Commentary

Apps in the Coming Wave of Privacy Regulations

by Nina Lentini , Staff Writer @Nina_Lentini, September 18, 2019

As the marketing world looks to California and what its Consumer Privacy Act will entail come Jan. 1, it wonders if there's a chance for federal regulation rather than having to be concerned with what each state is regulating. Today at our Marketing In-App conference in New York, Nathaniel Bessey, Partner, Brann & Isaacson, said he doesn't see a federal law coming anytime soon.

Part of the problem, he said, is that it is difficult to get anything done in Congress these days. "It did happen with email, where the federal government passed the spam act" but in the case of privacy, "I don't think it's imminent."

Another major concern for marketers is the interpretation of what it means to sell data and how marketers could be at risk. "We're interpreting that it applies to much of the data practices that we see in a multi-channel retailer world," Bessey said. That means risk for companies doing cooperative marketing in order to hone their targeting methods.

At the very least, he said, companies doing business in California or with residents of the Golden State will have to put a link on the home page of their websites that reads "Do Not Sell My Information." Of course, then the onus is on the retailer to verify each request.

It's a long row to hoe. As Bessey put it, it used to be that if you told people you were collecting data (outside of health, student, and banking information), it was okay. Now, not so much.

He advised the most crucial thing you can do is to communicate in your privacy policy how you collect information and what you do with it. Also, have a plan for if or when there is a data incident, a breach, or if information is inadvertently sent to someone. "Then the horse is out of the barn."

The CCPA will change the game. By Jan. 1, marketers should have their notices of practices up online, including notice of the rights of consumers to request access to their data, deletion of that data, how to opt out of collection and how the data is sold if it is.

The California attorney general's office will begin enforcing the law on July 1.