate President pro Tem Darrell Steinberg, D-Sacramento.

The most important differences between Mactaggart’s proposal and AB375 is that it gives tech companies more certainty of their own that there would be legal limits on their exposure to damage claims from those using their services.

The bill quickly made it to Brown’s desk despite warning from key players.

Tech lobbyist: At least ‘even worse’ measure is dead

The Internet Association, a lobbying group for tech firms with significant online presence, issued a statement decrying “many problematic provisions” in the bill and “the unprecedented lack of debate or full legislative process.” But the association said it would not “obstruct or block AB375 … because it prevents the even worse ballot initiative from becoming law in California.”

The state Senate Judiciary Committee, which approved AB375 on Tuesday, did so even though chairwoman Hannah-Beth Jackson, D-Santa Barbara, expressed “grave, grave concerns about this legislation” to the San Francisco Chronicle. But she also praised its consumer-friendly elements, which take effect in 2020.

While California, as the nation’s largest and wealthiest state, often finds its policies emulated by other states, it’s not clear if AB375 will be copied in other capitals. Companies like Google, Amazon, Comcast and AT&T have steadily increased lobbying and campaign contributions in many states and may try to get what they consider model online privacy legislation passed elsewhere – so it could in theory compete with California’s version.

However, Facebook voiced its support for the state bill. “While not perfect, we support AB375 and look forward to working with policymakers on an approach that protects consumers and promotes responsible innovation,” a Facebook official told the Sacramento Bee.