Big Tech Must Disclose Data Used to Profile Citizens’ Behavior, California AG Says
Reporter Karina Montoya writes about a recent decision in California regarding data privacy that might have implications in other states.
Last month, California Attorney General Rob Bonta issued his first opinion interpreting the definition of personal data under the California Consumer Privacy Act (CCPA). The law, in effect since January 2020, gives state residents rights over the personal data platforms hold about them, including the right to opt out of its sale and sharing, or to delete it. The opinion clarified for the first time that the profiles platforms create about individual users to tailor advertising to them should be considered personal data. The opinion applies both to data collected directly by the platforms and “inferences” based on close study of other behavioral patterns.
Bonta delivered his opinion in response to a specific inquiry by a member of the California Assembly, so the full implications are not clear. One immediate practical effect, however, is that platforms must now disclose this information to any individual California resident who asks for it.
But some data privacy experts expect Bonta’s decision may actually threaten the long-term viability of the surveillance advertising practice that underpin Google’s and Facebook’s business models. The decision, they say, opens the door to a broader discussion about an extended definition of personal data and the types of control consumers should have over it.
“Access requests are not a holy grail, but it’s a win for transparency,” Ignacio Cofone, assistant professor and Canada Research Chair in AI Law & Data Governance at McGill University, told Open Markets. There is also a “huge potential for expanding other rights” to this type of data, he added, including the right to delete profiling data or to opt out of this practice entirely.
In the meantime, Cofone suggested, data privacy activists will have more resources to expose data aggregation practices that allow for price discrimination based on predicted behavior, or to exclude users based on race, gender, or religion in ads for housing or employment opportunities.
Google, Facebook, and other platforms routinely derive inferences about a user’s behavior by aggregating seemingly innocuous data points (such as IP addresses, email, and age) harvested from consumers directly or from public sources, with data gathered through surveilling users across the web. These insights can reveal a person’s voting intentions, religious beliefs, sexual orientation, or health conditions — information that consumers never intended to provide in the first place. It is through this practice that platforms can, for example, fuel extremism and push users to join partisan political groups online, as The Markup reported.
For instance, when a person uses Google’s search engine, maps, mail, or voice assistant, the platform stores those interactions. If that same person visits a news site supported by Google ads or analytics, Google is able to collect data about that content as well. Google then aggregates all this data to help target ads to that person. Facebook does the same with data collected from WhatsApp and Instagram, and from third-party websites with embedded Facebook buttons.
Californians can already download their personal information from platforms covered by the CCPA, but until now platforms have not included the full profiles they have compiled about that individual.
Other legal experts say that Bonta’s recent decision implicitly allows platforms to continue to retain and deal in inferred data even if a consumer has requested that his or her direct personal data be deleted. The Attorney General’s Office declined to comment on this issue.
More clarity about the CCPA implementation and enforcement is yet to come. After the CCPA was amended through the California Privacy Rights Act in late 2020, the California Privacy Protection Agency was created to enforce both laws, in addition to the attorney general. The agency is expected to complete its rulemaking at the end of this year, and it will not affect the attorney general’s opinion.
This article originally appeared in The Corner newsletter of April 8, 2022.