I sat down to write about the changes in California law that went into effect on January 1, and like any good millennial, prior to starting, I took a little trip down the social media rabbit hole.  Amidst the several pictures of food, I saw a video of a child that probably wouldn’t want the video to follow them through their life.  The video was posted to an Instagram story, and so the parent likely thought that it would disappear after 24 hours.

You may have noticed that in nearly every single app that you have on your phone, when you opened them for the first time in 2020, you received a popup notification asking you to agree to a new privacy policy.  California Assembly Bill 25 amended the California Consumer Privacy Act (more widely known as the “CCPA”) to require businesses to provide consumers (including employees and applicants) with notices about what categories of information they collect about them and its purpose for collecting said information.  The law requires these notices to be provided before or at the time of collection.  Therefore Instagram, Snapchat, and whichever map app you use to provide you directions had to provide you an opportunity to see the updated, and CCPA-compliant privacy policy that their lawyers helped them draft ahead of the updated law in 2020.

All California citizens now have the right to know what type of data most big companies are collecting from us, and more importantly, whether that data is being sold to third parties.  We have the right to opt out of those sales.  And we have the right to request to see any data that has already been collected and ask the company to delete it.  Unfortunately, there are two problems raised by your trying to avail yourself of those rights.  First, we are assuming that companies are fully compliant with the law, and as your friendly neighborhood lawyer, I can tell you many are not.  Second, in many cases, the only mechanism that the companies can provide to you in order to delete your data is to delete your account entirely, a step many of us don’t want to take.

Where this conversation really begins is the same place that almost every conversation about the modern internet begins – a determination of how much you value convenience.  There was an excellent study done by New York Times reporters in January about the way in which our phones collect location data, and how easily a fairly accurate portrait of a person’s life can be put together simply from the metadata collected by our phones and apps, even if identifying information (e.g., phone numbers or names) are removed from the data.

Typically, when I begin describing how important this is to people, this is when they look at me and say “Well I have nothing to hide, so why should I care?”  This is indeed a fair point.  It is also the kind of thinking that got us to the point where the state of California decided to step in to protect its citizens from data mining companies, but doesn’t go nearly as far as the European Union does in its privacy protections for its citizens.  However, these same people often are the ones who think it’s “so weird” that Instagram or Facebook shows them advertisements for whatever product they were just talking about with their friends.  These apps can do this because of all of the metadata that your phone collects, and the permissions that these apps have gained from our collective unwillingness to read long privacy policies and simply hit the accept button so that we can see more pictures of our friends’ kids or grandkids.

In the meantime, if you actually go through the process of requesting from Facebook the private data that they have been collecting from you on any one of their apps (Facebook, Instagram, or WhatsApp being the most popular), you can eventually be emailed a link to download your data.  What a short (it’s not short) and simple (it’s not simple) perusal into your data files from Facebook will show you is the data that you have shared with Facebook or Instagram – personal information, apps you’ve granted permissions to, photos you’ve uploaded, etc.  However, what these files won’t show you is all of the metadata that has been collected on you by Facebook. 

Even though Instagram knows which pictures you linger on longer than others, which stories you view multiple times, what types of accounts you are most likely to click on in the Explore tab, and use this information in order to provide better advertisements to you, it isn’t in your data file that you can quickly (it’s not quick) and easily (it’s not easy) download from them.

The more access a company has into your life, the more convenience they can provide to you – Google provides you a free search engine, free and unlimited email (Gmail), free maps with accurate GPS guidance (Google Maps and Waze), or a free catalog of entertaining videos (YouTube).  However, that data has helped make Google one of the largest, if not the largest (depending on the metrics you use) sellers of online advertisements.  Three companies (Google, Facebook, and Amazon) sell over 70% of all online advertising.  When you think about how much information those three companies have about us, it makes sense how they can provide such targeted advertising.

My advice? Request your data – see what they are collecting. Update your privacy settings to provide as little free data as you possibly can.  However, telling you to delete your accounts would be a waste, since I wrote this and haven’t deleted mine.