Subject: [Secdispatch] CCPA Do-Not-Sell

From: Sebastian Zimmeck <[email-masked]>
Date: Sat, 21 Mar 2020 20:08:40 -0400

At the beginning of this year the California Consumer Privacy Act (CCPA)
became effective. In addition to the rights of data access and deletion,
this new privacy law gives consumers the right to opt out from the sale of
personal information. A "sale" is understood broadly and likely covers, for
example, a website or app disclosing location data or device identifiers to
an ad network for purposes of monetization. Now, the most recent regulations
to the CCPA
<https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-text-of-second-set-mod-031120.pdf?>
published
by the California Attorney General specify that automatic signals
communicating a user's decision to opt out must be respected. Here is the
relevant language:

"If a business collects personal information from consumers online, the
business shall treat user-enabled global privacy controls, such as a
browser plugin or privacy setting, device setting, or other mechanism, that
communicate or signal the consumer’s choice to opt-out of the sale of their
personal information as a valid request ... ."

I am interested in setting up a working group on such device controls. The
Do-Not-Sell signal could be similar to a Do-Not-Track (DNT) signal.
However, the difference is that recipients of the DNT signal were not
required to comply with the signal. Rather, they only needed to *say*
whether they would comply; per the California Online Privacy Protection Act
(CalOPPA).

Also, the CCPA may have substantial impact beyond California as some
companies, e.g., Microsoft, already made clear that they would apply the
CCPA to all consumers in the US.

It would be great to get a discussion started ...

Best regards,

Sebastian

_______________________________________________
Check out PrivacyFlash Pro
<https://github.com/privacy-tech-lab/privacyflash-pro>
Developed at the privacy-tech-lab <https://privacy-tech-lab.github.io/>,
Wesleyan University

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 27 Mar 2020 12:28:12 -0700

> It would be great to get a discussion started ...

It's not really clear to me how much discussion is needed...
if one assumes that you're just considering a HTTP header field, then the
only technical question I can think of is whether there's intended to be
some level of richness of expressivity vs. a boolean signal "don't sell my
data".  At that point it is mostly a matter of writing down the expected
semantics (the header field registry requires only Expert Review for
allocations).

-Ben

---

From: Sebastian Zimmeck <[email-masked]>
Date: Sat, 28 Mar 2020 13:37:29 -0400

Indeed, from a technical standpoint the implementation of a header field is
straightforward. Though, there are related policy implications. Given the
broad scope of what is considered a sale per the CCPA, especially, a lot of
data collected by ad networks would be subject to Do-Not-Sell. Also, it
would be nice to create a solution going beyond the browser, particularly,
covering mobile apps.

Best regards,

Sebastian

On Fri, Mar 27, 2020 at 3:28 PM Benjamin Kaduk <[email-masked]> wrote:

> > <
> https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-text-of-second-set-mod-031120.pdf
> ?>
> > published