ABSTRACT
It is time for the United States Congress to pass a comprehensive consumer privacy law. The GDPR and the CCPA serve as starting points for several recent bills. However, neither the GDPR nor the CCPA distinguish in their choice frameworks based on whether or not personal information is reasonably identifiable, or on whether or not personal information is used for tracking. As a result, the GDPR fails to effectively incentivize use of pseudonymization, and the CCPA fails to effectively disincentivize tracking. In this paper, we develop classifications of personal information based on the degree of identifiability of this information. We create a choice framework that, unlike the GDPR or the CCPA, utilizes all three options: mandating use through terms and conditions, requiring an opt-out choice, and requiring opt-in consent. We develop corresponding notice requirements that enable consumers to make informed choices over the collection, use, and sharing of their personal information. These proposals can be used to create policy options in between those offered by the GDPR and the CCPA.
Jordan, Scott, A Proposal for Notice and Choice Requirements of a New Consumer Privacy Law (November 3, 2021). Federal Communications Law Journal, forthcoming.
First posted 2021-12-20 14:00:48
Leave a Reply