The leading trade association for the insights industry shared in its final thoughts with California’s regulator on rules implementing the California Privacy Rights Act (CPRA), particularly noting that it does not believe that the drafters of the law intended to restrict audience measurement and expressing concerns about the quick turnaround between the rules' completion and their enforcement.
CPRA, the new comprehensive state privacy law overwriting CCPA, comes into effect on January 1, 2023, with enforcement starting July 1.
The latest proposed draft rules differ slightly from the version IA looked at in late October.
The Insights Association’s final comments to the CPPA about CPRA reiterated the insights industry’s previous concerns (relayed on August 11, 2022, and November 8, 2021), IA specifically drilled down again on the need for preferential treatment for audience measurement, noting that:
“the current regulations prohibit service providers from combining personal information received from businesses with personal information received from the service provider’s own interactions with consumers unless it has a valid ‘business purpose’ for combining the information. Because audience measurement is not included in the list of business purposes, this effectively amounts to a ban on critical audience measurement activities. We do not believe the CPRA’s drafters intended to regulate these types of activities. To that point, draft federal legislation and extant state privacy statutes already make an accommodation for audience measurement. Accordingly, we again strongly urge the Agency to follow the lead of federal and other state legislators and add audience measurement to the express list of business purposes.”
Read IA’s full November 16, 2022 comments on the CPRA rules.
Given that the California Privacy Protection Agency (CPPA) is tardy in issuing rules for businesses to follow, the Insights Association and our California Chamber of Commerce allies earlier warned, on November 2, that "California businesses are being placed in the untenable position of being required to comply with and effectuate the CPRA starting January 1st, without having been provided all of the final regulations necessary to do so. This is hugely problematic, not only as an operational matter, but also as a legal one." The agency has at least recently indicated that it will consider how soon after January 1 an alleged infraction occurs when considering an investigation, and may also consider “good faith efforts” at compliance. However, we still fail to understand "how a law that cannot be implemented by its effective date, let alone implemented properly, protects consumers or takes into consideration impact on businesses. Stated plainly, the problem identified has nothing to do with the intentions and good faith efforts of businesses to comply; it has to do with the delayed regulations of this Agency. Yet, the ones who will feel the consequences of that failure are businesses, their employees and the consumers they serve."