Subject: [saag] CCPA Do-Not-Sell

From: Sebastian Zimmeck <[email-masked]>
Date: Thu, 26 Mar 2020 12:31:55 -0400

At the beginning of this year the California Consumer Privacy Act (CCPA)
became effective. In addition to the rights of data access and deletion,
this new privacy law gives consumers the right to opt out from the sale of
personal information. A "sale" is understood broadly and likely covers, for
example, a website or app disclosing location data or device identifiers to
an ad network for purposes of monetization. Now, the most recent regulations
to the CCPA
<https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-text-of-second-set-mod-031120.pdf?>
published
by the California Attorney General specify that automatic signals
communicating a user's decision to opt out must be respected. Here is the
relevant language:

"If a business collects personal information from consumers online, the
business shall treat user-enabled global privacy controls, such as a
browser plugin or privacy setting, device setting, or other mechanism, that
communicate or signal the consumer’s choice to opt-out of the sale of their
personal information as a valid request ... ."

I am interested in setting up a working group on such device controls. The
Do-Not-Sell signal could be similar to a Do-Not-Track (DNT) signal.
However, the difference is that recipients of the DNT signal were not
required to comply with the signal. Rather, they only needed to *say* whether
they would comply; per the California Online Privacy Protection Act
(CalOPPA).

Also, the CCPA may have substantial impact beyond California as some
companies, e.g., Microsoft, already made clear that they would apply the
CCPA to all consumers in the US.

It would be great to get a discussion started ...

Best regards,

Sebastian

_______________________________________________
Check out PrivacyFlash Pro
<https://github.com/privacy-tech-lab/privacyflash-pro>
Developed at the privacy-tech-lab <https://privacy-tech-lab.github.io/>,
Wesleyan University

---

From: Sebastian Zimmeck <[email-masked]>
Date: Sat, 28 Mar 2020 12:30:21 -0400

Sure. There are two California laws: the California Online Privacy
Protection Act (CalOPPA), effective as of July 1, 2004, and the California
Consumer Privacy Act (CCPA), effective as of January 1, 2020. Per CalOPPA
an operator of an online service must

"[d]isclose how the operator responds to Web browser 'do not track' signals
or other mechanisms that provide consumers the ability to exercise choice
regarding the collection of personally identifiable information ... ."

That is, CalOPPA does not require the operator to comply with the DNT
signal. It only requires the operator to *say* whether it complies. This
law is the reason why you find the DNT signals in many privacy policies
mentioned, but in a nicely worded way saying that it will not be respected.
In conjunction with CalOPPA's DNT requirement, the W3C DNT Working Group
formalized the DNT signal. Currently, Firefox is still supporting it, and
users can set the DNT header in the browser preferences.

The CCPA introduced new rights for California consumers, particularly, the
right to object to the sale of information. Recently, the Office of the
California Attorney General drafted regulations that actually require that
a business must comply with automatic Do-Not-Sell signals. It is not enough
for a business to say whether it complies, but it must actually comply.
That is the big difference.

What the exact relationship between the DNT and the Do-Not-Sell signal is
at this point is not clear. Some commentators on the regulations suggested
that a DNT signal should be interpreted as a Do-Not-Sell signal. Others see
these as separate.

On the naming, I agree. It would be better to not use DNS as an
abbreviation for Do-Not-Sell. Maybe, DNSell or something similar.

Best regards,

Sebastian

On Fri, Mar 27, 2020 at 4:21 PM Michael Richardson <[email-masked]> wrote:

> Sebastian Zimmeck <[email-masked]> wrote:
> I didn't understand this part.
> Can you use reply to the list and use more words, or give me an example?
>
> "Do-Not-Sell" == DNS. Could be confusing.
>
>