CCPA Encounters First Big Challenge from Facebook

Less than a month after the California Consumer Privacy Act (CCPA) went into effect, it appears Facebook will not be changing its web tracking practices anytime soon in response. Facebook is challenging its obligation to comply with the new law through a CCPA exemption for “service providers.” Facebook argues it can avoid CCPA compliance by defining itself as a “service provider” who acts as a platform that delivers anonymized data about its users to clients.

The CCPA went into effect January 1 and is the first step toward giving California consumers control over how their personal information is collected, used, and shared. Facebook argues it does not directly sell the data it collects about its users to third-party companies, and Facebook only acts as a service that runs ads. If Facebook were to be characterized by a court as a “service provider,” Facebook would be exempt from the regulations outlined in the CCPA.

Challenges like this were expected by legal experts, as definitions of terms such as “sale” and “service provider” are subject to interpretation. The California Attorney General’s office is releasing final regulations this year which could clarify these and other terms.

Privacy advocates claim that while the CCPA’s definition of “personal information” is broad, it includes browsing history and IP addresses, which Facebook does collect. The social media giant’s advertisement platform uses customer demographics, behavior, and browsing data to create profiles that deliver targeted ads to its users for its paying customers. If subjected to the CCPA, Facebook’s free users would be provided the right to opt-out of being served advertisements by revoking the company’s right to use their information.

Similarly, Google is offering “restricted data processing” to its partners who buy and sell ads through its platform to enable businesses to comply with the CCPA. With restricted data processing enabled, Google will act as an affected businesses’ data processing service provider, setting itself up to be defined as a CCPA service provider. However, privacy advocates claim this restricted data processing option doesn’t fully comply with the CCPA, which calls for a clear “do not sell my data” option for California consumers.

Clarification from the California Attorney General is expected to answer the challenges raised by both Facebook and Google. Trade associations, including the American Association of Advertising Agencies, are requesting the Attorney General’s office “delay enforcement for at least six months” to allow time for the clarification.

Businesses charged with a CCPA violation face fines starting at $2,500 per individual affected for unintentional web tracking and $7,500 for each intentional violation. Once a consumer notifies a company of an intended legal action for a CCPA violation, the company has only 30 days to remedy the situation. This applies to a business if one of the following three statements are true: 1) buy, receive or sell the personal information of 50,000 or more consumers, households, or devices; 2) have gross revenues in excess of $25 million; or 3) derive 50% or more of your revenue from selling consumers’ personal information.

David Kaufman
David (Dave) Kaufman has spent his entire career in the legal field, consulting with clients to develop class action settlement solutions in the securities, antitrust, consumer, mass tort, employment and insurance practice areas. Drawing from his 15 years experience, Dave specializes in pre-settlement consultation, enabling clients to better identify their needs to more efficiently and cost-effectively execute settlements.

Back to Blog


Subscribe to our blog

[eBook]: Tools for Navigating the Class Action Settlement Process

Find Out More

[On-Demand Webinar] Navigating the Settlement Administration Process from Start to Finish

Find Out More

New to Class Action Litigation? Start With Our Free Resources

Find Out More