Google and Facebook hate a proposed privacy law. News publishers should embrace it.
California voters get a chance to shape internet privacy rules for the rest of the country in November.
While most of America is focused on the presidential vote, Californians have another important decision to make at the polls this November. They’re being asked to approve what will likely become the internet privacy law for the United States.
Proposition 24, also known as the California Privacy Rights and Enforcement Act of 2020 (CPRA), is supposed to expand a landmark California privacy law that passed two years ago; there’s a good chance Californians will approve this one, too. It’s framed as legislation that will better protect their privacy — in particular, sensitive data such as Social Security numbers, race, religion, and health information.
And while the proposed law technically governs the use and sale of data for Californians, California has an enormous impact on the tech industry, which means CPRA will become the de facto law for all of the US.
Which should sound like a good thing for most people. Among other impacts of the proposed law, it makes a point of protecting young people by mandating triple fines for infringements against consumers under age 16. It will allow consumers to restrict the use of geolocation data by third parties, effectively ending practices like sending targeted ads to people who’ve visited a rehab center or a cancer clinic. And it will fund the creation of an agency to protect consumer privacy.
For news publishers, though, any new data regulation can create problems, and news publishers already have plenty of well-documented problems. But I think the proposed enhancements will actually help the news industry.
Fighting the Google/Facebook duopoly
From targeted advertising to personalization, data does a lot of work online. Unfortunately, two companies dominate data collection and therefore digital advertising. One big question about any privacy laws is whether they actually create more advantages for Google and Facebook instead of leveling the playing field for smaller competitors.
We’ve seen this happen before. In Europe, which began enforcing a new privacy law in May 2018, big tech companies have been able to effectively neuter the law by implementing half-measures and exploiting loopholes while enforcement lags.
The good news for consumers and news publishers alike is that CPRA seeks to close any loopholes in the previous privacy law the state passed two years ago.
For starters, the law is supposed to more clearly limit data collection and use for third parties — companies you don’t expect to get access to your data when you visit a news site — while allowing publishers to continue to use data they generate on their own sites.
That makes sense. As we have noted for years, consumers generally expect an app or website to collect data about them to help improve the service, recognize them as return visitors, or to recommend content. But they don’t expect unknown third parties to collect data about them to build profiles and serve targeted advertising on unrelated sites or apps.
That unbridled data surveillance by some big tech companies outside of their own user-facing services — that is, Google and Facebook’s ability to track you even when you’re not on their properties — has undermined consumer trust in the entire digital economy. Giving consumers the ability to control their own data should help restore some of that trust.
Privacy and subscriptions can work together
News publishers are also increasingly interested in trying to sell subscriptions instead of relying on digital ads. CPRA can help there by letting publishers offer subscriptions to consumers who opt out of having their data shared with other parties.
Some CPRA critics think this provision puts a price on “privacy.” I would argue that it gives news publishers the flexibility to decide on their own business model, and gives consumers an opportunity to understand how content gets funded. If they do not find it compelling enough, they are likely to seek out a competitive news service elsewhere. News publishers feel this tension every day. That’s why I think they will see healthy competition for consumers at various price points.
Third parties and liability
Lastly, and maybe most importantly, the CPRA closes loopholes that could be exploited by big tech platforms. One aspect of this is what we’re calling “the switch language,” which clearly aligns the obligations of third parties to serve the interests of consumers. It notes that when a consumer exercises their opt-out rights and a publisher passes their choice along to all the companies with which it works (third parties), those companies must stop reusing that consumer’s data for any other purpose. This essentially forces those companies to revert to the role of a service provider. The “switch language” also prevents any wiggle room by not allowing contracts to override this requirement. As publishers experienced in Europe, platforms like Google and Facebook often use their unbalanced negotiating leverage to force publishers to sign over these data rights, so this section is hugely important for individual publishers that do not have the leverage to force Google or Facebook to stop mining data off their properties.
Finally, CPRA clarifies that publishers are not responsible for third parties that violate the previous section as long as they do not have actual knowledge of the violation. Taken together, these provisions reflect a thoughtful understanding of how data flows in the digital economy. They also put the onus squarely on big tech companies to tailor their data collection practices in accordance with consumer preferences.
Privacy laws are imperfect yet unavoidable
CPRA isn’t perfect, but it’s well-intentioned. And while you might hear tech giants warning that it will hurt publishers, you should consider the source of those warnings, and the motivations behind them.
Consumer expectations are evolving; policy, and our industry, must follow. Yes, there may be some short-term problems as advertisers get used to working with less data and lower the price for the ads they buy. But those playing the long game will be prepared for a world where more value is placed on publishers’ direct relationships — and consumer trust.
Jean-Philippe Behr
