The California Consumer Privacy Act (CCPA) is in a state of flux, with a new Attorney General enforcing its provisions and a new agency created by proposition, the California Privacy Protection Agency (CPPA) setting up to take over and implement substantive changes also passed by proposition. With these circumstances, observers may see 2020, the first year of CCPA enforcement as relatively unimportant. However, the new California Attorney General, Rob Bonta, held a press conference in July to tout the effectiveness of the law and unveil a reporting tool for consumers. This article looks at some of his more important comments and predicts what this could mean for the future of consumer privacy in California.

AG Bonta opened the conference by discussing his office’s enforcement actions. He said he was pleased to report that 75% of the companies that received notice of a CCPA violation from the AG’s office responded with amended practices within the 30-day cure period provided under the law. Bonta noted the remaining 25% of alleged violators were either in the midst of their 30-day cure period or under ongoing investigation.

Photo by Pi.1415926535, CC BY-SA 3.0

"We've sent quite a few [notices], but the good news is when we send out notices to cure we get a response," Bonta said. "We're not seeing resistance, stiff-arming or foot-dragging."

Bonta also offered specific but anonymous examples of practices changed in response to notices. These included two privacy policies that were missing language regarding certain data activities, one with insufficient responses to CCPA requests, and a website that lacked of a Do Not Sell button. That initial transparency and scope into the attorney general's work went deeper later Monday as Bonta's office published a separate list of 27 notice examples with descriptions.

"We're seeing businesses are motivated and able to comply with the law. My belief is that the vast majorities want to comply and will comply," Bonta said. "They want to know how and once they do, they (comply). We're not talking about any 'gotchas' here. We really do we do want compliance and that outcome. That's how consumers and their privacy are protected."

The AG giving a positive report on these cure notices could be important in the future. The Consumer Privacy Rights Act, passed by proposition in 2020, changes provisions of the CCPA, including giving consumers the right to bring enforcement actions. The law retains the 30-day right to cure, though, and these good results could bolster the value of this provision. Other states, such as Colorado, considering consumer privacy acts have struggled with including right to cure provisions in statute, so their success in California could also influence other states or even potential federal legislation.

Notably, a press release published after the press conference included a summary of an enforcement action against a dealer-manufacturer. The release stated: “A business that manufactures and sells cars failed to notify consumers of the use of personal information when collecting personal information from consumers seeking to test drive vehicles at a dealership location, in addition to other omissions in its privacy policy. After being notified of alleged noncompliance, the business implemented a notice at collection for personal information received in connection with test drives and updated its privacy policy to include required information.”

This enforcement action against a dealer is a reminder that in-store notices are important, and that every retailer with a brick-and-mortar store should ensure it has practices to provide Notices when information is collected in-store.

In addition to discussing enforcement history, the AG also announced a new Consumer Privacy Tool that allows consumers to bring their Do Not Sell companies directly to companies. According to Bonta, the tool "asks guided questions to walk consumers through the basic elements of the CCPA before generating a notification that the user can then email to the business." This tool could trigger the AG’s office to issue a 30-day cure notice to the business.

The effectiveness of the tool and what it means to businesses will ultimately boil down to how a consumer uses it. And he seems to be advocating that consumer take advantage of it. "It's their decision. I'm not saying to use it or not to use it, but it's there to be used," Bonta said. "If you don't want your information to be sold, you have to act. For those out there that think your information won't be sold automatically because of the CCPA, that's not true. You have to take that step and click that button on those websites."

If consumers take advantage of this tool, businesses may receive a number of notices through the system of consumer concerns. Because these consumer reports are likely to be reviewed by the AG’s office, every business should take any report seriously and consider changes to their privacy notices.

Overall, the AG’s press conference should indicate that his office will continue to enforce the CCPA while the CPPA gets up and running. It also provides a preview of what we make expect from the CPPA: an activist body that will take advantage of the law’s tools to inform consumers of their rights. The next couple years will be key to understanding the future of consumer privacy, and the actions today will form the future.