California’s AB5 and CCPA Laws Promise a New Era in Tech Regulation - Barron's

Photograph by Alastair Pike/AFP via Getty Images

Privacy advocates, pundits, and politicians are all clamoring for more aggressive tech regulation. The issues are myriad and varied, but no matter how the 2020 election plays out, change is already on the way. To get a taste of what’s coming, head to California.

On Jan. 1, two new California laws will try to address some of the thorniest issues created by tech companies’ mounting power. The new statutes will also create headaches, hassles, costs, and complications for anyone doing business in the state. Investors, take heed.

Let’s start with AB (Assembly Bill) 5, which focuses on improving working conditions for “gig” economy workers at places like Uber Technologies (ticker: UBER), Lyft (LYFT), DoorDash, Postmates, and Instacart. AB5 enshrines into law a 2018 California Supreme Court decision, which laid out rules for classifying workers as contractors. The toughest bit: contract work must be “outside the usual course of the hiring entity’s business.” The law primarily hits contract workers like drivers and delivery folks, but it also applies to folks like golf caddies, freelance journalists, and exotic dancers.

Under AB5, they are protected by U.S. labor laws. Employers will have to pay Social Security and payroll taxes, unemployment insurance, and state employment taxes, while providing workers’ compensation insurance and complying with minimum wage laws. Uber and Lyft didn’t answer my questions this past week on how exactly they’ll apply the new law. Uber has previously claimed that they aren’t running a transportation business but rather a tech business, and thus not covered by AB5. That view is sure to be tested in court.

In the meantime, both Uber and Lyft have added AB5 as a risk factor in their SEC filings. “If we are required to classify drivers as employees, this may impact our current financial statement presentation including revenue, incentives, and promotions,” Uber warns.

The companies assert that the law would force them to assign drivers to specific shifts, stripping them of flexible schedules. The gig companies are already talking with California Gov. Gavin Newsom and others about modifying the law. They’re also ready with a Plan B, a November 2020 ballot proposition to crush AB5 while still addressing driver pay.

Also arriving Jan. 1: the California Consumer Privacy Act, providing sweeping new data protections for consumers, along with complications for anyone collecting Californians’ data. Like Europe’s pioneering privacy law—the General Data Protection Regulation—or GDPR, CCPA covers many aspects of digital data privacy. That means Californians now have the right to know what data is being collected about them, to bar the sale of their data to third parties, to sue companies that collect their data and suffer a security breach, and to delete data collected about them. CCPA will also bar discrimination against consumers who opt out of data collection.

Ahead of the new year, many companies have already posted revised policies that address “your California privacy rights.” I found that new phrase on websites from Kohl’s, Lyft, Walt Disney, U.S. Soccer, Visa, Gannett, and Walmart. California firms doing business with consumers have two weeks to add their own language.

Michael Rubin, who leads the data privacy and security practice with Latham & Watkins in San Francisco, says CCPA is aimed squarely at addressing the excesses of targeted ads. But there are sure to be unintended consequences, including adding costs to publishers already struggling to compete with large tech platforms.

“It is fair to say that online advertising is the target of the legislation—and that publishers are likely to feel pain from this statute,” Rubin says. Complicating matters is the fact that a dozen or more other states are considering their own data privacy bills that don’t quite match the California measure. Publishers would prefer a federal law to simplify compliance—but Washington gridlock makes that unlikely. Rubin says Congressional action might hinge on proof that CCPA is causing genuine and widespread economic problems for publishers.

CCPA calls for civil penalties of $2,500 to $7,500 per violation. That could result in some monster fines. Rubin notes that a company accused of improperly placing, say, 500 million ad cookies on Californian’s computers—a not unrealistic number on the internet—would face a potential liability of $1.25 trillion and likely be forced into a painful settlement.

Sharon Klein, who chairs the privacy, security, and data protection practice at Pepper Hamilton’s Irvine, Calif., office, says CCPA is a direct reaction to Facebook’s (FB) mishandling of personal data. “Facebook sold information to Cambridge Analytica and then they sold it,” she says. “Stopping that from happening is the heart of CCPA.”

But the law is sure to have wider applications. One example is Microsoft’s (MSFT) LinkedIn, which doesn’t sell ads, but gets used by job recruiters. The issue is that scanning LinkedIn for job candidates without explicit permission from the targets is “not consistent with CCPA,” Klein says.

Kalinda Raina, LinkedIn’s head of privacy, says her company does not sell personal information or provide access to data “beyond what our members choose to share, according to their privacy settings.” Adds Raina: “We’ve let people know about our updated privacy policy and terms of service, and in the coming weeks we’ll post a CCPA notice to make sure everyone using LinkedIn understands their rights under this new law and how LinkedIn complies.”

More terms of service and more disclosure statements. Welcome to 2020.

Write to Eric J. Savitz at eric.savitz@barrons.com