The Evolution of Consumer Privacy in 2020

The start of a new year is usually associated with change, resolutions, and personal development, and the beginning of this year brought some major changes in the area of consumer privacy with the California Consumer Privacy Act (CCPA), which was signed into law in 2018 and went into full effect on January 1, 2020.

The CCPA includes a few key provisions, including rules about disclosure of data collection, compliance with requests to delete consumer data, and the right of consumers to opt out of data collection entirely. Though it’s still very early days in terms of seeing how businesses will comply and how the government will punish those that fail to do so, the CCPA may very well be a harbinger of legislation and regulation to come.

Will consumer privacy and protection continue to be an issue in 2020?

Consumer privacy has been a pretty consistently white-hot topic of discussion for the past few years. Scandals like the Cambridge Analytica data breach, as well as growing concerns about the data harvested by smart devices, particularly connected speakers, have helped fan the fire.

As consumers become more educated about the ways their data is collected and deployed by companies, and as the number of connected devices in the average home continue to proliferate, it’s likely that concern over consumer data protection and privacy will grow more fervent. In the U.S. in particular, the 2020 presidential election may bring increased scrutiny to these issues as candidates seek to position themselves as pro-consumer.

Will more states adopt consumer privacy protection laws?

Around the time the CCPA was signed into law there were predictions that its enactment might spur Congress to regulate consumer privacy protections. As of now, however, comprehensive federal legislation has yet to take shape.

Still, the CCPA has far-reaching implications given the size of the state’s population and the fact that the law applies to any company that does business with its citizens or operates within its borders (provided they have $25 million in annual revenue, or have personal data on 50,000 or more consumers, or garner at least half their revenue selling consumer data).

More regulation similar to the CCPA on a state level is pretty much inevitable at this point. Some states, like Maine and Nevada, have adopted similar laws. New York and Massachusetts are likely to adopt consumer privacy protection legislation in the near-term.

The implications of enhanced privacy laws for consumers and merchants

The rollout of enhanced privacy laws has implications both for consumers and businesses who will have to adapt operations to remain on the right side of the law.

Consumers: New laws give consumers greater autonomy over the collection and handling of their personal data. However, in many cases the onus is still on users to opt out rather than opt in to collection. So far U.S. regulation is not as stringent as the General Data Protection Regulation (GDPR) implemented by the European Union in 2018. Without comprehensive federal regulation, consumers may find it difficult to navigate and access their rights within their respective state.

Merchants: Adapting to new regulation presents challenges for businesses. The cost to businesses of coming into compliance with the CCPA, for example, is expected to cost $55 billion. Having a plan in place to bring your business into compliance is essential to avoid penalties in the future. Those who have been slow to adapt are granted a (small) reprieve, however, as California is not expected to begin enforcing the law for another six months. Even for businesses not affected by the CCPA, keeping a close eye on news of regulation in other states is necessary as the landscape is changing quickly.

Final thoughts: is more regulation good or bad?

The answer to the question of whether more regulation is good or bad will largely depend on who you talk to. Tech giants oppose the law in favor, they say, of federal legislation. Privacy advocates generally praise regulatory efforts, though are quick to point out areas where they believe legislation is not comprehensive enough.

Though there is inevitable criticism of the CCPA and other attempts at regulation, from a consumer perspective more regulation in this area reflects a positive change in the status quo. Regulation means that businesses are no longer in the dark about “the right way” to handle consumer privacy issues. Clear rules benefit businesses and consumers alike.