MARY LOUISE KELLY, HOST:
Time now for All Tech Considered.
(SOUNDBITE OF MUSIC)
KELLY: When the new year begins tomorrow, the country's toughest data privacy law will go into effect. It's a state law in California. But with no federal law on the horizon, it is expected to set the national standard. Rachael Myrow of member station KQED in San Francisco has details.
RACHAEL MYROW, BYLINE: It's hard to find a better authority on the California consumer privacy act than one of its co-authors, Mary Stone Ross. She doesn't have to reach to give you the highlights.
MARY STONE ROSS: On January 1, 2020, all Californians will be able to find out what personal information a business is collecting about them, their devices and their children. They'll be able to opt out of the sale of their personal information, and if a company fails to implement reasonable security practices and their personal information is breached, they'll be allowed to sue those companies.
MYROW: Companies can still collect the data - what you buy, where you go and when, all the photos you've ever taken, your emails, even the ones you deleted, etc. What companies must do now is tell you what they're collecting when you ask. And what companies can't do anymore legally is sell that data if you tell them not to. And if they do anyway, can you sue? No, not for that.
STONE ROSS: It's only for data breaches. So if certain categories of personal information, for example, your social security number, are breached and a business fails to implement reasonable security practices, then you have cause.
MYROW: Also California's attorney general can prosecute after the law goes into effect January 1.
MYROW: Right after that first kiss and the hugs and the champagne, the law's in effect.
MYROW: That's Attorney General Xavier Becerra. But his budget is limited. He's already said his office is likely to conduct only three enforcement actions a year. Against who, he won't say yet.
XAVIER BECERRA: The bigger the company, probably the bigger the problem. The bigger the universe that has data that is used in certain ways that could lead to that violation, the bigger the case will be.
MYROW: Industry groups spent the last year trying to rewrite and soften the law. It's expected they'll sue to stop its rollout in the new year. In the meantime, some companies, like Microsoft, are adopting the new rules right away and across the nation. Other companies - not so much. In a post outlining its position, for instance, Facebook argues it doesn't sell your data. It sells advertisers access to you. It's up to the advertisers to let you opt out or not. You can almost see Chris Hoofnagle, who teaches tech regulation at UC Berkeley, rolling his eyes.
CHRIS HOOFNAGLE: Facebook, in particular, appears to be interpreting the law in a very opportunistic way so that they don't need to actually do anything to comply with it.
MYROW: Hoofnagle thinks the biggest tech companies in Silicon Valley are in a financial position to bet it'll be a while before the attorney general's office comes for them. And in the meantime, the money is no joke. Facebook alone makes billions annually providing advertisers access to users.
HOOFNAGLE: Enforcement is the big unknown here. But Facebook will be in trouble if the attorney general picks up the law and uses it.
MYROW: Other data privacy laws like this one are expected to crop up in other states, too, because there is no federal law. In California, the attorney general's office is expected to finalize its regulations and begin enforcement July 1.
For NPR News, I'm Rachael Myrow in San Francisco.
(SOUNDBITE OF THE HELIO SEQUENCE'S "BATTLE LINES")
Copyright © 2019 NPR. All rights reserved. Visit our website terms of use and permissions pages at www.npr.org for further information.
NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.