Data vendors, analytics firms and media consultants working in California could have some unhappy clients on their rosters after Jan. 1, 2020.
That’s when the state’s new digital privacy law, passed unanimously through the legislature and signed into law June 28, goes into effect.
The bill, which was rushed through Sacramento under pressure from a ballot initiative group, is now law and will give Californians the ability to request the data companies like Google, Facebook and Amazon have on them and also determine how they're sharing it.
Individual campaigns and consultants are unlikely to feel an immediate impact. But data vendors and big tech companies could eventually pass along the compliance costs in the form of higher prices and steeper ad rates.
“It clearly raises costs,” said Adav Noti, a former FEC attorney now with the Campaign Legal Center, a DC-based non-profit. “[The companies impacted] are going to have to hire expensive lawyers.”
Beyond lawyers, the ad businesses of companies like Google and Facebook could take a hit. For instance, the law requires websites like theirs to have a “Do Not Sell My Personal Information” button accessible to Californians. According to the bill, this enables the consumer “to opt out of the sale of the consumer’s personal information.”
“It’s going to hinder some of the work that campaigns value, like identifying and targeting voters based on what appeals to them,” said Noti.
Bradley Hertz, who practices election law at the Los Angeles-based Sutton Law Firm, agreed with Noti that the law will likely make it harder for campaigns to reach voters. Still, Hertz noted that it remains to be seen how many voters will take advantage of the law’s protections, which requires Golden State residents to be proactive.
“How many people are really going to make use of these privacy protections that will make it more expensive for candidates and ballot measures to get their messages out?” Hertz wondered. “Will it be enough to make a difference? It could make a difference in smaller jurisdictions.”
California-based consultant Kate Maeder, who’s currently running Democrat Eleni Kounalakis’ campaign for lieutentant governor, agreed the biggest unknown is how many Californians will actually take advantage of the opt-out.
“I think, by and large, it’s not going to set back campaigns in a tremendous way,” said Maeder. “What percentage of people are actually going to opt-out? It’s going to impact the way digital consultants communicate to voters—there will be more hoops to jump through. But in terms of running campaigns, you’re still going to need a multi-channel communications strategy to win.”
Many of the consultants contacted by C&E said they were still unsure how the law would be implemented and wouldn’t speculate on how it could play out. Representatives of Political Data, Inc. (PDI), the state’s largest data vendor, didn’t respond to a request for comment.
L2, a non-partisan data firm, pledged not to pass along any added costs to its clients.
“For nearly 50 years L2 has maintained a rigorous policy on how our data are stored, delivered and utilized. We intend to continue those policies and to absorb any regulatory costs allowing the political campaigns we work with the ability to have affordable access to the highest quality and updated voter contact information,” said Paul Westcott, a VP at the firm.
“It has always been L2's policy to suppress the information on any voter contacting us and requesting that we do so. We have thus long ago enshrined many of the statutory requirements appearing in this new law.”
One thing consultants and vendors could benefit from is their close relationship with lawmakers. Sitting politicians will be acutely interested in how this legislation impacts their ability to reach voters, and the campaign industry has two years to make its case.
Asked if he could see the law changing from its current form, Noti replied: “I would be surprised if it didn’t.”
Meanwhile, other states will be watching California as its implementation rolls out. It’s the first jurisdiction in the United States to adopt similar provisions to Europe’s General Data Protection Regulation (GDPR). That law, which went into effect in May, allows European consumers to request that their data be deleted — the “right to be forgotten” — by the company that gathered it.
Now, with federal legislation on data privacy unlikely to materialize in the near future, California is the pace setter for American online privacy regulation, according to Noti: “It’s probably going to determine what the baseline is.”