When state senator Bob Hertzberg learned that an ambitious privacy initiative had gotten enough signatures to qualify for the ballot in California, he knew he had to act quickly.
“My objective,” he says, “was to get the damn thing off the ballot.”
It was the spring of 2018. Facebook’s emerging Cambridge Analytica scandal had cast a harsh light on the tech giants’ data-gathering practices, spurring calls for more consumer privacy protections. The initiative was the brainchild of Alastair Mactaggart, a wealthy San Francisco real estate developer, who had the idea in the shower in 2015 and funded the effort out of pocket. Mactaggart enlisted his neighbor, Rick Arney, and Mary Stone Ross, a former CIA analyst and lawyer, to help craft the ballot measure. None had any background in data privacy, or, for that matter, anything related to the tech industry.
“No one knew who Alastair was,” says Hertzberg, a longtime fixture of California politics whose district includes parts of Los Angeles. “Who is this guy, and where is he coming from? All of a sudden he writes a check, spends a couple years, does some homework, and does a ballot initiative.” If enough voters approved the initiative that fall, it would put in place extensive new regulations that could only be amended if the legislature mustered a 70 percent supermajority. The prospect alarmed Hertzberg and some of his colleagues. “The reason we thought it was horrible wasn’t because he didn’t do a lot of good things that were consumer-facing; of course he did. But he put a 70 percent threshold. And in my world, a 70 percent threshold basically gives the other party all the power.”
Much better, he thought, to address the problem of data privacy through the legislative process. So Hertzberg approached Mactaggart with a deal: work with him to craft a bill, and once it passes, withdraw the ballot initiative. Mactaggart agreed. That June, after a few months of intense negotiation, the legislature unanimously passed the California Consumer Privacy Act. It was the most ambitious data privacy law in the nation—but it quickly proved inadequate. The rushed and contentious drafting process left enormous loopholes in the law, and it didn’t provide the resources necessary for its own enforcement. Legislators spent the early part of 2019 introducing bills to fix those flaws before the law took effect, but didn’t get anywhere. (There was also a series of bills that tried, and failed, to pare back the law further.)
So, about a year after the CCPA was passed—but before it had gone into effect—Hertzberg, who by then was majority leader of the California State Senate, pitched a new idea to Mactaggart. In a total reversal from his earlier stance, Hertzberg urged Mactaggart to bypass the legislative process. Instead, he should fund and draft a new ballot initiative to improve upon the CCPA. And this one wouldn’t be a bargaining chip. It would go all the way to a vote by the people of California. Thus was born the California Privacy Rights Act, which will appear on Californians’ ballots this fall as Proposition 24.
“The only way we’re going to do this is, we have to go back to the ballot,” Hertzberg recalls saying. Legislation looked like a dead end. “Because we had made mistakes—not horrible mistakes, but mistakes—in CCPA, all the business people were using it to cut up our credibility. Washington people were saying, ‘See, California doesn’t know what they’re doing.’ Given the timing, given the speed, we realized that we had to do another initiative.”
Hertzberg’s flip-flop on the ballot initiative question is just one way in which Prop. 24 has scrambled political dynamics in California. The initiative has also divided privacy advocates who previously fought on the same side. Mactaggart’s former ally, Ross, is leading the opposition and has enlisted allies that include the American Civil Liberties Union and consumer advocacy groups. “The CCPA was a lot weaker than the [original] initiative, but at the same time it was, and still is, the strongest consumer privacy law in the nation,” she says. “And this initiative weakens it.”
Whenever regulation is on the table, members of the affected industry can be expected to line up in opposition. But privacy advocates resisting a privacy initiative is less intuitive. How did Prop. 24 upend these alliances? The answer is: It’s complicated. Not just the situation, but the measure itself.
You can’t understand Prop. 24 without first understanding how lame the CCPA turned out to be.
The law was intended to give Californians the right to know what data businesses are collecting about them, to opt out of the sale of that data, and to make businesses delete the data they’ve already gathered. But those rights are mostly theoretical, thanks to a handful of missteps by the law’s drafters. First, the CCPA specifies that users have the right to opt out of the “sale” of their data. But tech companies argue that many transfers of user information that seem to raise privacy concerns aren’t sales at all, because no one is paying for data: Websites commonly give user data to third parties like Facebook in order to more effectively sell subscriptions and advertising.
Second, the CCPA ended up including an exception for “service providers” who need user data to perform a “business purpose.” Companies like Facebook and Google have seized on that language, arguing that they provide the service of microtargeted advertising. Taken together, the two provisions essentially exempt targeted advertising from the privacy law—which, given how central advertising is to all the tracking of users online, is a bit like exempting coal plants from a law promoting clean air.
“The ‘sale’ and the ‘service provider’ issue are two huge loopholes that companies are currently exploiting,” says Justin Brookman, the director of consumer privacy and technology policy at Consumer Reports. “If you say ‘Do not sell’ today, many companies are doing nothing.”
Mactaggart rues the fact that, as he sees it, tech lobbyists managed to get the service provider clause into the bill. “I caught a bunch of the things they were trying to do, but I didn’t catch this one.” As a result, he says, when it comes to cutting down on the biggest sources of online tracking, “We literally didn’t do anything. We did all this work and Google can still take all your information, Facebook can still put a pixel on a website. All they have to do is have a contract with that website, and one of the business purposes says ‘advertising and marketing,’ and boom.”
The other big CCPA shortcoming is enforcement. The original ballot-initiative version of the law would have let any Californian sue a company that violated its provisions—a so-called private right of action. But that provision, which tech companies vehemently opposed, got killed in the negotiation process. In the end, the law gives the state attorney general the exclusive power to enforce it. (Ross disagreed so bitterly with that concession, along with giving up on the 70 percent threshold, that she and Mactaggart stopped speaking.)
“One decision we made was, we’re just going to give the power to oversee this to the California attorney general,” says Hertzberg. That position is currently held by Xavier Becerra, a fellow Democrat. “I thought I was doing him a big favor by giving him the power to ultimately decide all these issues in privacy,” Hertzberg says. In fact, Becerra has said his office only has the resources to bring a handful of cases a year. Even if he had more, the law lets businesses avoid punishment if they “cure” a violation that gets flagged. There is little reason for businesses to take it very seriously.
Data from the first six months of the law’s existence suggests that it hasn’t changed the privacy game for consumers all that much, either. According to an analysis by DataGrail, a company that helps businesses comply with privacy laws, there were only 82 “Do not sell” requests for every million consumer records in that timespan.
The point of Prop. 24 is to patch the holes currently making the CCPA such a leaky privacy vessel. If approved by California voters, the initiative would change the law’s “Do not sell” provision to “Do not sell or share” to eliminate any wiggle room for unremunerated data transfers, and it clarifies that targeted advertising does not count as a “business purpose” that exempts companies from complying with user opt-outs. It also aims to beef up enforcement by requiring the legislature to appropriate $10 million in annual spending for an entire new privacy protection agency. And unlike the 2018 ballot initiative, Prop. 24 allows the legislature to make future changes with a simple majority vote—but only if those changes enhance, rather than weaken, the purposes of the law.
“We’re not trying to create a new ceiling, we’re trying to raise the floor,” says Andrew Yang, the former presidential candidate. Yang, who chairs the advisory board for Mactaggart’s Californians for Consumer Privacy, is one of several prominent supporters of the initiative, along with congressman Ro Khanna and tech theorist Shoshana Zuboff. “It preempts tech companies’ ability to water down the CCPA and make it toothless. And it leaves up to all of us how we want to continue to develop people’s privacy rights and data rights. If it doesn’t include everything that you want, fantastic—let’s get this one in place and then champion something else that continues to raise the floor.”
Not everyone thinks it’s so fantastic. Mary Stone Ross, Mactaggart’s erstwhile partner, has gone so far as to found a group called California Consumer and Privacy Advocates Against Prop. 24. At times, the rivalry has gotten a little personal. The “No on 24” website warns that “a wealthy San Francisco developer” is spending millions to “weaken California’s recent landmark privacy law,” without mentioning that it’s the same developer who helped create the law in the first place. The two have traded barbs in the press. Mactaggart is incredulous that Ross sent a fundraising prospectus to tech companies, among others. Ross counters that her only funding to date comes from the California Nurses Association, who donated $20,000, and that Mactaggart himself met with tech companies and incorporated some of their concerns into the initiative.
Ross’ other allies include the ACLU of Northern California, the Consumer Federation of California, and Color of Change. Some organizations that carry clout on the issue, like Consumer Reports and the Electronic Frontier Foundation, have declined to endorse the initiative, declaring that they can’t decide if the good parts outweigh the bad. What is the bad? One common complaint is that Prop. 24 allows what is pejoratively known as “pay for privacy”: businesses can charge users more if they opt out of sharing their information. (They can only charge the value they would have derived from that data.) That’s already allowed under the CCPA, but critics say Prop. 24 entrenches it further.
“If you look at the people who need privacy the most, I think those are often people who are economically struggling,” says Jacob Snow, a technology and civil liberties attorney at the ACLU of Northern California. “But if people have to pay for their privacy rights, then privacy becomes a luxury that rich people have but poor or economically struggling folks don’t have access to.”
Mactaggart defends the pay-for-privacy option as a compromise intended, in part, to protect news media’s ability to monetize through advertising. “We didn’t want to put a law into effect that’s going to crush an already crushed business,” he says. “They call it ‘pay for privacy’; we call it ‘preserve the free press.’”
The biggest disagreements over Prop. 24 are interpretive. The initiative comprises 52 pages of dense legal language, addressing highly technical concepts, with subsections and intricate cross-references that even experts admit they struggle to follow. That convoluted language has led to sharply different opinions about what the initiative would actually do—whether, in crucial respects, it would expand consumer privacy or restrict it.
Perhaps the most important example of this revolves around so-called global opt-outs. The final regulations implementing the CCPA require companies to honor a “Do not sell” request that’s automatically sent by someone’s browser or device—a browser extension or phone setting, say, that would save people the trouble of opting out of every site one by one. At first glance, Prop. 24 seems to go backwards on that. Beginning at the bottom of page 17, it appears to offer businesses a choice: Option (a) is to have a “Do Not Sell or Share My Personal Information” button on their homepage, and option (b) is to comply with global opt-out requests.
“The implication is that, under Prop. 24, it’s likely people will have to go website by website, app by app, data broker by data broker, to try to get companies to respect their choices,” says Snow. “There are 300 data brokers in the California data broker registry, and it’s totally unacceptable to put the burden of opting out of each one of those individually on consumers.”
Mactaggart completely agrees—with that last part. “That would be the single dumbest thing,” he said, of letting businesses ignore browser opt-outs. “I would actually oppose this law if that was the case. The opt out needs to be global; it needs to be set-it-and-forget-it.”
On this count, Mactaggart makes the more compelling case. A few paragraphs down, the text of the initiative clarifies that all businesses will be required to comply with a global opt-out, “regardless of whether the business has elected to comply with subdivision (a) or (b).” To understand the actual options businesses would have if Prop. 24 passes, you have to follow the other sections cross-referenced under (a) and (b). The choice, it turns out, is actually between having a “Do Not Sell or Share” button—and being able to charge users more for opting out—versus getting to skip the annoying pop-up notice if you agree to not treat users who opt out any differently, among other detailed requirements.
Like I said, it’s complicated. Here’s another example. Recall that Prop. 24 is supposed to prevent a future legislature from weakening privacy protections while giving it freedom to strengthen them. To do this, the initiative specifies that any legislative amendments must be “consistent with and further the purpose and intent of this Act,” which is “to further protect consumers' rights, including the constitutional right of privacy.” The tricky thing is that the initiative lists 23 specific principles underneath that broad purpose, a couple of which are not obviously pro-privacy. This raises the fear that the initiative could, perversely, block the legislature from expanding privacy protections. One provision, for example, calls for letting consumers “knowingly and freely negotiate with a business over the business’ use of the consumer's personal information.” What if the legislature wants to simply ban the use of personal data five years from now—could a company argue in court that this deprives users of the right to negotiate?
“There are 23 different purposes of intent, including to take into consideration the impact on business and innovation,” says Ross. “So you’re going to have everyone running to court on opposing sides to argue on how a proposed regulation is going to impact them.”
Mactaggart says the point was to make clear that there are many reasons the legislature could amend the law, provided it doesn’t harm consumer privacy. In response to Ross’s argument, he points to a detailed blog post by David Carrillo, a law professor at UC Berkeley and executive director of the university’s California Constitution Center. Carrillo is satisfied that the “statement of intent unambiguously sets the floor and creates a one-way ratchet: The legislature can only amend this initiative by increasing privacy protections.” California case law, he argues, suggests that judges will look at the overall purpose, not each subcomponent. But none of the cases he cites appear to deal with a subpurpose that arguably limits the law’s overall intent. So while he may be right, it’s not 100 percent clear how courts would approach the question.
These knotty disagreements point to a somewhat meta objection to Prop. 24: the ballot initiative process. “How can you possibly ask voters to competently vote for something that’s 52 pages long, and is so complicated that even experts disagree on what it actually means?” says Ross. “I firmly believe we wouldn’t have the CCPA had it not been for the ballot initiative process, but I think that now it’s gone too far.”
Mactaggart concedes that there’s no way for voters to understand every detail of Prop. 24. “Like so much in life, there may not be a perfect solution here,” he says. “But I think it’s a very, very good solution.”
When Mactaggart first got interested in privacy issues, in 2016, his concerns were pretty simple: He learned how much of his online behavior was being tracked by corporations and got totally creeped out. In the years since, his thinking on the issue has grown more systemic. The most important thing about Prop. 24, he argues, is its potential to steer the internet away from an economy based on tracking users across sites in order to serve them the most highly targeted ads at the lowest cost. He has become convinced that that business model is accelerating the demise of the journalism industry, and taking democracy down with it.
“I think if you continue to be able to microtarget, it’s the end of society,” he says. “If we don’t have the free press, we are totally screwed.” Cross-site tracking, he says, allows ad tech companies, most notably Facebook and Google, to gather data from internet users while they’re reading an article on a journalistic site (like, say, WIRED), combine it with data gathered on those users from everywhere else they go online, and then use it to serve them ads somewhere cheaper, so that the publisher never sees that income. “The virtuous thing about [Prop. 24] is, if you want to reach that WIRED audience, you’re going to have to go to WIRED. No longer will that value flow downhill and end up benefiting YouTube.”
Facebook and Google dispute the claim that their impact on the journalism industry has been anything but positive. They point to the traffic they send to media sites and the donations they’ve made to news outlets. But, notably, neither the companies nor their trade group, the Internet Association, have officially opposed the initiative. According to Hertzberg, it’s because it’s a battle they can’t win. “Nobody wants to fight privacy,” he says. “Everybody knows that it polls through the roof.”
Indeed, the available polling suggests that Prop. 24 is likely to pass. If it does, it could set a de facto nationwide default on data privacy, given California’s outsized population and economic power. Even then, however, there’s no guarantee that the law would trigger the reordering of the internet economy that Mactaggart envisions. That would require a complex chain of events in which a critical mass of consumers take advantage of global opt-outs, which in turn makes surveillance-free business models, like contextual advertising, more attractive. Mactaggart is betting that changing some hidden incentives will translate into real change in how the internet functions.
“The reason I’ve spent this stupid amount of money is because it’s not that visible—no one actually sees the magnitude of the struggle,” says Mactaggart, who estimates his total outlay at north of $10 million. “But the reality is, if we don’t get this right, the world that my kids are going to grow up in is going to look completely different than it would have looked, and than it should look, if we just get a few simple steps right now.”
- 📩 Want the latest on tech, science, and more? Sign up for our newsletters!
- YouTube’s plot to silence conspiracy theories
- “Dr. Phosphine” and the possibility of life on Venus
- How we’ll know the election wasn’t rigged
- Dungeons & Dragons TikTok is Gen Z at its most wholesome
- You have a million tabs open. Here’s how to manage them
- 🏃🏽♀️ Want the best tools to get healthy? Check out our Gear team’s picks for the best fitness trackers, running gear (including shoes and socks), and best headphones
