This week I have been reading in the news about the California Consumer Privacy Act. CCPA is a bill that was introduced to California legislators on January 3, 2018 and signed into law on June 28, 2018. However, it will not go into effect until January 1st, 2020. The new law will require companies to allow California residents to find out what personal data is being collected on them, ask them not to sell the information, and request that their data be deleted. There is, of course, a certain amount of personal data that cannot be deleted if you want to do business with a company, but the idea is to give people an option for limiting the data being saved and sold. It sounds like a splendid idea, but will it actually work?
The law is intended for California residents, but supposedly customers in other states will also benefit, albeit to a lesser degree. They will be able to ask for a report of what is being collected about them and who it is being shared with, and opt out of some data collection, but not be able to have that personal information deleted.
So I decided to put it to the test, and see if I could limit what information Hulu was collecting on me.
I logged into my account, and clicked around trying to find the area that might help me as a non-California resident. I found a section that outlined their current privacy agreement, followed by the future 2020 agreement. It was so long that I gave up on reading it all, but it didn’t look like things were going to be much different. Then I went back to the “California Privacy Rights” section. It had three sections:
Right to know
Right to opt out
Right to delete
I clicked on “right to know” to request a report of who they were sharing my info with. They sent a code to my email, which I had to respond to within 15 minutes or they would cancel the request. Got that done, and now they have 45 days to furnish me with that information. Why can companies know your entire financial situation and approve you for credit in 30 seconds, but when you want to know their end of the story, you have to wait for a month and a half?
Then I went to the “right to opt out” section. I went through the same email verification process, with a mere 15 minutes to put in that code. Got that done, and am now opted out of a certain amount of data collection. When I looked at the list of what they were still allowed to collect, it didn’t seem like there was a lot of difference.
The deletion area was unavailable to me, as I do not live in California.
Many of the news articles seemed very optimistic about the new law, and predicted that it would soon be a nationwide policy. Hopefully that will be the case, but I have my doubts. Companies have gotten so used to being able to collecting every tiny bit of information about our lives, that they are unlikely to give in. They will say they aren’t saving our data, and will delete it from their servers. But somewhere, they will have a backup of the information in their archives. It’s just too valuable to them to give up. Once information is harvested, there is no “undo” button.