A few thoughts on the new California privacy law, AB 375 (1/5).
This law won’t have much impact on major online platforms, like Google and Facebook. They already enable users to download a data archive or delete their data, and they aren’t in the business of selling user data.
This law won’t have much impact on major online platforms, like Google and Facebook. They already enable users to download a data archive or delete their data, and they aren’t in the business of selling user data.
(2/5) AB 375 likely won’t have much near-term impact on the third-party online advertising ecosystem. The law has an ambiguous exception for “deidentified” data, and the advertising sector will argue that it exempts tracking cookies, email hashes, and other common ad identifiers.
(3/5) It will be up to the California Attorney General to determine whether AB 375 regulates the online advertising ecosystem, then to defend that position in inevitable litigation.
(4/5) AB 375 will likely have a significant impact on the offline data ecosystem, including data brokers, retailers, and financial services. These sectors don’t generally offer consumers data transparency, access, deletion, or prohibition on sale.
(5/5) It’s essentially impossible to bring a data breach lawsuit under AB 375, because a business has 30 days after receiving notice to cure a violation. By the time the AG or consumers learn about a breach, the business will inevitably have fixed the underlying security problem.
