CCPA: Questions of Privacy, Compliance, and Enforcement

Doing business is, in its simplest form, often an elaborate risk game. On January 1, 2020, several companies doing business in the United States were forced to weigh their businesses like never before.

From that date, a historic consumer protection law, the California Consumer Protection Act (CCPA), will come into effect. As a result, many American companies will be subject to a much stricter set of privacy rules for the first time.

In short, American consumers now have a legal right to instruct a specific company to disclose what personal information has been collected about it and to request that the company receive it immediately. This process is known as a consumer order to be forgotten.

As a consumer, the new law is simple: someone’s right to privacy has increased significantly. And if a company decides not to comply with the new regulations, it will face greater financial penalties than ever.

But this is only the beginning. As things get complicated and to measure marketing and monitor consumers, people like me are really cool. This is because many companies are not sure how these new regulations will affect their marketing strategies:

  • What do you need to change in your data collection processes?
  • How sensitive are your current consumer privacy models
  • Whether the marketing measurement tools used by the respective suppliers are compatible and less accurate with the new regulations

The new law also has far-reaching consequences for a company’s marketing strategy. Even if a company reviews its process and complies with the new regulations, it is not an exaggeration to say that the law will greatly affect the accuracy and effectiveness of long-term marketing approaches, such as attribution.

When consumers withdraw by invoking the right to be forgotten, gaps in the measurement map appear. And you see, these are not random gaps. Attribution approaches that try to create a ‘buying path’ are now missing and the whole approach is starting to fall apart. Brands today also use several likely mechanisms to identify consumers; Additional gaps in this data have a greater impact on its accuracy.

The result is a swarm of potential problems in terms of exaggerating and underestimating the value of marketing and, therefore, being wrong in that part of the equation.

These problems are not limited to undermining marketers’ confidence in the true financial impact on companies.

Although the law has been in effect for just a few weeks, some brands are well ahead of their time. Those in more regulated sectors, such as insurance, have long been aware of privacy issues and therefore have mature processes for managing them. They are on the front lines as if to say, “Our current approach will no longer work with CCPA, so we need to find other ways to measure our marketing investment that doesn’t just depend on the identity of the consumer.”

Also, several Fortune 500 companies have conducted complete and comprehensive audits of their marketing approach to control all data sharing points and record consumer data. They have already started to contact their suppliers to request information. In this way, brands report their exposure, map and correct their exposure and risks. In addition to compliance, brands themselves ask whether their current measurement approaches involve more exposure and risk. And the answer with the CCPA is a definite “yes”.

So, where does he leave his mark? For better or worse, it will be a waiting game. The big question remains how difficult it is and when California will apply the new law.

We can go to the European Union to see an example of what to expect: the EU implemented the General Data Protection Regulation (GDPR) in May 2018, and many conscientious brands immediately started to rethink their marketing and data collection processes. This was followed by an unannounced grace period, in which the EU, in most cases, postponed enforcement as companies approached compliance.

However, the application of GDPR has gradually increased and, of course, the financial results of large and small companies will be adversely affected.