PRIVACY, PRICING, AND THE VALUE OF CONSUMER DATA: THE COMPLEX NATURE OF THE CCPA’S NON-DISCRIMINATION REQUIREMENT

By Jeewon Kim Serrato and Lawrence Wu¹

I. INTRODUCTION

Much like how there was debate in the past on whether the goals of antitrust and intellectual property law were incompatible or complementary,² we should anticipate many debates on how the goals of privacy law may affect the way firms compete, particularly when consumers are given a choice of opting in or opting out of providing companies with their personal information and when those choices may be affected by the prices charged and the services offered by those companies. With the passage of the California Consumer Privacy Act (CCPA),³ which went into effect on January 1, 2020, this issue is now front and center.

The CCPA is a first-of-its-kind law that requires businesses to calculate the value of consumer data. While it includes several new consumer rights, such as the right to know, right to delete, and a right to opt-out, this article will focus on the right to non-discrimination and the complexities that businesses will face as they navigate three things: the need to ensure consumers’ right to privacy and non-discrimination under the CCPA; the ability to offer competitive prices and marketing incentives to meet consumer demands; and the opportunity to earn revenue from the consumer data they may be able to collect, sell, and retain. These three interrelated objectives complicate what businesses may have to do to meet one of the fundamental requirements under the CCPA, which is this: if a business offers financial incentives or a price or service difference as compensation for the collection, sale, or retention of consumer data, the business must explain how the incentives or price or service difference are reasonably related to the value of the data to the business. This is uncharted territory; and while we wait to see what enforcement actions the California Attorney General brings under this law, which began on July 1, 2020, we cannot underestimate the lasting impact the law may have on the global privacy discourse and how regulators view the respective rights and powers the consumers and businesses have in controlling the use of personal data that is collected about individuals.