As consumers shift to working from home and spending even more of their time online in light of the COVID-19 crisis, now more than ever, they need baseline protections to protect their privacy and security. Consumer Reports appreciates that the AG has improved upon the previous draft rules, particularly by eliminating the exemption for IP addresses from the definition of personal information. But other steps, such as a new provision that could allow service providers to build profiles to deliver targeted advertising, undermine existing protections. We reiterate the requests from our previous comments, particularly to close targeted advertising loopholes by strengthening the definitions of sale and service provider, and to further limit pay-for-privacy, and additionally call on the AG to:
- Deny the request from industry to delay enforcement of the CCPA;
- Maintain a strong, inclusive definition of personal information;
- Ensure that Do Not Track signals are honored as opt-out requests;
- Tighten up service provider language; and
- Set up an appeals process for responses to access requests.
Companies are seeking to evade the letter and the spirit of the CCPA, and to avoid any punishment for doing so. By sending a clear message that companies need to respect the CCPA, the AG can better protect consumers’ constitutional right to privacy.