Data privacy laws are not about secrecy, they are about transparency. I am well versed in both. I was one of the original co-authors of the California Consumer Privacy Act (CCPA), the most comprehensive privacy law in the United States, and before that I was a CIA counterintelligence officer and general counsel to the House Intelligence Committee. Unsurprisingly, my career as a spy, including overseeing the NSA wiretapping program that Edward Snowden later disclosed, made me realize how desperately the United States needs laws protecting consumers' online privacy. I am impressed by this quote from Gabriel Weinberg, founder of the privacy-oriented search engine DuckDuckGo, who said that the NSA's "privacy laws" are "not about privacy, but about the privacy of the people who use them. In other words, your information may not be secret, but it should remain private.

The U.S. government did not get that memo; until the CCPA went into effect on January 1, 2020, there were minimal regulations on what personal information companies could collect, how they could use it, and with whom it could be shared. Outside of California, this is still the case. When you click "I agree" on an app or website, it is nearly impossible to know what terms you are really agreeing to. Companies can know where you live, how fast you drive, whether you have a chronic health condition, and even whether you are pregnant or a rape victim.

This personal information is used to serve you unsolicited advertising, spurring the $100+ billion digital advertising market. There are even entire companies, called ad brokers and data brokers, that collect, package, and sell the data. Data is shared with employers, insurance companies, marketers, and others. Some companies create e-scores that virtually anyone can purchase. Unfortunately, the discriminatory impact of e-scores greatly affects women and people of color.

The CCPA gives all Californians the right to know what information companies are collecting, to opt out of the sale of their personal information, and to sue companies if their personal information is stolen. The looming question is whether Congress will pass a comprehensive federal privacy law like the European Union's General Data Protection Regulation. Several bills have been introduced, including by Senator Kirsten Gillibrand of New York, but have largely failed due to lobbying by the tech, retail, and advertising industries.

Government change will take time, but there are some things you can do now: if you live in California, opt out of the sale of your data. (If you live in Nevada or Maine (both of which have privacy laws), know how you are protected. If not, contact your agent and request that they enact a law. (Several states, including New York and Washington, are working on legislation.) Your information is being used against you. It is time to get your information back.

This article was originally published in the Fall 2020 issue of Marie Claire.

Click here to subscribe (opens in new tab)