Residents in the country’s most populous state voted in favor of Proposition 24, which will create a state agency to enforce internet privacy regulations, while attempting to tighten some of the loopholes found in the existing law. With 99% of precincts partially reporting in the state, 56.1% of voters supported the measure and 43.9% opposed it.
Given California’s size and influence, the measure has the potential to set a national standard if other states follow suit. The ballot initiative passed despite criticism that its effect will only marginally be felt by the industry it is aimed to govern.
Facebook Inc., Alphabet Inc.’s Google and other technology companies that showed strong opposition to the California law largely stayed silent on the ballot measure.
“It will be the default law of the land because there are very few American businesses that don’t do business in California,” Alan Friel, an attorney and privacy expert at Baker & Hostetler LLP, said in an interview before Tuesday’s election. “Over the next five years, we will look more like Europe [in terms of regulation], and American businesses will have no choice but to get on the bus because that bus has left the station.”
When California lawmakers passed the privacy law in 2018, they left much unaddressed over how the legislation would be enforced and what exactly it would target. Enforcement has largely been up to the state attorney general’s office, which has said it can only take on a small number of cases a year. The new measure aims to fix that problem by creating a dedicated agency to dole out fines to companies that violate the law, with city and district attorneys also having the power to sue. The agency will initially be funded with $10 million.
California’s law primarily established the right for consumers to request from businesses any personal information that is being collected from them and ask for that data to be deleted and not sold. With industry groups and privacy advocates having wrestled greatly over what constitutes the sale of consumer data, the measure updates the rule by explicitly stating that residents can prohibit sharing of personal data. It also gives consumers rights to limit how companies use sensitive data such as their ethnicity, religion and location.
The measure still leaves the burden of opting out of collection of information on the consumer, and it doesn’t give consumers direct rights to sue companies over violations. The Electronic Frontier Foundation, an influential advocacy group that has been a leading voice for consumer privacy, said the measure was “a mixed bag of partial steps backwards and forwards.”
The measure doesn’t go into effect until 2023, giving companies time to adjust. Facebook and Google are also focused on more consequential matters, including the election and antitrust scrutiny. The U.S. Justice Department in October sued Google over alleged anticompetitive behavior, and the Federal Trade Commission is examining Facebook’s acquisition strategy.
Alastair Mactaggart, the real-estate developer who spearheaded the measure, said it was aided by the larger fight Facebook, Google and other leading tech companies have faced during the past year over their power.
Mr. Mactaggart, who has said he views internet privacy as a long game, said he saw his measure as one big step forward.
“This will be a living and breathing thing just like other laws and will be amended for the rest of our lives,” he said. “It needs to evolve, and it will evolve over time as society changes.”