**Jonathan:** Welcome to San Francisco, firstly.
**Alysa:** Yeah. It is great to be here.
**Jonathan:** We promised your fans that we would give an update on the CPPA board meeting on Friday.
**Alysa:** Alright. These are diehard privacy fans. I will say it was a fascinating meeting. There was a lot that came out of that. So we can unpack it in a variety of different ways. I the data broker thing is still at the top of my list because that's soon and that's gonna be materially impactful to a lot of businesses. But then I do think we need to talk about the automated decision making.
**Jonathan:** So what we heard was two groups of kind of thought on mostly the algorithmic decision making. It was chambers of commerce saying this is too expensive, and you haven't you're rushing into it a little. And then you had consumer advocacy groups and and other groups saying this is great. Keep rolling forward with it. And then the board responding with, hey. We we can't slow down. We're under a legal mandate. Right? We've been sued when we slow down. Let's start with the with the algorithmic decision making. What what were kind of the key points?
**Alysa:** So I I think the comments that they have received thus far and all of the speakers, there there were a variety of of perspectives there. I think from the business community, you heard this is really broad. This could affect how I am able to advertise to my own customers. I think we heard from some groups that it is a time of rapid change. So you put forward these rules, small businesses are going to have to respond to those rules and put in a lot of resources to that. And then the legislature may come and and enact a new law, and then we're gonna have to change for that. And then you're gonna amend the rule. We're gonna have to change again. They had a few different critiques on that. I think what I heard most was the dialogue between the board members and that they were not all aligned. And and that's what I they were not all aligned in the prior board meetings where they've talked about automated decision making. And so I think you could read the headlines that the board approved to start the rule making and think this is a done deal. And I think that is not the takeaway. The takeaway was in order we hear you on some of the concerns around the breadth, around the details, around behavioral advertising, for example, being included, what high risk things, should that be the standard? So I think what we heard was, yes, we heard you. Refile your comments once we start the formal rulemaking because we can't really make the changes until we kick off the formal rulemaking because otherwise, we'd have to do a new economic analysis. We'd have to do all these other things that would push out the time even more. We are getting litigation around we didn't give enough time to to really respond to the rule. So I think now it's real. Now the rulemaking is going to kick off and all of those comments and the feedback and the concerns need to get submitted this time around. And what we're watching is, well, what's the next version?
**Jonathan:** Gotcha. So what are the key dates that we should be looking for?
**Alysa:** We we don't know yet. So but essentially, think of q one and second quarter being really impactful quarters for how does the language change, what is the interaction, between either first quarter or second quarter. I think we're gonna see some we'll have an answer.
**Jonathan:** Gotcha. And then on on data brokers, and this is kind of the one you flagged last week. So the Delete Act is ready to rock, right, locked and loaded for January twenty twenty six. And we had talked about, potentially, this definition of data broker being expanded to, like, all businesses, anybody who touches third party data.
**Alysa:** I I saw it buried in the in the comments deliverable where where the board was responding to some of the comments they had previously. And in one of the one of the comments, the question was well, the answer was if if you append third party data, you're not a data broker. And if you do it in kind of this ordinary course of business, then then you're not. But then it goes on to say, but if you then sell that data, you are a data broker. And so what do they mean by sell? Is it is it, like, plain English data broker, I'm selling data? Or is it actually no. It's it means sell or share. We've just spent the last three years arguing about the broad definition of sale. And I think many have and particularly those who where we've dealt with investigations that share so interest based advertising, cross contextual behavioral advertising is a subset of sale. Sale could be analytics. And so I think the very practical issue with the new broader definition, which we'll talk about the effective date, but that means if you're, let's say, a retailer and you are licensing data to to append to better understand your customers, if you are using any of that licensed data to inform and use the segment that you're going to let's just say you want to retarget on a social media platform and some of the data attributes you're using, you didn't get directly from the consumer, that would be a data broker. And so I think the the real question is all companies now need to look at their mostly their digital advertising practices to think about what data are they making available in order to power that digital advertising, and does that put them in the bucket of being a data broker.
**Jonathan:** Gotcha. And you gotta you gotta believe that the board understands this at some level. So they could have responded to that comment and said, it's just when you act like a data broker and you're selling data. We don't mean cross contextual. They could have said that and they didn't. So this is why we're taking this kind of broad view of it.
**Alysa:** They could have said that, but there was a lot of responses. For example, in the board meeting itself, there was a response to the critique that they didn't have the authority, and they said, yes. We do. It's not what a direct relationship is is not defined. We think consumers' expectations is you're getting this information from other sources and not directly from them within the last three years. So they even had a a temporal element to it, and you were selling it, but you're still you have the sale definition. They didn't change the the statutory definition or all the other guidance that they have put around the definition of sale.
**Jonathan:** Gotcha. Just to close up on the data broker, because I think folks will wanna know, well, what's the timing on that?
**Alysa:** It has to get a pack just procedurally, it has to go to the office of administrative law. And then depending on when that gets sent there, when it comes out, that's that determines the effective date. But I think we could be looking at that as April first as an effective date. So that's a really short period of time that you would then need to register. But then the delete act comes in January twenty sixth, and the sentence before that. Exactly. This is a near term thing, which is why I wanna flag because it requires some urgency in terms of how does this apply to your business and what do you need to do.
**Jonathan:** So by April, businesses will be potentially flagging that they're a data broker, everyday business.
**Alysa:** They they may need to file. Yes. Once it's a once you have an effective date there. So that that is a big deal. Talk with your lawyers.
**Jonathan:** But the Ashkan Soltani announced, and I don't think anybody, at least on the outside, was expecting this, that that he is stepping down. Why is that a big deal?
**Alysa:** You know, he was he was when you think of the CPPA, you think of the leadership there. And, obviously, he built up the CPPA, and it is a formidable agency and they have you can like or not like, but they have done a lot. They have done a lot from policy that we know that they're working on enforcement. So I think it's a big question. It's the end of this era and then who will be the next leader and that the process will start for that. And that'll be something really interesting to see who who takes up who takes that up and what the CPPA looks like going forward.
**Jonathan:** And what's Soltani will be doing? Do you think did he say?
**Alysa:** He did not say. So we'll yeah.
**Jonathan:** Well, I'll have to watch and see. Thanks for keeping us updated. Good to talk with you.
