In collaboration with CIS Visiting Research Scholar Jana Gooth, we have (belatedly) submitted comments to the California Attorney General's office regarding California's Consumer Privacy Act (CCPA). This was a cooperative exercise between an information scientist (me) and a German lawyer (Jana), and we were able to work in many valuable insights from Jana's experience working on the General Data Protection Regulation (GDPR) for the European Parliment. As a non-lawyer, many of my concerns focus on the mechanisms by which the law provides notice to consumers, and I emphasized the fact that this legislation perpetuates a notice and consent framework that I and others consider fundamentally flawed. As we look forward towards a future of probable privacy legislation, we are overdue for a serious reckoning on how to rethink our notice and consent mechanisms and to move away from long form legal notices.
A PDF of our comments is posted below.