Many Apps Not Compliant With California Privacy Law, Group Says

Nearly half of products or apps used by families are not in compliance with new California privacy rules that will be enforced beginning July, according to a report released Wednesday by Common Sense Media, a nonprofit group that advocates for more safeguards for youth in the tech space.

The report examined the privacy policies and practices of 200 of the most popular digital products used by families and children, such as Discord and Netflix. Forty-eight percent of them will need to adapt to new definitions around “selling” and “sharing” data or risk enforcement penalties, according to the report.

The California Privacy Rights Act, passed by voters in 2020 to strengthen privacy protections, technically became law in January, but enforcement for the new rules begins Saturday.

One of the key updates from the law added the sharing of data—not just selling data for monetary value—to disclosure and consent requirements. The change particularly targeted cross-context behavioral advertising, where personal data beyond the primary app is given to other companies to track and advertise the user. The language was meant to close a loophole where companies could ignore privacy rules by saying they did not sell the information for money, but rather entered into a relationship with the third party. Privacy advocates argued selling and sharing data, whether for cash or for advertising, are essentially the same.

The report found that 73% of companies told customers last year that they do not sell their personal information. However, under the new law, many of those same businesses—48% of all companies—had other practices like third-party tracking that are now considered “selling or sharing” data and have to be disclosed as such.

With the new law now lumping “selling” and “sharing” data together, the landscape for which companies are subjected to data transaction rules will shift drastically, the report said. For this year, at least 62% of companies should be disclosing they essentially sell personal data—a big turnaround from the 73% last year that said they did not sell data.

A number of the company privacy policies examined by the group were unclear and could not be analyzed to determine whether the business was selling or sharing data, which the report criticized. Consumers can be easily confused about the difference between sharing and selling data, according to the nonprofit.

Common Sense Media said it’s important for companies who profit off of data to tell people they’re doing so.

The group added the updated rules “were a good first step toward increasing clarity on what the sale of data means in order to better protect kids and families, who can now make better informed decisions about whether to use products that say they sell kids’ data for profit.”

It also advocated for additional actions, especially on enforcement.

“But we can’t stop there. The next step will require holding companies accountable when they don’t follow the rules or when they mislead consumers by saying they don’t sell data,” the group said.