Ad industry calls for delayed enforcement of CCPA

“Unfortunately, it is presently unclear when the rules will be finalized and whether they will be further amended,” the letter said. “Just five months before enforcement is scheduled to begin, companies that are subject to the CCPA are faced with the likelihood that the draft rules could substantially change from their present form and impose entirely new requirements.

“Thus, in order to avoid consumer and business confusion with respect to the new rules, we request that you further delay the enforcement of the law to begin six months from the date the CCPA regulations become final,” concluded the letter. “This short deferral will give businesses the time they need to understand and effectively operationalize the rules helping ensure consumers have access to the rights afforded under the new law.”

The intent of the law is to give internet users more control of their personal data by allowing them to prevent the sale of their information to third parties and forcing businesses to disclose where their data is going.

The state began its consumer privacy initiative in December 2017. The first form of the CCPA bill was passed in September 2018. The most recent amendments were approved last October, and it went into effect on 1 January this year.

Despite the long runway, the trade groups said it’s “presently unclear when the rules will be finalized and whether they will be further amended.”

“[T]he draft rules imposed on businesses entirely new recordkeeping obligations, notice requirements, and verification rules, among many other novel requirements,” the letter said. “Businesses are still contending with the proposed regulations’ new mandates and are working earnestly to adjust their systems and build new processes to facilitate compliance.”

Early last year, the IAB sat in front of congress to criticize the CCPA. It called for a federal consumer privacy regulation that would avoid a patchwork of varied state-by-state acts.

“While well-intentioned, their rigid frameworks impose significant burdens on consumers, such as rampant over-notification leading to consent fatigue in consumers and creating an indifference to important notices regarding their privacy,” IAB executive vice-president for public policy, Dave Grimaldi, said last February.

The 4A’s and ANA recently came together in criticism of Google’s decision to rid its Chrome browser of third-party cookies, another move it said would negatively impact its members.

The letter to the California AG was signed by Grimaldi; Dan Jaffe, ANA group executive vice-president of government relations; Alison Pepper, the 4A's senior vice-president; Christopher Oswald, ANA senior vice-president of government relations; David LeDuc, NAI vice-president of public policy; and Clark Rector, AAF executive vice-president of government affairs.

Read the full letter below:

Dear Attorney General Becerra:

As the nation’s leading advertising and marketing trade associations, we collectively represent thousands of companies, from small businesses to household brands across every segment of the advertising industry, including a significant number of California businesses. Our members engage in responsible data collection and use that substantially benefits consumers and the economy, and we strongly support meaningful and effective privacy protections in the marketplace.

Although the California Consumer Privacy Act (“CCPA”) went into effect on January 1, 2020, the final regulations have not yet been promulgated, leaving our members and thousands of other California businesses uncertain concerning their ultimate compliance obligations. Given the extraordinary complexity of the law and the wide range of open issues to be clarified from the draft guidance, there will not be sufficient time for many businesses to effectively implement the final regulations prior to the anticipated enforcement date of July 1, 2020. We therefore ask you to delay enforcement of the CCPA until at least six months from the date of finalization of the rules implementing the law, in order to provide businesses a sufficient time period to implement the new regulations before being subject to enforcement.

I. It is Appropriate to Provide Businesses a Reasonable Period of Time to Implement the New Regulations

As soon as the California Legislature passed the CCPA, it was clear that the law’s requirements would evolve through both the legislative and rulemaking process. It was not clear, however, that the key CCPA provisions would be substantially amended so close to its effective date, and that the rules implementing its terms would not be finalized until after the law became operative.

While we recognize that the amendments in the California Legislature delayed the development and formal release of draft regulations implementing the CCPA until October 11, 2019, these draft rules presented significant new and unprecedented requirements, such as the requirement for a business upon receipt of a consumer opt-out request, to “notify all third parties to whom it has sold the personal information of the consumer within 90 days prior to the business’ receipt of the consumer’s request that the consumer has exercised their right to opt-out and instruct them not to further sell the information.” Moreover, the draft rules imposed on businesses entirely new recordkeeping obligations, notice requirements, and verification rules, among many other novel requirements. Businesses are still contending with the proposed regulations’ new mandates and are working earnestly to adjust their systems and build new processes to facilitate compliance.

Unfortunately, it is presently unclear when the rules will be finalized and whether they will be further amended. Just five months before enforcement is scheduled to begin, companies that are subject to the CCPA are faced with the likelihood that the draft rules could substantially change from their present form and impose entirely new requirements. Publications disseminated by your office indicate that the draft rules will be revised not only after input received during the initial comment period, but that you will also hold at least one subsequent 15-day comment period on the content of those updates. If any changes to the regulations are made that constitute “substantial and sufficiently related” changes, the Attorney General (“AG”) must provide for at least a 15-day public comment period. If, on the other hand, any of the changes to the regulations are “substantial, but not sufficiently related” changes, the AG must issue a new notice in the California Regulatory Notice Register and provide for a new 45-day public comment period. The rules will not be effective until the rules are submitted and reviewed by the Office of Administrative Law, further reducing the time available to businesses to implement the regulations. This timeline increases the likelihood that the draft rules will not be finalized before, or only a short period prior, to the law’s July 1, 2020 enforcement date.

We and our members strongly support the underlying goals of the CCPA. The limited and quickly shrinking time before the existing enforcement deadline, however, will place business in a nearly untenable position. Without final regulatory requirements, business will be unable to make operational changes to their systems, further delaying finalization of their compliance programs. Businesses should be afforded an appropriate time period to implement the new regulations once they become final and before being subject to enforcement.

II. Providing a Reasonable Period of Time for Implementing the New Regulations Benefits Consumers

While the law instructs the AG not to bring any enforcement action prior to July 1, 2020, there is no restriction on you providing a reasonable period of additional time for California businesses to review and implement the final regulations before initiating any enforcement actions. Thus, in order to avoid consumer and business confusion with respect to the new rules, we request that you further delay the enforcement of the law to begin six months from the date the CCPA regulations become final. This short deferral will give businesses the time they need to understand and effectively operationalize the rules helping ensure consumers have access to the rights afforded under the new law.

Business attempts to comply with an incomplete legal regime risks causing significant consumer frustration and the implementation of inadequate or duplicative compliance tools. While we understand that your office is working expeditiously to provide clear rules for businesses to operationalize the CCPA, the clock is working against well-intentioned businesses in their compliance efforts.

We urge you to give California businesses the opportunity to understand what is required under the law before they are put at risk for being penalized for violating its terms.

* * *

While our members support California’s intent to provide consumers enhanced privacy protections, the evolving nature of the CCPA and the draft nature of the proposed rules makes the current enforcement date of July 1, 2020 a difficult deadline for businesses and consumers alike. Consumer privacy is best served when businesses that leverage data do so in accordance with clear and concrete laws and regulations that present them with adequate time to adjust their practices to come into compliance with the new requirements.

We urge you to accept this proposed six-month enforcement moratorium, thereby giving businesses throughout the United States that operate in California adequate time to prepare to adhere to the law’s final form. Delaying the CCPA’s enforcement in this manner will help ensure that businesses can effectively provide consumers with the new protections and rights that the law and its implementing regulations require.

Thank you in advance for consideration of this request.