[{"_1":2,"_100":-5,"_101":-5},"loaderData",{"_3":4,"_26":27},"root",{"_5":6,"_17":10,"_18":19,"_20":21,"_22":10,"_23":-5,"_24":-5,"_25":10},"user",{"_7":8,"_9":10,"_11":10,"_12":-5,"_13":-5,"_14":15,"_16":-5},"roles",[],"isAuthenticated",false,"isPremium","planName","subscriptionStatus","featureFlags",{},"insightsBudget","isDevelopmentHost","userPreferences",{},"recaptchaSiteKey","6LcvOJcUAAAAAHsB-gPGfGktcRlKpH7OTIU_dMTD","isImpersonating","impersonation","affiliateStatus","isFreedomPortal","routes/v2/article/layout",{"_28":29,"_30":31},"notFound",true,"relatedArticles",[32,76,88],{"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},"mediaId",6371205,"mediaKeyId","2150190-8b93f4d9fdae6f22d223a154db38426d","parentId",2150190,"title","Small‑business and startup representatives warn CPPA rules could hinder growth and drive firms from California","audioSeconds",2879,"startMs",471000,"endMs",3350000,"viewUrl","/Search/View?dp=1&key=2150190-8b93f4d9fdae6f22d223a154db38426d&start=471&end=3350","thumbnailUrl","https://assets.pipeline.soar.com/2150190-8b93f4d9fdae6f22d223a154db38426d/thumbnail_471000.jpg","articleUrl","/articles/6371205/California/Smallbusiness-and-startup-representatives-warn-CPPA-rules-could-hinder-growth-and-drive-firms-from-California","mediaUrl","https://secure.pipeline.soar.com/6371205-6774d79c43df4e87dce0ef6835f719d5/orig.mp4?Expires=1770814927&Signature=XejpK6Xd4642b0OqucYILdSA3YFVDg1GA-NmRb9XzH4EX-a6zmnzolcmUSvkUV9H6Ce2uyLekkpEzSQVBbJqUw-XPX7i0BZO2d0yuDt8xi0eGAGinTVfGyQZSTnLH9cD2Ec6QqxhWLgJwj6Oc0OzVD7p6LelGSV3QSsSYXAqqdhmNHXPcdErdtQudtzkpXmEiyeayZoccISfP0IQsyGm0a87GUnn3I-PDK-sW7gasIGeDYiMNkTAWOhYBiRrAepd~GIgg~SACQyzP47ekatl-iaA5NedNcmsjKU4QOkQl9DJByPluxQbhwijkU4uMaynh53zvi4FcCjlNmIPygVZMw__&Key-Pair-Id=KUT5TJCACFTXG","author","California Privacy Protection Agency","date","2025-01-25T00:33:29Z","article","Small‑business groups, chambers of commerce and startup founders used the CPPA's Jan. 14 public comment hearing to warn that the proposed privacy regulations would impose heavy compliance costs, make digital customer acquisition harder and, in some cases, push businesses out of California.

Multiple speakers referenced the agency's economic analysis repeatedly during testimony. Julian Kennedy, president of the California Hispanic Chambers of Commerce, cited figures presented in the rule‑making materials: \"3,500,000,000 in direct implementation costs to businesses resulting in a much larger adverse impact... ongoing cost of 1,000,000,000 annually for the next 10 years, potential of 98,000 initial job losses in California,\" he said. Other representatives from the Black Business Association, Strippers United, the African American Chamber of Commerce, and minority‑focused chambers echoed concerns that minority‑owned small businesses rely on targeted, first‑party advertising and could be disproportionately harmed if the CPPA restricts those practices.

Startups and small vendors also described concrete competitive harms. Patrick Coutts, cofounder and CEO of Abstract, said the agency's impact statement estimated \"it will cost a typical business over $20,000 a year for a decade\" to comply with website and related requirements — a figure Coutts called prohibitive for early‑stage companies relying on targeted outreach. Anthony Lycon, chief strategy officer at Epic Reach, and others said sharp fee increases and extra disclosure requirements would make small vendors less competitive compared with larger firms that can absorb compliance costs.

Speakers representing industry coalitions — including the Silicon Valley Leadership Group, BizFed Institute, and trade associations — urged the CPPA to narrow definitions, coordinate with the legislature, and consider staged or scaled compliance to protect startups and small businesses. Several witnesses asked for more stakeholder engagement focused on small‑business impacts before advancing final rules.

The agency recorded the oral comments for the rule‑making record; written comments are due Feb. 19, 2024, and the CPPA will hold a second public hearing that day.","mediaType","Video","parentTitle","January 14, 2025 - Public Comment Hearing on Proposed Regulations","oneSentenceSummary","Small‑business advocates, chambers of commerce and startups told the CPPA that the draft regulations' compliance costs, website and advertising changes, and broad ADMT definitions could burden firms and reduce competitiveness, citing agency impact estimates and individual startup costs.","taxTitle","California Privacy Protection Agency, Other State Agencies, Executive, California","taxId",76728,"location","California","headline","","shortSummary",{"_33":77,"_35":36,"_37":38,"_39":78,"_41":79,"_43":80,"_45":81,"_47":82,"_49":83,"_51":84,"_53":85,"_55":56,"_57":58,"_59":86,"_61":62,"_63":64,"_65":87,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},6371210,"Industry groups seek narrower cybersecurity‑audit rules and clearer assessments from CPPA",3680,3265000,6945000,"/Search/View?dp=1&key=2150190-8b93f4d9fdae6f22d223a154db38426d&start=3265&end=6945","https://assets.pipeline.soar.com/2150190-8b93f4d9fdae6f22d223a154db38426d/thumbnail_3265000.jpg","/articles/6371210/California/Industry-groups-seek-narrower-cybersecurityaudit-rules-and-clearer-assessments-from-CPPA","https://secure.pipeline.soar.com/6371210-2f7a0cc0796acbd1bd53de4baa34a72f/orig.mp4?Expires=1770814927&Signature=Qygxcpm~pHYCjSxAxq~zR6x6DLPR4xW5I-2KGPRd~0FErQPqmOCsI70wBZ14YGUnSGQa8GNOJUs2fsLRUIAc-sau0XlLUs5lCvKzDR82LjZgu0ZEL~d8hPc7MPJP2zGh65PQNc5NONKcKEXi~rcfp1Bis3zHX26GhvQ601TQZYHmCz2ruDl1JF7s2AESWqqnOOoedOQ0KRt1ZnUM4JIvrFBGDMLLXKCyRTBjtT0ra2EXxIuYCrSeEVthMAn5LjHSeCyFFO2VZ6X37KEh94YrAJdokgOcrqznUJtKlmU-ep57Sw61deQ6Omfe9LwMeJZVQ3qvYVyMIWyOSA-DrNOYxw__&Key-Pair-Id=KUT5TJCACFTXG","During the Jan. 14 California Privacy Protection Agency public comment session, cybersecurity and industry witnesses raised technical and procedural objections to the CPPA's proposed cybersecurity‑audit and risk‑assessment regulations, asking the agency to align the rules with existing frameworks and to clarify several drafting ambiguities.

Olga Medina, representing the Business Software Alliance, told the agency that existing certifications and audits such as ISO 27001 and SOC 2 should be recognized as meeting the CPPA's audit requirement and that risk‑assessment materials submitted to the agency should be treated as confidential. \"Companies already perform a host of audits to manage cyber risks,\" Medina said, and she recommended allowing those audits to satisfy the proposed requirements.

Several industry witnesses objected to board‑level attestation requirements. Ben Galenbeck of the California Chamber of Commerce said placing responsibility for detailed audit findings on boards \"misses the mark,\" arguing boards are not risk‑management experts and that requiring director attestations departs from other frameworks. Other speakers including business groups and cybersecurity consultants asked the CPPA to limit the scope of annual audits so they focus on high‑risk systems rather than enterprise‑wide processing solely because of company size.

Cybersecurity consultant Rocio Bridal (Rocio) and another practitioner at the hearing urged a clearer distinction between compliance audits and program effectiveness assessments. Rocio recommended restructuring the rule so that an audit documents compliance against stated requirements while a separate assessment measures program effectiveness and identifies mitigation plans. She also suggested a sequenced process in which audits are followed by documented remediation plans and board reporting of completed evaluations, rather than folding remedial planning into the audit itself.

Speakers asked the CPPA to avoid duplicative reporting and to ensure that required submissions do not create new privacy or privilege risks. Several witnesses urged the agency to clarify terms, limit proactive submission requirements, and coordinate with other federal and state frameworks to reduce unnecessary burden and preserve security resources.","At the CPPA public hearing, industry and cybersecurity professionals urged the agency to harmonize proposed cybersecurity‑audit and risk‑assessment requirements with existing standards, limit board reporting, and clarify the distinction between audits and assessments.",{"_33":89,"_35":36,"_37":38,"_39":90,"_41":91,"_43":92,"_45":93,"_47":94,"_49":95,"_51":96,"_53":97,"_55":56,"_57":58,"_59":98,"_61":62,"_63":64,"_65":99,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},6371215,"Calif. privacy hearing features split over automated decision-making rules and behavioral-advertising opt-out",6914,327000,7241000,"/Search/View?dp=1&key=2150190-8b93f4d9fdae6f22d223a154db38426d&start=327&end=7241","https://assets.pipeline.soar.com/2150190-8b93f4d9fdae6f22d223a154db38426d/thumbnail_327000.jpg","/articles/6371215/California/Calif-privacy-hearing-features-split-over-automated-decision-making-rules-and-behavioral-advertising-opt-out","https://secure.pipeline.soar.com/6371215-3cd971acb9f606eb2fb0fca08c69fff4/orig.mp4?Expires=1770814927&Signature=j2Z55ZPwSeMwZYJIbFnrFq7SV3kXlt62l1J0aQ6NmkpTgSdmfYs5hjRIfpnP0GcpLmKw9bO3~QiTGWF2iPcrD~5lY3F2u-AngIKPSQ4XSUwmj8zO~KZ~9lvF9KyhRK0nQxKLgEwjZmk8UDNnLM8CagGpu937pDnt~laRqOi2lPMqZDdv3ix9asFlyT7MjV357OrQRE3c9X-Yy7AdRLIbg1ofi4Y7A9RbokEIYoamztLMA~acjWtF6afDzsHzVBQXwu8avDX-TcDIxQRtIy~DuZixaowbTrkpM7tl~szNql4TtsYHcX24~Q-No1UCQ02GooASJLi7NQ51uDpE98ZxlQ__&Key-Pair-Id=KUT5TJCACFTXG","The California Privacy Protection Agency (CPPA) held a public comment hearing on Jan. 14, 2024, in Sacramento on proposed regulations covering automated decision‑making technology (ADMT) and behavioral advertising, drawing sharply divided testimony from civil‑rights and labor advocates on one side and business and advertising groups on the other.

Supporters of strong ADMT rules said the regulations are needed to protect people — especially workers, renters and marginalized communities — from opaque algorithmic systems. Jake Snow, senior staff attorney at the American Civil Liberties Union of Northern California, told the agency, \"Technology can make life better for Californians, but only if it is built carefully and used thoughtfully to empower people and address systemic challenges.\" Annette Bernhardt of the UC Berkeley Labor Center urged expanded notice, access and opt‑out rights for workers and stronger risk‑assessment requirements before systems are deployed.

Business groups and advertising trade associations countered that the draft rules were overly broad and would harm innovation and small businesses. Alex Torres of Brownstein Hyatt Farber Schreck, speaking for the Bay Area Council, said, \"The Bay Area is the birthplace of innovation,\" and warned the rules' expansive scope \"will have a dampening impact on innovation\" by increasing compliance costs and discouraging testing of algorithms in California. Several speakers cited the agency's standardized economic analysis—repeated in testimony as a $3,500,000,000 implementation cost and roughly $1,000,000,000 in annual recurring costs—and warned of job losses and business exits if the rules remain as drafted.

Opponents also argued the proposed behavioral‑advertising provisions would improperly regulate first‑party advertising and exceed the CPPA's statutory authority. Lou Mastria of the Digital Advertising Alliance said the regulations \"exceed the scope\" of the law and would create an expensive compliance apparatus that could pick winners and losers in the marketplace. Multiple organizations asked the agency to narrow definitions of ADMT and \"significant decision,\" limit opt‑out rules to high‑risk, consumer‑impacting decisions, and defer or align contentious provisions with forthcoming legislative action.

The hearing also featured calls from civil‑rights and labor advocates to preserve and strengthen opt‑out rights and to make sure ADMT rules address workplace harms. Swati Chintala of Tech Equity described opaque systems as having \"profound equity implications\" for workers and renters, and urged the CPPA to ensure meaningful opt‑out and notice rights.

The CPPA staff and board did not debate the substance during the hearing; the session recorded oral comments that will be considered with written comments and responded to in the agency's final statement of reasons. The public comment period remains open through Feb. 19, 2024, and the agency will hold a second hearing on Feb. 19 from 2 to 6 p.m. in the same Sacramento location and via Zoom.","At a Jan. 14 public comment session, privacy advocates pressed the California Privacy Protection Agency to keep strong opt-out and worker protections for automated decision-making technologies, while industry and business groups warned the proposed rules would impose large costs and exceed the agency's authority.","actionData","errors"]

Article not found

Small‑business and startup representatives warn CPPA rules could hinder growth and drive firms from California

Industry groups seek narrower cybersecurity‑audit rules and clearer assessments from CPPA

Calif. privacy hearing features split over automated decision-making rules and behavioral-advertising opt-out