Companies operating in California will have to comply with tougher data privacy rules after voters approved Proposition 24.
The measure, also known as the California Privacy Rights Act, passed with 56% of the vote as of midday Wednesday, according to the Associated Press. The proposition would impose stiffer fines on companies that break certain data privacy rules and create a new state agency that along with California’s Justice Department will enforce the state’s consumer privacy laws.
Prop. 24 revamps California’s current year-old data privacy law, known as the California Consumer Protection Act (CCPA), which gave residents the ability to demand that companies disclose and delete any personal data they gathered about them. Analysts considered the passing of that law a major blow to many tech companies like Google and Facebook that operate vast data-collection operations used to train their machine-learning systems and target consumers with online advertising.
Under the new California Privacy Rights Act, consumers will now be able to ask businesses to not share their personal data, a common practice in online advertising and marketing. Consumers will also be able to ask companies to correct any personal data they have gathered if they have noticed errors.
Additionally, companies that violate the data privacy rights of minors could be penalized up to $7,500 under Prop. 24, most of which will likely take effect by January 2023. Businesses that suffer data breaches as a result of lax cybersecurity will also no longer be able to avoid fines by fixing their security holes within 30 days of a data leak.
Prop. 24 received praise from notable politicians like former Democratic presidential candidate Andrew Yang, Silicon Valley Rep. Ro Khanna, San Francisco Mayor London Breed, and organizations like the California NAACP, Common Sense, and Consumer Reports. But it also faced criticism.
The ACLU, for instance, opposed Prop. 24, saying that it could result in Black and immigrant communities having to “pay for their privacy.” The ACLU said that Prop. 24 is “full of loopholes” and “allows companies to charge you more if you tell them not to sell your personal information.”
The Electronic Frontier Foundation, a digital rights nonprofit, abstained from either supporting or opposing Prop. 24, saying that it doesn’t “do enough to advance the data privacy of California consumers.”
Still, with Prop. 24’s approval, there’s a good chance that the new data privacy rules will have an impact outside California. For instance, several businesses like Microsoft had said that they would comply with California’s previous data privacy rules nationwide, and they may do the same with the new law.