[Secdispatch] CCPA Do-Not-Sell

[Sebastian Zimmeck <[e-mail]>]

At the beginning of this year the California Consumer Privacy Act (CCPA)
became effective. In addition to the rights of data access and deletion,
this new privacy law gives consumers the right to opt out from the sale of
personal information. A "sale" is understood broadly and likely covers, for
example, a website or app disclosing location data or device identifiers to
an ad network for purposes of monetization. Now, the most recent regulations
to the CCPA
<https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-text-of-second-set-mod-031120.pdf?>
published
by the California Attorney General specify that automatic signals
communicating a user's decision to opt out must be respected. Here is the
relevant language:

"If a business collects personal information from consumers online, the
business shall treat user-enabled global privacy controls, such as a
browser plugin or privacy setting, device setting, or other mechanism, that
communicate or signal the consumer’s choice to opt-out of the sale of their
personal information as a valid request ... ."

I am interested in setting up a working group on such device controls. The
Do-Not-Sell signal could be similar to a Do-Not-Track (DNT) signal.
However, the difference is that recipients of the DNT signal were not
required to comply with the signal. Rather, they only needed to *say*
whether they would comply; per the California Online Privacy Protection Act
(CalOPPA).

Also, the CCPA may have substantial impact beyond California as some
companies, e.g., Microsoft, already made clear that they would apply the
CCPA to all consumers in the US.

It would be great to get a discussion started ...

Best regards,

Sebastian

_______________________________________________
Check out PrivacyFlash Pro
<https://github.com/privacy-tech-lab/privacyflash-pro>
Developed at the privacy-tech-lab <https://privacy-tech-lab.github.io/>,
Wesleyan University