IV. PROPOSED ADJUSTMENTS

IV. PROPOSED ADJUSTMENTS

IV. PROPOSED ADJUSTMENTS

[32] Upcoming generations deserve protection from voracious data collectors. Several solutions have been offered.¹²⁸ Reevaluating the framework by which today’s social media use and online activity is understood will hopefully contribute to the burgeoning scholarship about online privacy protection. As the previous section outlined, surveillance capitalism fundamentally alters the way we interact online and presents unprecedented problems for Generation Z—and beyond.¹²⁹ Thus, as COPPA enters its third decade, understanding the mechanisms of data collection becomes more pertinent.

¹²⁸ See infra text accompanying notes 137–39.

¹²⁹ Compare Joe Pinsker, Oh No, They’ve Come Up With Another Generation Label, THE ATLANTIC (Feb. 21, 2020), https://www.theatlantic.com/family/archive/2020/02/generation-after-gen-z-namedalpha/606862/ [https://perma.cc/LC6M-PPED] (“Generation Alpha . . . will grow up to be . . . the most technologically immersed [generation].”), with Brian Sharon (@ThatBShar), TWITTER (Mar. 19, 2020, 1:09 PM), https://twitter.com/ThatBShar/status/1240701836132155393 [https://perma.cc/A3G9- 5HDB] ( “There’s so much video calling going on that the babies conceived during the coronavirus pandemic should be called ‘Baby Zoomers’. @zoom_us”), and Kevin Smith (@KevinSmithNBA), TWITTER (Mar. 25, 2020, 7:23 PM), https://twitter.com/KeithSmithNBA/status/1242955200102629376 [https://perma.cc/B8HE-34EG] (“Are we all agreed that babies born 9 months after COVID-19 are going to be call coronials? And in 2033/2034 they’ll all become quaranteens? #dadjoke”).

A. Promulgation of COPPA

[33] As the number of internet-connected devices increases,¹³⁰ our concept of the internet will disappear.¹³¹ The sprawl of our internetconnected and online-focused world highlights the need for increased protection for our children. COPPA must evolve with our increasingly connected world:

[S]ince the enactment of COPPA, the internet has grown and the way data is stored, collected, and disseminated over the internet has become more complex and more prominent. ‘[I]n light of [these] changes in online technology,’ the FTC amended the Rule in 2013 to ‘clarify the scope of the Rule and strengthen its protections for children’s personal information . . . .’¹³² The amendment modified certain definitions, updated COPPA’s requirements, and included a new provision regarding data retention and deletion. Despite these efforts to better align COPPA with the potential harms child internet users face, the 2013 revision still falls short in meeting its stated goals of protecting children’s internet privacy. Accordingly, the need to protect child privacy online remains strong and relevant.¹³³

¹³⁰ See generally Peter M. Lefkowitz, The Profession: Making Sense of the Internet of Things, 59 BOSTON. B. J. 23 (2015) (examining the Internet of Things and how devices will grow in future years).

¹³¹See Dave Smith, Google Chairman: ‘The Internet Will Disappear’, BUSINESS INSIDER (Jan. 25, 2015), https://www.businessinsider.com/google-chief-eric-schmidt-the-internetwill-disappear-2015-1 [https://perma.cc/S3SU-FHJ5] (quoting Google Chairman Eric Schmidt: “[T]he internet will disappear . . . . There will be so many IP addresses … so many devices, sensors, things that you are wearing, things that you are interacting with that you won’t even sense it. It will be part of your presence all the time.”).

¹³² Children’s Online Privacy Protection Rule, 78 Fed. Reg. 3972 (Jan. 17, 2013) (codified at 16 C.F.R. pt. 312).

¹³³ Shannon Finnegan, Note, How Facebook Beat the Children’s Online Privacy Protection Act: A Look into the Continued Ineffectiveness of COPPA And How to Hold Social Media Sites Accountable in the Future, 50 SETON HALL L. REV. 827, 830 (2020) (footnotes omitted).

FTC Commissioner Noah Phillips opined:

[T]he American privacy framework is built upon identifying risks and then designing a solution that balances competing interests. That requires evaluating the sensitivity of the information involved and the potential harms that would result from its collection, use or disclosure, and then creating a solution that will limit these harms while still allowing appropriate use of even sensitive information. With COPPA, rather than trying to protect children by limiting their experience on the Internet, Congress instead created a comprehensive, yet flexible, framework to protect both children’s privacy and their ability to access interactive content on the Internet.¹³⁴

[34] Before considering additional COPPA amendments, Commissioner Phillips stressed that original intent¹³⁵ must be remembered, rulemaking must be “grounded in facts, . . . rather than predicated on unsupported fear or speculation[,]” and regulation must focus on harmful conduct, not data collection in general.¹³⁶ Currently, there are several proposed solutions for online privacy issues that range from the imposition of a fiduciary duty on entities that collect or retain users’ information¹³⁷ to banning sexual predators on social media¹³⁸ to shifting the regulation to state legislatures.¹³⁹

¹³⁴ Noah Joshua Phillips, Comm’r, Fed. Trade Comm’n Remarks at The Future of the COPPA Rule: FTC Staff Workshop, at 2 (Oct. 7, 2019), https://www.ftc.gov/publicstatements/2019/10/remarks-commissioner-noah-joshua-phillips-ftc-workshop-futurecoppa-rule [https://perma.cc/7MK4-B8TL].

¹³⁵ See 144 CONG. REC. S11, 657 (daily ed. Oct. 7, 1998) (statement of Sen. Bryan) (stating COPPA’s original goals: “to enhance parental involvement in children’s online activities to protect both their privacy and safety; to maintain the security of the personally identifiable information collected from children online; and to protect children’s privacy by limiting the collection of personal information from children without their parent’s consent.”).

¹³⁶ Phillips, supra note 134, at 4–5.

¹³⁷ See Peter C. Ormerod, A Private Enforcement Remedy for Information Misuse, 60 B.C. L. REV. 1893, 1929 (2019).

¹³⁸ See Mico, supra note 124.

¹³⁹ See Blaire Bayliss, The Kids Are Alright 😂 🍆 🍑: Teen Sexting, Child Pornography Charges, and the Criminalization of Adolescent Sexuality, 91 U. Colo. L. Rev. 251, 280–281 (2020).

B. COPPA’s Limitations

[35] Several articles—coincidentally written by juris doctorate candidates—address the general inefficiency of COPPA and online privacy laws.¹⁴⁰ Perhaps the most notable problem is that kids frequently lie about their age.¹⁴¹ In 2011, a study found that about 40% of teens lie about their age to access a website or signup for an online account.¹⁴² By 2014, another study found that one-quarter of U.S. children between the ages of 8 and 12 use Facebook.¹⁴³ Moreover, children are not the sole falsifiers: parents also help their children circumvent many age-restricted sites.¹⁴⁴

¹⁴⁰ See, e.g., Christie Dougherty, Every Breath You Take, Every Move You Make, Facebook’s Watching You: A Behavioral Economic Analysis of the US California Consumer Privacy Act and EU E-Privacy Regulation, 12 NE. U. L. REV. 629, 658 (2020) (“Informed consent is meaningless in the area of privacy law when companies exploit consumers’ irrational behaviors and inabilities to accurately and completely assess the tradeoffs of privacy disclosures.”); Lauren A. Matecki, Update: COPPA Is Ineffective Legislation! Next Steps for Protecting Youth Privacy Rights in the Social Networking Era, 5 NW. J.L. & SOC.POL’Y 369, 370 (2010); Mark Peasley, It’s Time for an American (Data Protection) Revolution, 52 AKRON L. REV. 911, 943 (2018); Nicole Smith, Protecting Consumers in the Age of the Internet of Things, 93 ST. JOHN’S L. REV. 851, 866 (2019).

¹⁴¹ See Madden et al., supra note 96.

¹⁴² *Id. *

¹⁴³ Mary Aiken, The Kids Who Lie About Their Age to Join Facebook, THE ATL. (Aug. 30, 2016). https://www.theatlantic.com/technology/archive/2016/08/the-social-mediainvisibles/497729/ [https://perma.cc/JXE7-X7AL] (“It wasn’t just 11-to-12-year-olds who were going there: 34 percent of the Facebook users in the study were 8-to-10-yearolds. In the EU study, one-quarter of the 9-to-10-year-olds and one-half of the 11-to-12- year-olds were using the site as well: Four out of 10 gave a false age.”).

¹⁴⁴See Danah Boyd et al., Why parents help their children lie to Facebook about age: Unintended consequences of the ‘Children’s Online Privacy Protection Act’, 16 FIRST MONDAY 11 (2011), https://journals.uic.edu/ojs/index.php/fm/article/ download/3850/3075 [https://perma.cc/6T2X-BVZM] (“The online industry’s response to COPPA’s under–13 rule and verifiable parental consent model is largely proving incompatible, and at times, antithetical to many parents’ ideas of how to help their children navigate the online world. Instead of providing more tools to help parents and their children make informed choices, industry responses to COPPA have neglected parental preferences and have altogether restricted what is available for children to access. As a result, many parents now knowingly allow or assist their children in circumventing age restrictions on general–purpose sites through lying. By creating this environment, COPPA inadvertently hampers the very population it seeks to assist and forces parents and children to forgo COPPA’s protection and take greater risks in order to get access to the educational and communication sites they want to be part of their online experiences.”); accord Steven Johnson, The Bargain at the Heart of the Kid Internet, THE ATL. (Apr. 12, 2018), https://www.theatlantic.com/family/archive/2018/04/child-dataprivacy/557840/ [https://perma.cc/3GE5-V5GN].

[36] Websites set their minimum age to thirteen primarily because of COPPA’s restriction. ¹⁴⁵ Because websites are seemingly complaint, the FTC has had little incentive to reevaluate COPPA’s restriction.¹⁴⁶ Consequently, the FTC has not challenged this process, effectively accepting that age disclosure with a minimum age requirement sufficiently complies with COPPA.¹⁴⁷

¹⁴⁵ See Bethany Brown, Comment, Children’s Right to Privacy on the Internet in the Digital Age, 20 J. TECH. L. & POL’Y 223, 225, 227 (2020) (stating that the Children’s Online Privacy Protection Rule described anyone under the age of thirteen as a child). Finnegan, supra note 133, at 835.

¹⁴⁷ Andrea M. Matwyshyn, Of Teenagers and Tweenagers: Professor Allen’s Critique of the Children’s Online Privacy Protection Act in Historical Perspective, 13 AM.PHIL. ASS’N NEWSL. 8 (2013) [hereinafter Matwyshyn, Of Teenagers and Tweenagers]; see also Andrea M. Matwyshyn, Generation C: Childhood, Code and Creativity, 87 NOTRE DAME L.R. 1979, 2018–2022 (2012) (arguing for the extension of the minority doctrine to digital spaces) [hereinafter Matwyshyn, Generation C].

[37] Enforcing these restrictions is also an issue.¹⁴⁸ “The vast ineffectiveness of COPPA, and the failure to adequately enforce it in a manner that promotes its underlying objectives, supports Zuckerberg’s opinion that a law to regulate teenage data—if bearing any resemblance to COPPA—would likely be unnecessary.”¹⁴⁹ COPPA’s enforcement determines its effectiveness: the FTC must be properly equipped to enforce COPPA as legislators continue regulating the “Tech Titans.”¹⁵⁰

C. Modest Proposals

[38] In their review of The Age of Surveillance Capitalism, Justice Cuéllar and Professor Huq animadvert on how legal scholars disregard the ambiance of neoteric technology:

[L]egal scholarship tends to be discrete in its focus and granular in its analysis when it comes to novel technological development. We myopically scrutinize a specific technology, such as social media platforms, machine learning, or the internet of things, and try to understand how that phenomenon relates to existing legal templates. This work is valuable, even essential. But scholars and lawyers can miss the forest for the trees when they consider only parts rather than the integrated whole of the emerging datadriven economy. System-level effects, whether positive or negative, may be missed when discrete technologies or legal changes are analyzed in isolation. Gains or losses that spill over from one domain of human activity to another may be sliced out of the analytic frame. Without a clear sense of how discrete technologies are deployed, legal scholars are left with the feeling that they know something is happening, but they don’t know what it is.¹⁵¹

¹⁴⁸ See Brown, supra note 145, at 227.

¹⁴⁹ Finnegan, supra note 133, at 828.

¹⁵⁰ See id.

¹⁵¹ Mariano-Florentino Cuéllar & Aziz Z. Huq, Economies of Surveillance, 133 HARV. L. REV. 1280, 1283–84 (2020) (reviewing SHOSHANA ZUBOFF, THE AGE OF SURVEILLANCE CAPITALISM: THE FIGHT FOR A HUMAN FUTURE AT THE NEW FRONTIER OF POWER (2019)).

[39] The issue has been framed, the stage set, the gauntlet laid. The following three proposals address the need for more consumer protection, especially for children, in hopes of advancing the privacy rights conversation. Given the gradual regulation of the internet’s rapid metamorphosis, these proposals will undoubtedly contain overlooked—and possibly outdated¹⁵²—issues in the coming months and years. However, the conversation must continue—not only to educate the uninformed, but to defend the unaware.

¹⁵² See, e.g., Euirim Choi, Facebook Offers Money to Reel in TikTok Creators, WALL ST. J., (July 28, 2020, 5:30 AM), https://www.wsj.com/articles/facebook-seeks-to-reel-intiktok-creators-raising-stakes-in-social-media-rivalry-11595928600 [https://perma.cc/4VW4-G8E6] (discussing Facebook’s new service, Instagram Reels, which aims to compete with TikTok and is scheduled to launch in the U.S. and other countries in August 2020); Rob Copeland, Google’s Advertising Haul Comes Up Short for First Time, *WALL ST. J., (last updated July 30, 2020, 7:26 PM), https://www.wsj.com/ articles/google-alphabet-googl-2q-earnings-report-2020-11596139328 [https://perma.cc/F5JF-CJXB] (noting Google’s first quarterly revenue decline since its inception as a result of the global pandemic); Georgia Wells et.al., *Inside the Microsoft Talks to Buy TikTok’s U.S. Business, WALL ST. J., (last updated Aug. 3, 2020, 10:47 AM), https://www.wsj.com/articles/microsoft-aims-for-a-deal-to-buy-tiktoks-u-s-

1. Increase the Penalty

[40] Until the monetary penalties exceed the benefit of harboring children’s behavioral data, companies will continue to violate COPPA. Until then, COPPA penalties will remain as another “cost of doing business.”¹⁵³ Discovering the monetary value of children’s online behavioral data is the main barrier from determining the appropriate penalty.¹⁵⁴ A framework shift from basic data collection to behavioral surplus is required to properly regulate these sites. Without austere penalties, “surveillance capitalists are impelled to pursue lawlessness” and “vigorously lobby to kill online privacy protection . . . because such laws are existential threats to the frictionless flow of behavior surplus.”¹⁵⁵

[41] As noted earlier, courts limit an operator’s civil penalty to $43,280 per violation, though that amount decreases depending on several factors.¹⁵⁶ This amount is simply not enough to dissuade companies from collecting children’s data.¹⁵⁷ The FTC should raise the amount of each violation in substantial increments until the violations cease. Until the violations stop, the economic presumption is that the revenue generated from children’s behavior is still higher than the cost of paying the penalty.¹⁵⁸

business-11596418842 [https://perma.cc/E9GW-3T3V] (discussing the potential sale of TikTok to Microsoft in the coming weeks).

¹⁵³ Cf. Eldar Haber, Toying with Privacy: Regulating the Internet of Toys, 80 OHIO ST. L.J. 399, 441–442 (2019) (“[Online service provides] must not see fines as costs of doing business and should reflect further on the gravity of poor security measures. Policymakers should thus implant in the FTC more substantial regulatory teeth. This would enable the Commission’s fines not merely to reflect the level of consumer loss but rather to sanction violations, with fines as percentages of annual global turnover.”).

¹⁵⁴ See, e.g., Noam Kolt, Return on Data: Personalizing Consumer Guidance in Data Exchanges, 38 YALE L. & POL’Y REV. 77, 87–88 (2020).

¹⁵⁵ ZUBOFF, supra note 73, at 105; see also TRACY, *supra *note 77. *See generally id. *at 104–105 (comparing Google and Facebook’s unfettered freedom to Gilded Age “robber barons”).

¹⁵⁶ COPPA FAQs, supra note 19.

¹⁵⁷ In 2011, there were an estimated 7.5 million underage users on Facebook. Marc Perton, Facebook’s Zuckerberg wants to let kids under 13 onto site, CONSUMER REPORTS NEWS (May 20, 2011), https://www.consumerreports.org/cro/news/2011/05/facebook-szuckerberg-wants-to-let-kids-under-13-onto-site/index.htm [https://perma.cc/33FETWE9]. As for a basic calculation: 7.5 million violations x $100-$43,280 penalty = $0.75-324.6 billion. Any increase in penalty would further—and possibly sufficiently— exacerbate a violator’s punishment.

¹⁵⁸ Facebook’s 2019 net income was over $18 billion and their 2019 Fourth Quarter net income was over $7 billion. Facebook Investor Relations, Facebook Reports Fourth Quarter and Full Year 2019 Results, FACEBOOK (Jan. 29, 2020), https://investor.fb.com/investor-news/press-release-details/2020/Facebook-ReportsFourth-Quarter-and-Full-Year-2019-Results/default.aspx [https://perma.cc/Q3VS-QEZ9]. Leaving the law-students-are-bad-at-math joke behind, Facebook could pay its“unprecedented” $5 billion settlement from its Q4 net income and still profit over $2 billion—just for that quarter!

2. Increase the Age

[42] COPPA’s age minimum should be increased to eighteen.¹⁵⁹ As discussed earlier, the age of thirteen is arbitrary.¹⁶⁰ Common law recognizes the age of eighteen as the age of contractual capacity:

[U]sing the age of thirteen as the ostensible age of consent for privacy contracting in digital spaces creates an irreconcilable conflict with the minority doctrine in contract law. Contract law has historically considered these concerns of child judgment when crafting its own rules. Since the issue that COPPA . . . address[es] relates to a particular contracting context—data privacy and information security contracting—a logical age of consent is one which mirrors contractual capacity generally. Applying a contract law analysis, the usual age of contractual capacity is eighteen, not thirteen.¹⁶¹

¹⁵⁹ Cf. Berin Szoka & Adam Thierer, COPPA 2.0: The New Battle over Privacy, Age Verification, Online Safety & Free Speech, 16 PROGRESS & FREEDOM FOUND., at 6 n.20 (June 2009) (discussing the term “child” as someone under eighteen).

¹⁶⁰ Matwyshyn, Of Teenagers and Tweenagers, supra note 147 at 7.

¹⁶¹Id. at 8; see also Matwyshyn, Generation C, supra note 147.

[43] Moreover, there is a reason that children cannot vote,¹⁶² enlist in the military,¹⁶³ drive,¹⁶⁴ consume tobacco,¹⁶⁵ drink alcohol,¹⁶⁶ or do several other activities:¹⁶⁷ a child’s capacity to understand consequences develops with time. As such, companies should not exploit children’s behavioral data until children have turned eighteen. Adults can protect themselves from online manipulation,¹⁶⁸ but society must protect children.

¹⁶² See Tex. Const. art. VI, § 1 (limited to eighteen and older).

¹⁶³ See TEX. GOV’T CODE ANN. § 437.302(b)(3) (West 2020) (eighteen and older).

¹⁶⁴ See TEX. TRANSP. CODE ANN. § 521.204(a)(1) (West 2020) (sixteen or older); TEX. TRANSP. CODE ANN. § 521.222 (West 2020) (learner’s permit at age fifteen).

¹⁶⁵ See TEX. HEALTH & SAFETY CODE ANN. §§ 161.251–161.257 (West 2020) (twentyone and older).

¹⁶⁶ See TEX. ALCO. BEV. CODE ANN. § 106.01–106.02 (West 2020) (twenty-one and older).

¹⁶⁷ See, e.g., TEX. LABOR CODE ANN. § 51.011 (West 2020) (limiting employment to at least fourteen years of age); TEX. ALCO. BEV. CODE ANN. § 106.09(a) (West 2020) (“[N]o person may employ a person under 18 years of age to sell, prepare, serve, or otherwise handle liquor, or to assist in doing so.”); TEX. LABOR CODE ANN. § 51.016(b) (West 2020) (limiting “sexual oriented employment” to at least eighteen years of age); TEX.PENAL CODE ANN. § 43.24(a–b) (West 2020) (prohibiting the sale or distribution of sexual material to a person younger than eighteen years of age); TEX. CIV.PRAC. & REM. CODE ANN. § 129.001 (West 2020) (“The age of majority in this state is 18 years.”); TEX. ELEC. CODE ANN. § 141.001(a)(2) (West 2020) (limiting eligibility to run for public office to at least eighteen years of age).

¹⁶⁸ Cf. Johnson, supra note 92, at 447 (arguing that COPPA should extend to adults as well: “If COPPA applied across the board, companies, regulators, and the public would not need to engage in any exercises to determine whether COPPA applied. It would apply.”).

3. Increase the Stakes

[44] The manufacturing of “prediction products” from children’s behavioral data should be criminalized as another form of child abuse.¹⁶⁹ In the seminal case, Packingham v. North Carolina, the U.S. Supreme Court ruled on a state’s law regulating social media sites for the first time.¹⁷⁰ There, the Court held that a North Carolina law prohibiting registered sex offenders from accessing a “commercial social networking Web site”¹⁷¹ was too broad and thereby violated the First Amendment.¹⁷² However, the Court noted:

While we now may be coming to the realization that the Cyber Age is a revolution of historic proportions, we cannot appreciate yet its full dimensions and vast potential to alter how we think, express ourselves, and define who we want to be. The forces and directions of the Internet are so new, so protean, and so far reaching that courts must be conscious that what they say today might be obsolete tomorrow.¹⁷³

¹⁶⁹ See generally 18 U.S.C. § 2252 (2018) (listing prohibited products involving minors).

¹⁷⁰ See Packingham v. North Carolina, 137 S. Ct. 1730 (2017).

¹⁷¹ See N.C. GEN.STAT. ANN. §§ 14–202.5(a), (e) (2015).

¹⁷² See Packingham, 137 S. Ct. at 1738.

¹⁷³ Id. at 1736.

[45] The Court further observed that all new technologies, including the internet and social media, will be “exploited by the criminal mind” and “become instruments used to commit serious crimes.”¹⁷⁴ The Court suggested that a more narrowly tailored law prohibiting registered sex offenders or other bad actors from abusing children online would not be unconstitutional.¹⁷⁵

[46] The concurring opinion takes a step further by stating that safeguarding the psychological well-being of a minor is necessary even if laws must contravene constitutional rights.¹⁷⁶ Moreover, States have a compelling interest to prohibit online child abuse because bad actors can— and will continue to—use the internet to exploit children¹⁷⁷

[47] Legislators cannot adequately regulate the “new logic of accumulation” without understanding how online behavioral data are manipulated into “prediction products.”¹⁷⁸ There is already a duty to report any online activity that sexually exploits children.¹⁷⁹ Buying and selling a child’s online behavioral data is a short slip away from outright child exploitation.¹⁸⁰ The moral disparity between offline child exploitation and online child exploitation should be rectified.

¹⁷⁴ Id.

¹⁷⁵ See id. at 1737 (“Though the issue is not before the Court, it can be assumed that the First Amendment permits a State to enact specific, narrowly tailored laws that prohibit a sex offender from engaging in conduct that often presages a sexual crime, like contacting a minor or using a website to gather information about a minor.”)

¹⁷⁶See id. at 1739 (Alito, J., concurring).

¹⁷⁷ Id. at 1740 (Alito, J., concurring).

¹⁷⁸ See Shoshana Zuboff, Surveillance Capitalism and the Challenge of Collective Action, 28 NEW LAB.F. 10, 16 (2019).

¹⁷⁹ See 18 U.S.C. § 2258A(a) (2018).

¹⁸⁰ Cf. 15 U.S.C. § 6502 (2018) (requiring website operators to provide notice and obtain parental consent before collecting personal information from a child).

D. Current Exemplar

[48] The California Consumer Privacy Act (CCPA) is a current exemplar for how governments should respond to the ascension of surveillance capitalism.¹⁸¹ California recently passed the CCPA to curtail rampant privacy violations online.¹⁸² The CCPA creates a statutory right for consumers to request any personal information that a business collects, and requires the business to disclose that information to the consumer.¹⁸³ Furthermore, the CCPA allows the consumer to opt-out of having such personal information sold to third-parties.¹⁸⁴

[49] Several key rights are established and protected by CCPA: (1) the right to know what personal information is obtained by companies, (2) the right to delete information companies obtain, (3) the ability to opt out from the sale of their personal information, and (4) the promise that consumers will not be discriminated against for following through with any of these options.¹⁸⁵ Finally, “express authorization” is required for a minor consumer’s personal information to be sold.¹⁸⁶ Given the novelty of this legislation, case law has not clarified what “express authorization” requires.¹⁸⁷

¹⁸¹ The EU General Data Protection Regulation (GDPR) is also another exemplar for regulating personal data and online privacy rights. See Jacob M. Victor, Comment, The EU General Data Protection Regulation: Toward A Property Regime For Protecting Data Privacy, 123 YALE L. J. 513, 513–14 (2013) (discussing the GDPR’s background and proposed regulations); What is GDPR, the EU’s New Data Protection Law?, GDPR.EU, https://gdpr.eu/what-is-gdpr/ [https://perma.cc/3UEF-FRW3].

¹⁸² See CAL. CIV. CODE § 1798.100 (West 2020); Practical Law Data Privacy Advisor, Understanding the California Consumer Privacy Act (CCPA), WESTLAW (2020); see also John Stephens, California Consumer Privacy Act, ABA (Feb. 14, 2019), https://www.americanbar.org/groups/business_law/publications/committee_newsletters/bcl/2019/201902/fa_9/#:~:text=The%20California%20Consumer%20Privacy%20Act%20of%202018%20was%20approved%20by,effect%20on%20January%201%2C%202020.&text=This%20prompted%20the%20California%20legislature,control%20of%20their%20 personal%20information [https://perma.cc/A3W4-2KNQ] (discussing background and history of the CCPA); Dominique-Chantale Alepin, Social Media, Right To Privacy And The California Consumer Privacy Act, 29 J. ANTI., UCL & PRIV.SEC. CAL. ASSOC. 96, 96 (2019);Your Data Is Shared and. Sold…What’s Being Done About It?, UNIV. OF PA. (Oct. 28, 2019), https://knowledge.wharton.upenn.edu/article/data-shared-sold-whatsdone/ [https://perma.cc/5AFP-BR98].

¹⁸³ See CAL CIV. CODE § 1798.110 (Deering 2020).

¹⁸⁴ See CAL CIV. CODE § 1798.120 (Deering 2020).

¹⁸⁵ Lauren Davis, The Impact of the California Consumer Privacy Act on Financial Institutions Across the Nation, 24 N.C. BANKING INST. 499, 505–07 (2020) (discussing the right to know, right to be forgotten, right to opt out, and the right to equal service and pride);* see, e.g.,* John W. Dowdell, Comment, An American Right to be Forgotten, 52 TULSA L. REV. 311, 321 (2017) (“The right to be forgotten – the most controversial proposal by any measure – was described by the European Commission as ‘the right of individuals to have their data no longer processed and deleted when they are no longer needed for legitimate purposes.’”).

¹⁸⁶ See CAL CIV. CODE § 1798.120 (Deering 2020); CAL CIV. CODE § 1798.135 (Deering 2020).

¹⁸⁷Cf. Express, BLACK’S LAW DICTIONARY (11th ed. 2019) (defining express as “[c]learly and unmistakably communicated; stated with directness and clarity.”); Authorization, BLACK’S LAW DICTIONARY (11th ed. 2019) (defining authorization as the “[o]fficial permission to do something” or “[t]he official document granting such permission.”); FACEBOOK, https://www.facebook.com/help/contact/784491318687824 [https://perma.cc/9HHR-ZPSR] (displaying a form that Facebook and Instagram have that allows California residents to exercise their rights under the CCPA).