STEVE INSKEEP, HOST:
California's Consumer Privacy Act goes into effect today, New Year's Day. It is supposed to give consumers the power to prevent retailers and other companies from selling their personal data. You can opt out. No matter where you live, California's law may affect you. Stuart Brotman of the Wilson Center, which is a think tank here in Washington, specializes in digital privacy policy issues.
STUART BROTMAN: This is a pretty dramatic new law. As you know, California is the fifth-largest economy by GDP in the world. So even though it's one state, it affects a large part of the United States and even parts of the world.
INSKEEP: Is it even more influential because so many tech companies are headquartered inside California?
BROTMAN: Yes, I think so because any company that essentially touches a California resident will be affected by this law. That includes companies that are in California and companies outside California that are serving people who live there.
INSKEEP: What is California making tech companies do that some or all of them were not doing before?
BROTMAN: Well, it's not just tech companies. It's basically any company that collects information about people, and that's virtually any company that does so. So it's not just the Googles and the Facebooks of the world. It's every company. It's your auto body shop. It's your bank. It's a variety of different institutions, and so that's why it has such a broad reach.
INSKEEP: What things have to happen then for those various kinds of retailers and service firms and so forth?
BROTMAN: Well, one of the magic things you're going to see is there's going to be a button when you go on a website of a company that's covered by this act. And there's going to be a magic button that says, do not collect or do not sell my information. And you can literally press that button, and that essentially gives notice that whoever is collecting that information has to segregate that information and not sell it to anyone.
INSKEEP: Is this a good way to legislate what is effectively a nationwide or even global rule?
BROTMAN: Well, this is a major controversy whether or not this is something that should be done by the states or the federal government. Right now, there are only two states - California and Maine - which have enacted laws. But there are a variety of other states, including New York and Pennsylvania, which are looking at state legislation. On the other hand, you have Congress which says, wait a second. This should not be done by the states. We should have one standard, just like Europe has one standard for the entire European Union.
INSKEEP: Are there companies, institutions, entities that do not have to comply with these rules?
BROTMAN: Yes, and this is the big exception here. Government does not need to comply. And as you know, government is a major collector of information. Often, you don't have an option whether or not you want to give up that information. A good example might be a Department of Motor Vehicles. If you want to get a license or a car registration, you have to give up that information.
INSKEEP: Someone listening is finding it ironic that the very state that legislated this is not complying with it itself.
BROTMAN: Yes, and that is a great irony. And obviously it's going to create a lot of practical problems. In California, right now, the Department of Motor Vehicles in fact doesn't tell consumers that their information is being sold to third parties. And those third parties are commercial entities, so they'll sell it to a credit bureau or they'll sell it to a data broker.
INSKEEP: What is the justification for that?
BROTMAN: Well, money - they're getting about $50 million a year. And obviously they need more money. So they figured out there are other ways to do that.
INSKEEP: Some people will know that The New York Times recently reported a large project in which they revealed how easy it is to track people's movements using location-tracking data. Is that covered by the new California law?
BROTMAN: No, it is not. And in fact, there's going to be a new ballot initiative in November 2020 which will essentially strengthen parts of this California Consumer Privacy Act. And one of the other big loopholes here is that it doesn't cover geolocation tracking, which is the ability to track where you are and store that information.
INSKEEP: The ballot initiative would close that loophole as far as tracking people's locations.
BROTMAN: Yes, it would, but it would only apply to businesses, not necessarily governments.
INSKEEP: Is this ultimately a losing battle? We have to share so much information with so many companies in order to do normal business with them anymore that there's very little that people can truly, truly do about it.
BROTMAN: No, I don't think it's a losing battle, but I don't think we necessarily can come in and say, we have a one-size-fits-all solution which is going to apply to all circumstances and all technologies.
INSKEEP: Stuart Brotman, thanks so much.
BROTMAN: Thank you. Great to be here. Transcript provided by NPR, Copyright NPR.