Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / EU Opti-In vs US Opt-Out

Transcript

EU Opti-In vs US Opt-Out · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  In that context, see something like the EUAI Act approach or do
• 0:04
  you see more like the UK Safety Institute approach for AI?
• 0:08
  How, how do you see that developing?
• 0:10
  Because you said there is a talk at the federal level, you said a
• 0:13
  couple of states have passed AI laws.
• 0:15
  And you also mentioned, if I understood well, that Cal
• 0:19
  Privacy has also added a few more rights like you mentioned
• 0:22
  right to delete, right for opting out and things like that.
• 0:26
  So which direction do you see the legislation going,
• 0:28
  especially with AI specifically? If I had a crystal ball, I would
• 0:34
  probably not be in this job and, you know, probably be placing
• 0:40
  stock bets or something like that.
• 0:41
  And but yeah, it's really difficult to tell.
• 0:45
  I mean, all I can say is is that states are moving forward.
• 0:51
  I mean we see it not only in Democratic run states, but
• 0:55
  Republican states. There's just significant
• 0:58
  concerns out there at the state level about AI and its impact
• 1:06
  specifically on kids. And and there is rumblings in
• 1:12
  terms of what could occur in Congress, but you know, who
• 1:17
  knows where it's going to land. But what we're seeing is
• 1:21
  definitely, you know, move forward at the state level.
• 1:26
  We'll see if the federal government steps in, can get
• 1:29
  agreement. And we'll see to what extent
• 1:32
  that any legislation passed at the federal level is a ceiling
• 1:37
  where states can't go over and beyond or is a floor where
• 1:41
  states can go over and beyond. From our perspective, Cal
• 1:44
  privacy, our focus again is the usage, collection, sale,
• 1:51
  sharing, processing, etcetera of personal information that's well
• 1:55
  defined under our law. And, and obviously, if it's
• 2:00
  being used by automated decision making, we, we do have
• 2:05
  incredibly robust set of right of regulations and that becomes
• 2:08
  effective January 1st, 2027. And you know, we're already
• 2:13
  right now looking in the coming months to provide additional
• 2:17
  guidance to businesses in terms of what their obligations are,
• 2:21
  but it's all in the regulations as well.
• 2:23
  So we're moving ahead as it relates to what we're, we've
• 2:27
  been told by the statute, the states independently at a
• 2:30
  broader level, the federal government's looking at it.
• 2:33
  So again, it's hard to have a crystal ball in this area.
• 2:36
  And I I, I wish I knew but but I, I I don't.
• 2:41
  No, no. Again, I was looking at your
• 2:43
  perspective rather than a finite set of information.
• 2:46
  So you are definitely leading the way and you're definitely
• 2:49
  making impact. But do you also measure or have
• 2:52
  any initiatives to measure the impact or do you know, yes,
• 2:56
  everybody says you're leading and yes, you are leading, but do
• 2:58
  you have evident, do you quantify, do you qualify?
• 3:01
  Do you survey it? Is there something like that?
• 3:06
  Well, look, clearly what we're trying to do as a fundamental
• 3:15
  objective here at the California Privacy Protection Agency or Cal
• 3:19
  Privacy is we're trying to make privacy easier for consumers.
• 3:25
  So that's kind of a core objective that we have here
• 3:29
  because what we found is that at least in the notice and choice
• 3:35
  model or the opt out model, that as Professor Salov has
• 3:41
  described, that exercising privacy rights is a never ending
• 3:46
  set of chores and it's very difficult to do it at scale.
• 3:50
  And So what we're trying to do is make privacy easier.
• 3:56
  And the first step in that is implementation of the California
• 4:03
  Delete Act, which was SB362 passed in 2023 and signed by
• 4:10
  Governor Newsom. And that led us to to implement
• 4:14
  the delete request in opt out platform or drop.
• 4:18
  That's that single click mechanism.
• 4:20
  So to answer your question, we very much look at kind of the
• 4:25
  consumer adoption here in California of the drop system.
• 4:29
  And I'm very pleased to say that as of today, which is the 10th
• 4:35
  of April, we have over 270,000 Californians have signed up for
• 4:41
  the drop system. You know, and the that's
• 4:45
  actually a pretty staggering number given that the deletion
• 4:49
  request don't have to be fulfilled by the data brokers
• 4:53
  until the fall per the statute, but that kind of shows a pent up
• 4:57
  demand. So that is one way that we can
• 5:00
  measure the actual success that we're having in terms of
• 5:06
  evangelising and having people exercise their privacy rights at
• 5:11
  scale. We've also very much focused on
• 5:14
  providing a set of robust tips to consumers to better enable
• 5:21
  and unlock privacy controls. And we've put that on our
• 5:26
  privacy dot.ca.gov website, which is where the drop system
• 5:30
  also resides and we've had great traffic to that website.
• 5:36
  And then the last thing in terms of making privacy easy is that
• 5:40
  we very much care about what's called the global privacy
• 5:44
  control or what we in California call the opt out preference
• 5:47
  signal. That's the ability to send a
• 5:51
  signal to a business to not sell or share the personal
• 5:56
  information. The issue is, is that a lot of
• 6:00
  the browsers don't support that out-of-the-box or on a mobile
• 6:05
  platform. You can't add an extension to
• 6:08
  enable that. And so I'm very pleased that
• 6:10
  last year that Cal Privacy was the sponsor of legislation by
• 6:17
  Assembly Member Lowenthal AB566, which was called the California
• 6:22
  Opt Me Out Act that requires browser vendors starting January
• 6:28
  1st, 2027 to add that capability, that feature to
• 6:36
  their browsers. And what we will do is through
• 6:42
  our regulations, we require businesses of certain size as
• 6:47
  well as data brokers to publish results about the number of opt
• 6:51
  outs that they have processed. And so another measure of
• 6:56
  success which we won't be able to see until 2027 is we'll be
• 7:01
  able through the submissions of the business again either
• 7:06
  through the Delete Act submissions with data brokers or
• 7:09
  for the large businesses that have to publish their their
• 7:14
  privacy rights of exercising by consumers or DSA Rs statistics.
• 7:23
  We'll be able to see if we're actually being effective in
• 7:27
  terms of enabling more people to exercise the rights, including
• 7:33
  the opt outs as well. So we can quantify our success
• 7:38
  of making privacy easier. We're already seeing that today
• 7:41
  with the drop system. We're seeing that with increased
• 7:45
  traffic to our website with the privacy tips and then starting
• 7:50
  in 2027, we'll get a better sense for our impact as it
• 7:54
  relates to opt outs. That's good to hear.
• 7:59
  I'm sure you're making that impact and if you quantify that,
• 8:02
  that's even better. I'm tempted to ask you because
• 8:05
  you mentioned you have an opt out mechanism.
• 8:08
  Now Europe has gone the opt in way and I see California as a
• 8:13
  leader in the privacy in US has chosen the opt out way.
• 8:18
  What's the thinking behind or the rational behind the opt out
• 8:22
  mechanism? Because the proponents of the
• 8:24
  opt in in the EU believe that if it's an opt out, some data has
• 8:30
  already been collected and that should not have been collected.
• 8:33
  While opt out is more business friendly, that's what it's
• 8:36
  perceived as. At least.
• 8:38
  And then the business has an option, and if an informed user
• 8:42
  wants to opt out, that's where the business has an advantage.
• 8:45
  So how do you play the two options?
• 8:49
  Yeah, I mean, I'm, I'm not a constitutional lawyer and I
• 8:52
  don't play one on this podcast. And I, I was not involved in
• 8:58
  2018 in the drafting of the ballot initiative or the
• 9:02
  legislation for the California Consumer Privacy Act.
• 9:06
  But there was a concern expressed that a, that there
• 9:12
  could be some constitutional issues with an opt in.
• 9:16
  And so the decision was made to stop potential legal challenges
• 9:24
  that with the passage of the CCPA and signing by Governor
• 9:31
  Brown that the preferred and the safer choice was an opt out.
• 9:38
  Now there actually is carve outs for children and to have it to
• 9:44
  be an opt in. And that's also at the federal
• 9:46
  level with COPPA or COPPA or however you want to pronounce it
• 9:50
  as well. So you can do that for kids or
• 9:54
  minors, but the decision was made, rightly or wrongly, to
• 9:58
  have an opt out model. And since then, in the United
• 10:03
  States, all the other state laws have been an opt out.
• 10:08
  To catch the full discussion, head to YouTube, Spotify or
• 10:10
  Apple Podcasts and search fit for privacy.
• 10:13
  Links are in the description. Thanks for listening.