The activist who spurred California to adopt the country’s first-ever consumer privacy law is readying for another battle: a new ballot initiative that would be even tougher on tech giants and other big businesses that collect people’s personal information.
If the initiative passes, it would grant Web users in the Golden State new rights around their sensitive information, such their health and financial records or precise location. Consumers would have to give their permission before such data could be sold, and they would gain the ability to block companies from monetizing those sensitive insights through targeted ads.
Mactaggart’s proposal also includes the creation of an agency in California to enforce privacy protections, along with tougher penalties for mishaps involving children under age 16. And it would require companies to demystify their secret algorithms when such software is used to profile a person, such as determining their employment prospects or their ability to obtain housing, credit cards, loans or other key services.
The campaign by Mactaggart and his organization, Californians for Consumer Privacy, once again threatens to touch off an expensive, high-stakes war between consumer advocates and well-funded corporations in Silicon Valley and beyond. Many businesses have said that federal regulators, not those in the states, should set a national standard for online privacy. Yet Washington remains paralyzed by indecision, partisan gridlock and industry lobbying, and unable to write widely sought rules protecting privacy even after years of continued scandal.
“Privacy, I think, demands a greater set of protections,” Mactaggart said in an interview, later adding of the fight to come: “I hope it’s not a situation where we have another $6 trillion market cap opposition” — a reference to the value of the publicly traded companies his effort targets.
Two years ago, Mactaggart sought to muscle privacy protections into law much as he is now — by putting the idea before voters. He said he spent more than $3 million of his own money on a ballot initiative that initially drew sharp opposition from tech giants such as Facebook, Google and Uber, whose privacy abuses inspired Mactaggart to act in the first place.
But his campaign obtained more than 600,000 signatures, twice as many as he needed to put the matter to a referendum. The strong show of support forced state legislators, tech companies and privacy advocates to broker a compromise on legislation, which they adopted in 2018.
Those protections under CCPA take effect Jan. 1, having survived an all-out, last-minute assault from Facebook, Google and other corporate giants. The law as it stands will grant Web users the ability to see what information is collected about them and stop that data from being sold, while empowering California’s attorney general to penalize the worst offenders. Tech giants had sought to tweak key elements of the rules before the state’s legislature adjourned Sept. 13, but those efforts failed.
“Industry wanted a lot,” said Justin Brookman, the director for consumer privacy and technology policy at Consumer Reports. “They didn’t get a lot.”
Even as he hailed the law, though, Mactaggart stressed in an open letter announcing his new ballot initiative that CCPA “now seems insufficient,” citing incidents ranging from Facebook’s entanglement with Cambridge Analytica and the security breach at Equifax, a credit-reporting bureau, that exposed more than half of all U.S. adults’ data. He said in an interview that the “landscape has changed dramatically,” warranting another push to grant California residents privacy protections through the ballot box.
Some elements of the proposal won early support from organizations such as the Electronic Frontier Foundation, where Adam Schwartz, a senior staff attorney, said more protections around sensitive personal data — and the ability to block ads targeting it — would be a “step forward.”
But Schwartz, who said EFF is still reviewing the ballot initiative, said it could have gone further in one respect: allowing consumers to sue when their privacy has been violated. The idea has drawn sharp tech industry opposition.
Along with privacy, Mactaggart’s proposal also wades into the thorny issue of elections. The initiative would require that businesses disclose if they ever seek to use Web users’ data to shape the outcome of an election. Mactaggart acknowledged his concerns are hypothetical, but he cited recent developments in Washington to make the point that caution is warranted. “What we thought were sacrosanct norms can be broken,” he said.
Mactaggart still must embark on a lengthy process that begins with collecting signatures, and he estimates that they will need more than 1 million to put the proposal in front of voters next November. If it is adopted, though, it could make it difficult for industry lobbyists to weaken California’s rules in the future: Lawmakers in Sacramento could only make adjustments if it is in “furtherance” of its stated goal to protect Californians’ privacy, he said.
“My intention is to go to the ballot,” Mactaggart pledged. “This human right deserves special status in California law.”