SACRAMENTO — For all the angst it’s already caused in corporate America, the strongest data privacy law in the nation landed on the West Coast last week with a relative whimper. But the flurry of legal notices that accompanied the California Consumer Privacy Act point to regulatory and political drama ahead this election year.
The patchwork of industry responses to California's new privacy regime, which won't be enforced until at least July 1, ensure the law will remain in dispute for many months to come. Adding to the uncertainty, a wealthy privacy champion is preparing a ballot initiative to rewrite the Privacy Act, state Attorney General Xavier Becerra expects legal challenges, and Congress is under intense industry pressure to pass a federal standard that would supersede state laws like California's.
The law requires companies that sell consumers' personal information to post a prominent “Do Not Sell My Info” linkBut large retailers like Walmart and Lowe’s put their "Do Not Sell" links in the same footnote-like font and location commonly used for privacy policies. And they were nowhere to be found on other websites, such as Whole Foods Market, Albertsons-owned grocery stores, Visa or Bank of America.
Spotify concedes in its California privacy notice that "it is currently unclear whether the use of certain types of advertising partners would be considered a sale under CCPA.” The company doesn't offer a "Do Not Sell" link but gives listeners a chance to opt out of tailored advertising.