Comments of the Electronic Privacy Information Center to the California Privacy Protection Agency on Proposed Rulemaking Regarding Data Broker Registration Regulations

The Electronic Privacy Information Center (EPIC) submits these comments[1] in response to the California Privacy Protection Agency (CPPA)’s invitation for public input concerning the Agency’s development of regulations under Senate Bill 362, the Delete Act. We commend the Agency for ensuring more transparency into the opaque data broker industry and providing Californians with more information so that they can meaningfully exercise their rights under the California Consumer Privacy Act (CCPA).

EPIC is a public interest research center based in Washington, D.C., that was established in 1994 to focus public attention on emerging privacy and related human rights issues and to protect privacy, the First Amendment, and constitutional values.[2] EPIC has a long history of advocating for safeguards and rules to limit the harms caused by data brokers.[3] EPIC has previously provided comments on the CCPA,^[4] published a detailed analysis of the California Privacy Rights Act before its approval by California voters,^[5] and regularly presents oral testimony to the Agency to encourage the strongest protections for Californians.

EPIC supports the Agency’s efforts to rein in the largely opaque data broker industry. Although safeguarding the privacy of consumers requires far more than granting individual rights, providing Californians with transparency and choice is an important step in the right direction. EPIC supports the proposed regulations,[6] which will strengthen the data broker registry and ensure more meaningful compliance. The proposed regulations provide that the $400 registration fee plus processing fees can be paid via a standardized electronic payment method including debit card, check, or wire transfer if the business cannot pay by credit card. The proposed regulations also provide more clarity on the requirements for registration completion; explain that each data broker business is required to uniquely register regardless of its status as a parent company or subsidiary to another business; and require that businesses must provide accurate and functional website links and email addresses to the Agency. These regulations will improve the efficacy of the data broker registry by promoting clarity, accuracy, and completeness.

We support the proposed regulations’ broad definition of “reproductive health care data.” Under the proposed rules, data brokers will be required to disclose whether they collect consumers’ reproductive health care data, which will now be defined to include a wide array of reproductive and sexual information and inferences derived therefrom. The definition covers any information about a consumer searching for, accessing, procuring, using, or interacting with goods or services associated with the human reproductive system. Examples of goods include contraception, pre-natal and fertility supplements, menstrual-tracking apps, hormone-replacement therapy. Examples of services include sperm- and egg-freezing, in vitro fertilization, abortion care, vasectomies, sexual health counseling, treatment or counseling for STIs, erectile dysfunction, and reproductive tract infections; and precise geolocation information about such treatments. The definition also captures information about the consumer’s sexual history, health, and family planning (including information that the consumer puts on a dating app), and it specifically covers inferences derived from both reproductive and sexual information. EPIC supports this broad definition to fully protect the reproductive privacy of California consumers. As EPIC has previously explained, much of this information falls outside of the scope of HIPAA and is not adequately protected. When data brokers can collect and use this information to profile consumers, it can reveal pregnancy status and pregnancy outcomes, violating consumers’ privacy and exposing them to serious harm.[7] The Agency’s broad definition will help protect the reproductive privacy of California consumers from the invasive practices of data brokers.

While the proposed regulations will shed new light into the opaque data broker industry, the Agency should also require data brokers to provide an individual point of contact to be made publicly available on the registry—not just a URL and faceless email address. This change would increase data broker accountability and further the Agency’s goal of providing consumers with more information to help them exercise their privacy rights. Public contact information could be valuable to a consumer who seeks to get in touch with a data broker to clarify and exercise their rights under California law. This measure has been successfully implemented in other regulatory settings. For example, the Federal Communications Commission requires all voice service providers to furnish a designated contact person (name, department, contact number) for its Robocall Mitigation Database, and all of this information is publicly available.

EPIC supports the Agency’s efforts to enhance its data broker registry and rein in the privacy harms caused by the industry. EPIC supports the proposed regulatory clarifications and definitions and urges the Agency to require that data brokers supply an individual point of contact to be published on the registry.[8] We thank the Agency for the opportunity to comment on its proposed regulations and are eager to continue working with the CPPA to protect the privacy of all Californians.

Respectfully submitted,

/s/ John Davisson

Director of Litigation and EPIC Senior Counsel

/s/ Sara Geoghegan

EPIC Counsel

ELECTRONIC PRIVACY

INFORMATION CENTER (EPIC)

1519 New Hampshire Ave. NW

Washington, DC 20036

202-483-1140 (tel)

202-483-1248 (fax)

[1] EPIC Clerk Vaishali Nambiar contributed to these comments.

[2] EPIC, About EPIC (2022), https://epic.org/about/.

[3] EPIC, FCRA Rulemaking: A Path to Reining in Data Brokers, (2024) https://epic.org/documents/fcra-rulemaking-a-path-to-reining-in-data-brokers/; EPIC Comments to DOJ Regarding ANPRM on Access to Americans’ Bulk Sensitive Personal Data and Government Related Data by Countries of Concern (Apr. 19, 20224), https://epic.org/documents/epic-comments-to-doj-regarding-anprm-on-access-to-americans-bulk-sensitive-personal-data-and-government-related-data-by-countries-of-concern/; EPIC, Data Broker Threats: National Security (2024), https://epic.org/wp-content/uploads/2024/05/Data-Broker-One-Pager-National-Security-2.pdf; EPIC, CFPB Fair Credit Reporting Act Rulemaking (2024), https://epic.org/cfpb-fair-credit-reporting-act-rulemaking.

[4] Comments of Consumer Reports, Electronic Frontier Foundation (EFF), Electronic Privacy Information Center (EPIC) and Privacy Rights Clearinghouse (PRC) In Response to the California Privacy Protection Agency’s Invitation for Preliminary Comments On Proposed Rulemaking Under Senate Bill 362 (June 25, 2024), https://advocacy.consumerreports.org/wp-content/uploads/2024/06/Comments-of-Consumer-Reports-In-Response-to-the-California-Privacy-Protection-Agencys-Invitation-for-Preliminary-Comments-On-Proposed-Rulemaking-Under-Senate-Bill-362.pdf; Comments Of The Electronic Privacy Information Center, Center For Digital Democracy, and Consumer Federation Of America, to the California Privacy Protection Agency (Mar. 27, 2023), https://epic.org/documents/comments-of-the-electronic-privacy-information-center-center-for-digital-democracy-and-consumer-federation-of-america-to-the-california-privacy-protection-agency/; Comments of EPIC to Cal. Privacy Prot. Agency (Nov. 20, 2022), https://epic.org/wp-content/uploads/2022/11/EPIC-CPPA-Comments-Nov-20.pdf; Comments of EPIC et al. to Cal. Privacy Prot. Agency (Aug. 23, 2022), https://epic.org/wp-content/uploads/apa/comments/EPIC-CCPA-Feb2020.pdf; Comments of EPIC et al. to Cal. Privacy Prot. Agency (Nov. 8, 2021), https://epic.org/wp-content/uploads/2021/11/PRO-01-21-Comments-EPIC-CA-CFA-OTI.pdf; Comments of EPIC to Cal. Office of the Att’y Gen. (Feb. 25, 2020), https://epic.org/wp-content/uploads/apa/comments/EPIC-CCPA-Feb2020.pdf; Comments of EPIC to Cal. Office of the Att’y Gen. (Dec. 6, 2019), https://epic.org/wp-content/uploads/apa/comments/EPIC-CCPA-Dec2019.pdf.

[5] EPIC, California’s Proposition 24 (2020), https://epic.org/californias-proposition-24/.

[6] Data Broker Registration Proposed Text (Express Terms), CPPA (July 5, 2024) https://cppa.ca.gov/regulations/pdf/data_broker_reg_prop_text.pdf.

[7] Sara Geoghegan and Dana Khabbaz, Reproductive Privacy in the Age of Surveillance Capitalism, EPIC (July 7, 2022) https://epic.org/reproductive-privacy-in-the-age-of-surveillance-capitalism/.

[8] Call Authentication Trust Anchor, WC Docket No. 17-97, Second Report and Order, FCC 20-136, at 46, para. 84-85 (Sept. 29, 2020), https://docs.fcc.gov/public/attachments/FCC-20-136A1.pdf.