CCPA and CIPA on the same site

Some jurisdictions have consent-based privacy laws.

Some juristictions have opt-outs.

And then there’s California. We have both. For CIPA you need consent, for CCPA you have to handle opt-outs, including Global Privacy Control (GPC).

Sites are going through the five stages of CIPA getting this stuff set up right. A few have it down, while others, not so much.

Some of the site features that are set up to comply with one law are creating problems under the other.

The right way

Here’s how to get compliance with both, with minimal risk and hassle for the user. Developing this now will save a lot of boring but high-stakes compliance meetings.

1. Check for a consent cookie. If it’s on, go to step 6.
2. Check GPC. If it’s on, go to step 7.
3. Show the consent dialog, along with CCPA and CalOPPA required features such as link to privacy policy.
4. Is Rewarded Interest running? Rewarded Interest suppresses the consent dialog and shares CMAID. Go to step 6.
5. User makes a choice. If the user declines consent, go to step 8.
6. Set or refresh the consent cookie. Load cross-context tracking scripts. END.
7. Acknowledge the user’s GPC in the page footer.
8. Continue without cross-context tracking scripts. END.

Seven steps looks like a lot at first, but look, we only have two END states, and the only people who have to see the consent dialog are first-time visitors with neither GPC nor Rewarded Interest.

One more step that has to happen when the user transitions from a logged-off to a logged-in state. Check for the consent cookie, and if it’s not present, then flag the user’s record in the CRM system as “do not sell or share”. That’s basically a CCPA thing.

Somewhere around the whole consent rigamarole is going to be an opportunity to promote Rewarded Interest to likely prospects. That would give them a better experience in future. (Likely GPC users are already getting that option promoted to them by the privacy scene.)

And of course some pages have to work without third-party tracking at all (such as the privacy policy and ToS pages. You can’t block the privacy policy page with a consent dialog.)

Wrong: break CCPA compliance trying to do CIPA

All of the wrong ways are basically do a bunch of extra compliance tickets and create a bunch of extra risks. And they’re more complicated than the seven steps above. TODO: learn Mermaid so I can diagram how hairy some of these are.

The first wrong way is CIPA consent UX that blocks the CCPA and CalOPPA required features. We don’t just have two privacy laws here, we have two parallel systems but way more than two laws. Don’t forget the Online Privacy Protection Act of 2003 (CalOPPA).

You can’t block people from the CCPA/CalOPPA stuff just to get them to do the CIPA stuff first. All the compliance stuff has to work together.

Wrong: relying on CIPA consent to do “wiretapping” but not “sale or sharing”

Some lawyers claim a path through the legal weeds of the definitions of “wiretapping” and “sale or sharing” that makes it technically possible to load some third-party trackers with the right configuration to do something slightly different for the users who have given consent under CIPA but are still opted out under CCPA.

That’s just a recipe for explaining to CalPrivacy why the site isn’t doing dark patterns.

Regular people, even in California, don’t think about this stuff to understand why there is both and opt-out and a consent and they could technically be different.

The only manageable way to make it work is to lump, not split. CCPA opt out == CIPA no consent.

Bonus links

Hackers built a ‘Skynet mode’ agent that hijacks other people’s AI models to run its attacks by Ravi Gill. Someone has built a hacking agent that borrows its brain. It hunts the internet for AI models left open to strangers, hijacks one and uses it to plan and run attacks, while the model’s owner pays for every step.

Why I Resist Generative “AI” by Esther Weidauer. (Good list of reasons. Some of the best would apply even to a hypothetical future legit LLM.) The psychological damages caused by LLM use, sometimes even in the short time, are well documented by now, even by organisations operating or investing in these systems.

U.K. politicians and German publishers call on regulators to pause Meta’s new terms before October 30 deadline by Hanaa’ Tameez. The largest news publishing trade association in the United States is calling on Meta CEO Mark Zuckerberg to suspend the implementation of the company’s new commercial terms of service, set to go into effect on October 30.

AI Recipe Slop Networks Are Being Monetized Through Russian and Chinese Ad Tech from DecryptAds. In this report alone we found ads from brands including Adobe, HBO Max, Siemens, Subaru, The Wall Street Journal, Capital One, Sam’s Club, LinkedIn, Google Workspace, Tumi, Pepsi, Anker and VRBO running on these sites.

Accident Or Not, The No Kings Takedown Is Why You Shouldn’t Rent Your Megaphone From Zuck by Mike Masnick. (I believe it was a bug in the ML system, and I also believe the Big Tech firms do have a list of accounts that they will fix bugs for very quickly—but who gets on that list is political.)

HTML Can Do That by Chris Burnell. (Covers dialog and other handy elements, no JS needed. This site has a dialog element on it, if you try with ad blocker off: next steps on tinyMyTerms)