New California law will make it harder for Facebook, Google to gather users’ data

The California Privacy Rights and Enforcement Act, also known as Proposition 24, will make it more difficult for large technology companies such as Facebook and Google to gather and track users’ data through third parties. On Nov. 3, the bill was passed into law by voters in California.

Under the new law, users will have the ability to opt out of “sharing” their data with companies through digital advertising. It also prohibits the sharing of information between companies. Individuals will see new protections and additional mechanisms added that allow people to access, correct, or delete their data.

The law replaces the California Privacy Act, which took effect this year, and goes into effect as of Jan. 1, 2023. It will apply to data collected as of Jan. 1, 2022. The measure is designed to remove an ambiguity in the previous law regarding targeted ads, which weren’t considered a “sale” of user data under the original act.

“A consumer shall have the right, at any time, to direct a business that collects sensitive personal information about the consumer to limit its use of the consumer’s sensitive personal information to that use which is necessary to perform the services,” the law states. “A business that uses or discloses a consumer’s sensitive personal information for purposes other than those specified in this subdivision shall provide notice to consumers.”

The law also clarifies what qualifies as “sensitive information.” In addition to data including social security numbers, credit card numbers and sexual orientation, the law will also protect consumers’ precise geolocation.

“The third-party adtech industry will need to evolve … otherwise, their business models risk becoming obsolete,” Heather Federman, vice president of privacy and policy at BigID, a data-privacy compliance firm, told Business Insider.

One change users might see going forward is in the pop-ups that websites show new visitors, asking them to accept tracking policies or opt out. The opt-out choices may become streamlined and easier to use.

A newly created agency, the California Privacy Protection Agency, will enforce the new law and has the power to fine businesses for violations.

Many of the country’s biggest tech firms currently operate out of California, so this law would effectively apply to them on a national level. However, the law may also serve as a model for federal legislation.

“We are at the beginning of a journey that will profoundly shape the fabric of our society by redefining who is in control of our most personal information and putting consumers back in charge of their own data,” Alastair Mactaggart of advocacy group Californians for Consumer Privacy said in a statement.