Company

Data Privacy for E-commerce

Solutions

<div><a href="https://invisit.io/en/terms-of-use">Terms of Use</a>&nbsp;&nbsp;|&nbsp;&nbsp;<a href="https://invisit.io/en/privacy-policy">Privacy Policy</a>&nbsp;&nbsp;|&nbsp;&nbsp;<a href="javascript: __cmpLoginhood('displayConsentPopup')">Do Not Sell My Data</a></div>

Blog

Loginhood is now Invisit! 📃

Data privacy compliance made easy

Consent Banner

Enable consumer privacy rights

Data Subject Requests

California data privacy laws, simplified

For CCPA

About Invisit

As more and more states begin to introduce data protection and privacy legislation, one question remains? When will the US pass a federal data privacy law?

With the appointment of Joe Biden as the 46th president, hopefully it will be a short amount of time until a federal data protection law is enacted by the United States, and it will deliver many benefits for customers and corporations alike. With the passing of the California Consumer Privacy Act (CCPA) in 2018, a clear pattern started to emerge with more and more states looking to create their own General Data Protection Regulation (GDPR) or CCPA. On Election Day 2020, California voters added additional traction when they approved the <a href="https://invisit.io/en/post/what-is-the-cpra">California Privacy Rights Act (CPRA)</a> proposal. This should come as no surprise as more and more citizens are becoming aware of how their data is used and what control over their data they can take. Not only are citizens becoming more aware but lawmakers, congressmen, and businesses are realizing the potential impact that data privacy and legislation can have on the shape of the country’s future. Sure, the CPRA is not as comprehensive as the GDPR, but it is a great start and solid framework for the federal government to work off of.
There is high expectation that Biden will dive into numerous technological and privacy issues facing the country today because his VP Kamala Harris was the California Attorney General when the CCPA was first introduced and enacted. According to<a href="https://www.forbes.com/sites/steveandriole/2021/02/03/a-warp-speed-technology-plan-for-president-biden-that-will-make-american-companies-cheer/?sh=7de399903e8b"> Forbes</a>, The US faces multiple issues regarding technological innovation along with cyber security, data protection, and privacy so it is important Kamala Harris helps sway Biden into making important decisions regarding consumers and the businesses that collect and sell personal information. What the U.S. government really needs is to stop letting the responsibility of consumer data protection, collection, privacy, and sale of it fall onto individual states. Yes, California has some really solid legislation put in place but it is not perfect, nor do other states have the capability to follow suit. California is home to Silicon Valley and many other pockets that have a majority of US tech workers or data experts who are privy to these sorts of issues. The creation of a Federal Data Privacy Bill or law will give other states a chance to come in from the cold and understand why protecting individuals’ privacy and information is monumental in today’s age.
The US needs to pass their equivalent of the General Data Privacy Regulation(GDPR). The federal government needs to control how far businesses will go with their use of the data of individuals without consent or compliance. Federal privacy laws would give customers a better picture of their rights around the nation and would help corporations understand their unique responsibilities to achieve compliance. Citizens need “digital freedom” and the only hope or chance of that right now is if there is a solid framework of legislation that will clarify for consumers and businesses what are ok data collection practices and what rights individuals hold over their own data.
The growing culture of surveillance, which involves the implementation of facial recognition technology and other technologies designed to monitor people, must be addressed by regulators as well. We live in a current culture and society where almost every single thing you do throughout your ordinary work day is tracked and monitored. Assuming you live online and therefore regularly supply your personal, professional, venue, and behavioral data, there is not much left that is covered by regulators. The data collection world was similar to the wild west in a way that there was no regulation over these businesses selling and collecting all sorts of valuable information. Yes, a good amount of Economic dependency specifically in the US is placed on this “surveilled data” and would jeopardize that industry. Except, there can be a happy medium between allowing all surveilled data to be sold to whoever at whatever cost without any acknowledgement of the consumer creating the data, and destroying all monetized surveillance data techniques and machines. A Federal Data Privacy Law will help clarify to states, individuals, businesses and more about the middle ground and how a happy medium can be reached.

The US Needs a Federal Data Privacy Law

This list provides a quick rundown of all states who have passed or proposed data privacy laws to help consumers and businesses alike. The real question is, would the US benefit from federal data privacy legislation like the EU?

<a href="https://www.natlawreview.com/article/will-virginia-be-second-state-to-enact-major-privacy-legislation">Virginia</a> is likely to become the country’s next state to enact consumer data privacy legislation after two bills were given the go ahead by their state congress. The Consumer Data Protection Act (CPDA) would give consumers the right to access their data, correct inaccuracies, and request their personal information be deleted. Other states have enacted legislation that deals with data privacy, but none other than the CCPA have been as significant as the potential of what Virginia could be putting in place. 
Meanwhile, as Virginia is looking to pass the second significant legislation regarding consumer data privacy and compliance, Governor Andrew Cuomo from New York proposed that New York also adopt a Consumer Data Privacy Bill of Rights. <a href="https://www.natlawreview.com/article/governor-cuomo-announces-new-proposal-consumer-data-privacy-bill-rights">Cuomo said</a> the proposed data privacy bill will “provide New Yorkers with transparency and control over their personal data and provide new privacy protections.” The proposal also would establish a Consumer Data Privacy Bill of Rights that would guarantee “the right to access, control, and erase the data collected from them; the right to nondiscrimination from providers for exercising these rights; and the right to equal access to services.”
It is a sign of the times and super encouraging that more and more states are looking to pass legislation relating to consumer protection and data privacy. There are plenty of other states that have already passed legislation in some regard to consumer data privacy and here is a quick list: 
<img class="alignnone size-medium wp-image-742" src="https://invisit-landing-assets.s3.amazonaws.com/wp-content/uploads/2021/02/18161759/invisit-blog-map-q1-2021-privacy-300x201.jpg" alt="" width="300" height="201" srcset="https://invisit-landing-assets.s3.amazonaws.com/wp-content/uploads/2021/02/18161759/invisit-blog-map-q1-2021-privacy-300x201.jpg 300w, https://invisit-landing-assets.s3.amazonaws.com/wp-content/uploads/2021/02/18161759/invisit-blog-map-q1-2021-privacy-768x515.jpg 768w, https://invisit-landing-assets.s3.amazonaws.com/wp-content/uploads/2021/02/18161759/invisit-blog-map-q1-2021-privacy-1024x686.jpg 1024w, https://invisit-landing-assets.s3.amazonaws.com/wp-content/uploads/2021/02/18161759/invisit-blog-map-q1-2021-privacy.jpg 1430w" sizes="(max-width: 300px) 100vw, 300px" />
<ul>
<li style="font-weight: 400;" aria-level="1">Maine: Maine&#8217;s<a href="https://mainelegislature.org/legis/bills/getPDF.asp?paper=SP0275&amp;item=1&amp;snum=129"> Act to Protect the Privacy of Online Customer Information</a> will come into effect July 1, 2020. The<a href="https://mainelegislature.org/legis/bills/getPDF.asp?paper=SP0275&amp;item=1&amp;snum=129"> statute</a> applies only to broadband internet service providers (ISPs), defined as any “mass-market retail service by wire or radio that provides the capability to transmit data to and receive data from all or substantially all Internet endpoints.” Companies with war chests of consumer data such as Verizon or Comcast are the ones specifically targeted by this legislation. Companies such as Facebook and Google though are excluded because they do not actually provide internet service. You can use the internet without browsing Facebook or searching something on Google, but there is no access to the internet if you don’t have a provider like Verizon. The CCPA differs from Maine&#8217;s law because it requires consumers to request that their provider not sell their data.</li>
<li style="font-weight: 400;" aria-level="1">Nebraska: On January 8, 2020 Nebraska state Senator Carol Blood introduced the Nebraska Consumer Data Privacy Act. A consumer would have the right to request a business that sells personal information or discloses it for a business purpose, disclose: (1) the categories of personal information that the business collected about that consumer; (2) the categories of personal information that the business sold about the consumer and the categories of third parties to whom the information was sold; and (3) the categories of personal information the business disclosed about the business for its business purpose. Essentially, a weaker CCPA.</li>
<li style="font-weight: 400;" aria-level="1">Iowa: Iowa does not have an actual data privacy law or legislation but does abide by the four common invasion of privacy laws. However, there is a requirement to notify personal data breaches of both electronic and paper records to affected consumers as well as to the AG when the information of more than 500 residents is breached.</li>
<li style="font-weight: 400;" aria-level="1">Wisconsin: Wisconsin introduced three privacy bills on February 10, 2020 that all stem from the EU’s General Data Protection Regulation. The Wisconsin Data Privacy Act, if enacted, would create CCPA and GDPR-like rights for Wisconsin residents. The law would also impose significant new obligations on businesses. While it does not provide for a private right of action, the law would be enforceable by the attorney general and violations could result in penalties of up to $20,000,000 or up to four percent (4%) of the entity’s total annual revenue, whichever is greater.</li>
<li style="font-weight: 400;" aria-level="1">Minnesota: Minnesota has their own data privacy legislation known as the MGDPA (Minnesota Government Data Practices Act). The act is similar to Nebraska’s where it is more to inform consumers about how their data is being used. Consumers must be notified without unreasonable delay. If notification by an organization for more than 500 persons at one time is required, consumer reporting agencies must be notified within 48 hours with specific information. Internet service providers must take reasonable steps to maintain the security and privacy of a consumer’s personally identifiable information. Vendors must notify Organizations upon discovery of a breach or suspected breach. The Organization is responsible for submitting any required regulatory reporting and consumer notifications. If your breach affects residents in other jurisdictions, those individuals must be notified based on the breach notification laws of the jurisdiction where they reside.</li>
<li style="font-weight: 400;" aria-level="1">Illinois: Illinois proposed the Data Transparency and Privacy Act in 2019 and was updated in 2020 by the Governor. Under the proposed law, businesses that process personal or unidentified information must, prior to processing, provide notice of certain information to consumers. The bill also grants consumers the right to obtain certain information from businesses regarding their personal information and the right to request to opt out of certain practices related to their personal information. The bill provides a private right of action to consumers, and allows the Illinois Attorney General to enforce the provisions of the bill through the Consumer Fraud Act. The Illinois Data Transparency and Privacy Act is very similar to the CCPA.</li>
<li style="font-weight: 400;" aria-level="1">Nevada: Nevada has already adopted Senate Bill 220, a new piece of data privacy legislation. It was among the very first in the country as it came into effect on 1 October 2019, three months before California implemented their CCPA. Many experts and data privacy skeptics believe Nevada’s laws to be much more burdensome and complicated than California’s. Of course in some aspects Nevada’s Senate Bill 220 may be more lenient compared to the CCPA, but the per violation fine amount is more than double California’s being $5,000 per fine in Nevada. Compliance in Nevada could save or cost companies dealing with data a lot of money.</li>
<li style="font-weight: 400;" aria-level="1">Vermont: Vermont was among the first states in America to pass any sort of privacy law. On January 1, 2019 they passed a law which allows them to regulate “data brokers”. A “data broker” in their words is, “a business or unit/s of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship.” So if this company has a direct relationship with the consumer, for example selling directly to people online like clothes or anything, they’re not bound to the restraints of “data brokers”. Vermont’s law is not the most encompassing, but if your company is considered a “data broker” the regulations and restraints are very tough.</li>
<li style="font-weight: 400;" aria-level="1">Colorado: Colorado was the very first State to pass a new law on digital privacy. HB 18-1128 allows organizations to establish regulations on the protection of Personally Identifiable Information (PII). Companies who store PII are held accountable for the destruction of physical and electronic materials that contain PII, and are responsible for investigating and notifying any sort of data breach.</li>
<li style="font-weight: 400;" aria-level="1">Arizona: Arizona recently passed a data breach notification law, so while it does not exactly protect privacy or give more rights to Arizonian citizens regarding their data, it does make businesses inform them when their data has been compromised. Arizona recently enacted a new data-breach notification law, which is designed to give notice to Arizona residents when their personal information has been involved in a business’s breach.</li>
<li style="font-weight: 400;" aria-level="1">New Mexico: A new privacy bill has been introduced into the New Mexico legislature by State Senator Michael Padilla (D) called the Consumer Information Privacy Act. The New Mexico Consumer Information Privacy Act is almost a carbon copy of the CCPA. It can be broken down into three sections:</li>
</ul>
<ol>
<li>Right of Access and Right to Delete – The core data subject access rights are provided by the proposed New Mexico privacy law. Businesses must provide the information gathered to consumers in a format of their choosing (mail or electronic) as part of the right of access. Businesses also must delete personal information upon request unless it meets one of the six specified exemptions.</li>
<li>Right to Opt Out of the Sale of Personal Information – The proposed law would provide a consumer the right to opt out of the sale of their personal information at any time. A third party that sold personal information may not resell it without providing the consumer with explicit notice and the opportunity to opt out of the sale.</li>
<li>Private Cause of Action – The bill permits victims of data breaches where the business did not implement and maintain reasonable security procedures and practices to bring a civil action seeking statutory damages of up to $750 per incident.</li>
</ol>
<ul>
<li style="font-weight: 400;" aria-level="1">Florida: Florida lawmakers have proposed legislation that would require certain operators of websites to make online disclosures and accept requests to opt-out of sales of personal data but that would stop far short of creating CCPA-like privacy rights for Florida residents. The legislation, which is yet to be named but will be referred to as the 2020 Florida Consumer Privacy Act, appears to be very similar to the Nevada Online Privacy Protection Act, which was amended last year to add a right to opt-out of sales of covered information. </li>
<li style="font-weight: 400;" aria-level="1">Mississippi: Legislators in Mississippi recently introduced SB 2548. the “Mississippi Consumer Data Privacy Act.” The bill contains provisions similar to the California Consumer Privacy Act but goes further than the CCPA with a lower annual gross revenue threshold, applying to any for-profit business, or any entity that controls or is controlled by such a business, that does business in Mississippi.</li>
</ul>
<ul>
<li style="font-weight: 400;" aria-level="1">South Carolina: On May 3, 2018, Governor Henry McMaster signed into law the South Carolina Insurance Data Security Act. The Act defines the requirements applicable to a &#8220;licensee&#8221; and establishes standards for data security and standards for the investigation of and notification to the Director of a cybersecurity event. So again, not much legislation regarding consumer privacy or protection, but it does make businesses responsible for any data compromised and holds them accountable.</li>
<li style="font-weight: 400;" aria-level="1">Pennsylvania: Pennsylvania recently introduced new legislation but not for consumer privacy. Instead, it focuses on any sort of data breaches and holds companies responsible if they compromise any data. If any state residents are affected by a breach, the breached Organization must give notice without delay to each affected individual. When notification is made to more than 1,000 persons at one time, the breached Organization must report to all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis.</li>
<li style="font-weight: 400;" aria-level="1">New York: New York signed the SHIELD Act into law on July 25, 2019, but the bulk of its regulations came into effect on October 23, 2019. New York’s SHIELD Act varies from the other states because New York’s concern with this legislation is not about opt-out rights or even day to day online activity, but instead it focuses on dealing with data breaches. The SHIELD Act extends the scope of the subject information to include biometric information and the range of possible breach or hacking scenarios. The SHIELD Act  updates the protocols companies are required to follow in the case of a data breach.</li>
</ul>
New York is clearly looking to set themselves apart with California and Virginia by proposing the new data privacy bill of rights while having adequate legislation in place to make sure consumers and businesses know what is happening with their data. The problem unfortunately is the lack of clarity and unity amongst these states and how each state treats data protection and privacy differently.
A lot of states have looked to Europe and specifically the General Data Protection Regulation that all members of the EU must abide by. California took certain parts of their legislation when drafting up the CCPA and CPRA, but the U.S. itself needs to pass a federal law that all states can turn to when dealing with data privacy issues. Too many states are lost when it comes to dealing with data protection and compliance and the fact that each state has different regulations regarding data makes consumers and businesses the ones responsible for navigating through the chaos. 
If there were to be one unified set of regulations like the GDPR, it would give consumers and businesses a better understanding of how to treat data, the privacy and protection of it, the sale and collection of data, and compliance in the use of data. Until the U.S. has a federal framework for data privacy, unique state by state regulations will continue to be introduced creating a convoluted data privacy approach &#8211; a singular one will enable clarity and a much more efficient way for companies to be regulated and consumers to understand what to expect in terms of data protection and privacy.

Current State of Data Privacy Legislation in the US

Apple and Facebook have been trading jabs for years, but will this latest conflict be the last straw?

Facebook and Apple have never seen “eye to eye” on a majority of big tech issues and often are adversaries when it comes to legislation that can impact either of their monopolies. Facebook has recently been extra bitter towards Apple for the new <a href="https://invisit.io/en/post/facebook-concedes-to-ios14">iPhone iOS 14 updates</a> which is having a huge impact on Facebook’s digital advertising power. Facebook has taken this as an attack on all “personalized marketing” and advertising and is implying that Apple is only doing this to hurt Facebook’s ad tracking monopoly, given Facebook makes most of its money through “personalized” advertising.
Apple introduced a feature called <a href="https://invisit.io/en/post/facebook-concedes-to-ios14">App Tracking Transparency</a> (ATT) which briefly summarized means that Apple isn’t actually changing consumer tracking, but instead, users will now have to opt-in to tracking, whereas previously they would have to choose to opt-out. Facebook themselves declared “businesses that advertise mobile apps, as well as those that optimize, target, and report on web conversion events from any of our business tools will be affected.”
So how is Facebook responding?
According to <a href="https://www.theinformation.com/articles/facebook-looks-to-take-its-fight-with-apple-to-court">The Information</a>, Facebook is preparing an Antitrust lawsuit against Apple for unfair treatment of certain apps through their app store. More specifically, Facebook is alleging that Apple abused their power in the smartphone market specifically by enforcing regulations and rules for non-Apple developed apps in their app store that Apple produced apps do not have to follow. In an emailed statement to <a href="https://www.cnet.com/news/facebook-reportedly-considers-hitting-apple-with-antitrust-suit/">CNET</a>, a Facebook spokesperson stated “we have said repeatedly, we believe Apple is behaving anti-competitively by using their control of the App Store to benefit their bottom line at the expense of app developers and small businesses.&#8221;
How has Apple responded to this news?
Apple CEO Tim Cook on International Data Privacy Day <a href="https://www.cnet.com/news/apple-comes-out-swinging-against-facebook-over-data-privacy/">hit back</a> at Facebook highlighting some of Facebook’s controversies and shady company policies they have in place. Tim Cook very bluntly explained why the new Apple ATT and Identifier for Advertising (IDFA) is crucial for regulating the billion dollar industry of tracked advertising. “If a business is built on misleading users, on data exploitation, on choices that are no choices at all, then it does not deserve our praise. It deserves reform,&#8221; Cook said <a href="https://www.cnet.com/news/apple-comes-out-swinging-against-facebook-over-data-privacy/">at the virtual conference</a>.
Cook and Apple have positioned themselves over the past couple of years to be the leaders of consumer privacy and to be the “peoples’ champion” when it comes to data privacy. But, are all of these latest updates and policy changes just an attempt to discredit and remove Facebook’s main source of profit and present themselves to the public as the “peoples’ champion of privacy”? Or, is Apple actually concerned about consumer privacy? That is still up for debate as Apple doesn’t rely upon digital advertising for their main source of income but rather actual hardware and products. 
Facebook is saying Apple does not care about consumers nor consumer privacy, but they are attempting to create an even stronger monopoly in the app market world by creating extremely unfair regulations and conditions for non-Apple produced apps to follow by, thus making it much harder for smaller companies and developers to make a name for themselves and gain traction in their app store. So, in Facebook’s own words, they are fighting for smaller developers to help them get a more competitive chance in Apple’s app market. Whether that is the truth or they are just looking to hit back at Apple for destroying their incredibly powerful digital advertising practices remains to be seen. One thing for sure is that this feud is sure to have a couple more jabs thrown each way.

Facebook and Apple Continue to Feud

Amidst the content crackdown, consumers are looking for different messaging platforms and services.

Facebook owned WhatsApp recently <a href="https://news.google.com/articles/CAIiEJC5RuHVUAzOMel9IjuQV90qFwgEKg8IACoHCAoww5LyAzD2zh0wlqpV?hl=en-US&amp;gl=US&amp;ceid=US%3Aen">announced privacy changes</a> that have caused a wave of users to search for international messaging elsewhere. A lot of consumers have been concerned since a pop up message in the app in January stated that any accounts who hadn’t accepted the new privacy terms would be deleted by February 8, which we know from having the app ourselves. This caused a lot of confusion for WhatsApp users, the update was very vague, and a Facebook reference had users fearful that the contents of their messages would be shared with the social media giant. 
With its shoddy data protection policies, Facebook has had near-constant <a href="https://invisit.io/en/post/facebook-to-stop-eu-us-data-transfers">bad press</a>. WhatsApp was prompted by the negative response to give a clarification and postpone the changes until May. From their <a href="https://twitter.com/WhatsApp/status/1348839600333049857?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1348839600333049857%7Ctwgr%5E%7Ctwcon%5Es1_&amp;ref_url=https%3A%2F%2Fwww.dw.com%2Fen%2Fwhatsapp-controversy-highlights-growing-fears-about-data-privacy%2Fa-56266093">official twitter account</a>, WhatsApp again very vaguely states, “Our privacy policy update does not affect the privacy of your messages with friends or family. Learn more about how we protect your privacy as well as what we do NOT share with Facebook&#8230;”. While they have delayed rolling out the updates for three months, they still plan on moving forward with their new business model of allowing businesses and consumers to communicate through Facebook and WhatsApp. It is pretty much the whole purpose as to why Facebook <a href="https://www.investopedia.com/articles/investing/032515/whatsapp-best-facebook-purchase-ever.asp#:~:text=WhatsApp%20Acquisition&amp;text=The%20app%20was%20founded%20by,billion%20remaining%20in%20Facebook%20shares.">acquired WhatsApp back in 2014</a>. 
How do the new privacy policies change business?
The privacy policy changes are necessary to allow users to send messages to companies through WhatsApp, according to WhatsApp. The notifications mainly concern companies that host Facebook stores and connect via WhatsApp with users. The new rules specify that communications with these companies may be hosted on the servers of Facebook. As a consumer you should not be over eager to have another Facebook controlled app downloaded onto your phone.
Yes, WhatsApp’s whole mantra they preach is that they encrypt every message sent through their servers, but that doesn’t mean they are not collecting, selling, and sharing all of the other metadata that could be attached to the message sent. So for example, your unique user ID, information on use and ads, purchasing history and financial information, physical location, telephone number, contact information for you and your contact list, what items you have interacted with, how much you use the app, and how it functions when you do it.
There are lots of other messaging apps in the world that “protect your data” but are actually just specific terms and language to disguise the underlying purpose of these apps. Weibo and WeChat for example, which if you’ve never heard of are essentially the Chinese equivalents to a Facebook or WhatsApp. All three of these messaging services by default enable data collection and less privacy by using text/sms.chat messages to target and learn more about you. Do we really want Facebook to be able to do the same with WhatsApp?

Should You Delete WhatsApp?

A new social media platform is on the rise as more users are looking for alternatives to Facebook and Twitter.

MeWe is a new social media platform and app that has recently skyrocketed in popularity as an alternative to recent crackdowns of Facebook and Twitter. Last week, the app that calls itself the &#8220;anti-Facebook&#8221; gained 2.5 million new users, taking its total user base to 16 million — 50 percent of which live outside the U.S., according to <a href="https://www.foxbusiness.com/technology/anti-facebook-mewe-download-surge-big-tech-scrutiny">Fox Business</a> who were told by a MeWe spokesman David Westreich.
MeWe is positioning themselves in the social platform market as an alternative to Facebook and Twitter promising users more privacy than Facebook and co. who have been found using <a href="https://invisit.io/en/post/facebook-to-stop-eu-us-data-transfers">“capitalist surveillance” techniques</a>. In the interview with Fox Business, Westreich added that the platform &#8220;is the new mainstream social network with all the features people love and no ads, no targeting, no newsfeed manipulation, and no BS.&#8221; 
How Does MeWe Promise Privacy?
MeWe states explicitly on their <a href="https://mewe.com/about#">About Page</a>: “You own your content. You control your interactions. You design your level of privacy.” Their platform gives the users the ability to decide who gets to see what content they put out, placing the responsibility in the hands of the users. On the same<a href="https://mewe.com/about#"> page</a>, MeWe does pledge that they do not sell or share your personal information or data with marketers or advertisers. They even have their own <a href="https://mewe.com/about#bill">privacy bill of rights</a> that very explicitly lays out the foundation of their platform and what to expect. Some examples are:
<ul>
<li style="font-weight: 400;" aria-level="1">You own your personal information &amp; content. It is explicitly not ours.</li>
<li style="font-weight: 400;" aria-level="1">You never receive targeted third-party advertisements or targeted third-party content.</li>
<li style="font-weight: 400;" aria-level="1">You have the right to delete your account and take your content with you at any time.</li>
<li style="font-weight: 400;" aria-level="1">Permissions &amp; privacy are your rights. You control them.</li>
</ul>
It’s an encouraging sign seeing MeWe’s spike in users to show the rest of the big tech giants that people are starting to take data privacy seriously. Sure, some of the surge in users may be associated with the recent crackdowns on content and “Newsfeed” algorithms because of political unrest following the U.S. capitol riots, but regardless more and more users are becoming aware and concerned about their online privacy.
MeWe <a href="https://mewe.com/about#">describes themselves</a> as “fun, good people determined to revolutionize social media and build a new platform to go head-to-head with Facebook and restore decency, privacy, and respect for social media users.” We hope this sudden surge in users is not a one off and that people continue to take their personal online privacy more seriously.

MeWe The Social Platform Promising Privacy

 The advocate general of the European Court of Justice said Wednesday that privacy complaints do not necessarily have to be taken to the domestic regulator, meaning big tech could be hit with a wave of legal cases.

U.S. tech giants such as Google, Facebook, Apple, etc. are potentially about to be hit with a massive wave of lawsuits regarding data privacy in the EU specifically, after the advocate general of the European Court of Justice <a href="https://www.cnbc.com/2021/01/13/facebook-and-others-could-face-more-court-cases-in-the-eu.html">said Wednesday</a> that privacy complaints do not necessarily have to be taken to the domestic regulator. Meaning, that anybody not necessarily an EU watchdog or regulator has the right or ability to proceed with a legal case against any of these tech giants relating to data privacy, or lack thereof. Previously under the guidelines of the GDPR anybody that wanted to voice concern or file a complaint would do so under their countries Data Protection Commissioner, or the country’s commissioner in which the company that they are filing against is located.
For example, Max Schrems filed a <a href="https://invisit.io/en/post/facebook-to-stop-eu-us-data-transfers">lawsuit against Facebook</a> for allowing the U.S. government to collect and analyze EU citizens’ data. Schrems&#8217; lawsuit was brought to the Irish Data Protection Commissioner (DPC) because Facebook’s EU headquarters are located in Dublin. If they had been based out of Spain, then the Spanish DPC would have taken control.
Why is this such a big deal?
“Make no mistake the impact of this opinion if upheld by the court is far reaching as it would give equal right to any of the 27 data protection commissioners across Europe to take action for a breach of the rules,” Cillian Kieran, CEO of privacy company Ethyca, told <a href="https://www.cnbc.com/2021/01/13/facebook-and-others-could-face-more-court-cases-in-the-eu.html">CNBC</a> via email. Nothing is set in stone as other judges still need to weigh in and confirm that they agree with this stance, but as our previous example with Facebook and the Irish DPC, it would relieve some of the burden off of the Irish DPC and allow Facebook to get hit with multiple lawsuits from multiple angles.
Clearly the EU are showing big American Tech companies that they mean business when it comes to consumer data privacy, and that they must respect and abide by the GDPR regulations and any amendments. This move by the EU Court of Justice can be viewed in multiple ways:
<ol>
<li style="font-weight: 400;" aria-level="1">Countries who were previously less concerned about the enforcement of GDPR will likely take it more seriously given the amount of legislation and legal cases that will impact multiple industries.</li>
<li style="font-weight: 400;" aria-level="1">The countries who were already strongly enforcing the regulations of the GDPR will feel less isolated in their fight to attempt to regulate and protect consumer privacy because these businesses will now face a lot more attention and legislation from different countries and DPC’s.</li>
<li style="font-weight: 400;" aria-level="1">Companies such as Facebook who used to use the location of their headquarters as a way to prolong and avoid any sort of consequences for breaking the rules, do not have the excuse of oh you’re not in Ireland, you cannot file a data privacy lawsuit against us.</li>
</ol>
The EU Court of Justice is clearly taking steps to ensure that GDPR regulations are being followed more strictly and are applicable where they need to be. While the top judges ruling is not binding, it is incredibly unlikely any other judges disagree and it will only be a matter of time until we see lots of media attention surrounding these big U.S. tech companies and just how many legal cases are brought against them.

Big Tech Could Be Hit With Wave of Data Privacy Cases in EU

The Irish Data Protection Comissioner promised for "swift" action in shutting down Facebook's EU-US data transferring after the Privacy Shield was deemed not up to standards.

Back in 2013, Edward Snowden became the most famous modern whistleblower and revealed that a lot of the top US surveillance and protection agencies were way overstepping their boundaries collecting a lot more information and data than the public had realized, including from other countries. A data privacy advocate known as Max Schrems filed a complaint with the Irish Data Protection Commissioner(DPC) regarding the legality and morality of allowing US surveillance agencies to just rip any Facebook data with no consequence almost seven and a half years ago. Finally, according to <a href="https://techcrunch.com/2021/01/13/facebooks-eu-us-data-transfers-face-their-final-countdown/">TechCrunch</a> and the Irish DPC Facebook’s data transferring and data portability will come to a “swift” end. 
On multiple occasions Schrems has voiced his displeasure not only with Facebook, but with the Irish DPC and Irish courts. Facebook has been able to avoid pretty much any specific or damaging ruling that would put their data transferring at risk. Schrems main complaint as he voiced to <a href="https://techcrunch.com/2021/01/13/facebooks-eu-us-data-transfers-face-their-final-countdown/">TechCrunch</a> is that Ireland&#8217;s regulator chose to raise wider concerns about the legality of mechanisms for transferring data from the EU to the US like the <a href="https://bbbprograms.org/programs/all-programs/bbb-eu-privacy-shield/insights/2020/09/15/schrems-ii-what-do-privacy-shield-businesses-need-to-know">Privacy Shield</a>, rather than ordering Facebook to suspend data flows as Schrems had asked in the complaint.
And yet, it is his voicing and opinion that most likely influenced the top European Courts and Justices to rule in favor of abolishing the Privacy Shield. The EU-US privacy shield was struck down just this past September in a ruling because the US has no sort of federal or national data privacy law, and the few states who do have data privacy laws are not up to the standards as the GDPR. Following this court decision the Irish DPC sent a letter to Facebook ordering them to suspend data transfers. Unfortunately, here we are months later and Facebook is still transferring data to and from. The Irish DPC promises for swift action, but Schrems and others are hoping that they stick to their word of the blocking of data transferring over the next few months.
So what implications will this have?
For one, Facebook amongst many other social platforms and companies who guise themselves as things other than massive data collecting and selling corporations will have to figure out a way around this or pressure US lawmakers into matching EU privacy standards. Facebook had threatened to remove themselves entirely from the EU if they were unable to transfer data back and forth, but now have retracted that and are doing their best to delay any ruling regarding their EU-US data transferring until there is a new US policy in place. They are hoping with the new Presidential administration they can grease a couple pockets to get US legislation that will abdicate them of this privacy responsibility. 
There are a lot of ways that this can impact the future of data privacy and regulation. Yes it is wrong for Facebook to just transfer private and personal information back and forth from the EU and US especially considering a lot of that data is coming from the EU and being processed and analyzed by a country they are not citizens of. But, on the bright side it can finally help lead and pressure US legislators and Congress into seriously considering a federal or national data privacy law. There are multiple frameworks to use such as the GDPR, CCPA, CPRA, etc. that we at Invisit believe can seriously help the US finally create a unified encompassing privacy and compliance legislation.

Facebook May Finally Be Forced to stop EU-US Data Transfers

Apple’s iOS 14 launched in late 2020, but some really big changes are soon to be put in place that will change the current landscape of digital advertising on Facebook.

Apple’s iOS 14 launched in late 2020, but some really big changes are soon to be put in place that will change the current landscape of digital advertising and marketing. More specifically, the ongoing feud between Apple and Facebook seems like it has no intention of slowing down as Facebook finally <a href="https://www.facebook.com/business/help/331612538028890?id=428636648170202">conceded</a> to their users and marketers that they have no choice but to abide by Apple’s new AppTracking Transparency (ATT). Apple isn&#8217;t actually changing consumer tracking, but instead, users will now have to opt-in to tracking, whereas previously they would have to choose to opt-out. Facebook themselves<a href="https://www.facebook.com/business/help/331612538028890?id=428636648170202"> declared</a> “businesses that advertise mobile apps, as well as those that optimize, target, and report on web conversion events from any of our business tools will be affected.”
Why is Facebook adamantly against iOS 14?
Facebook, in an email sent to businesses obtained by <a href="https://www.imore.com/personalized-ads-and-user-privacy-can-coexist-facebook-tells-businesses">iMore</a>, have stated that the ATT features of iOS 14 will have “hard-hitting implications across targeting, optimization, and measuring campaign effectiveness.” The company also claims it believes that &#8220;personalized advertisements and user privacy can coexist,&#8221; which is also a point made by Apple. Clearly, however, the two businesses have different versions of what constitutes &#8220;user privacy.&#8221; 
Facebook in their <a href="https://www.imore.com/personalized-ads-and-user-privacy-can-coexist-facebook-tells-businesses">email</a> claim these new ATT updates “&#8230;will benefit them, while hurting the industry and the ability for businesses of all sizes to market themselves efficiently and grow through personalized advertising.” If a lot of Facebook users choose to opt-out immediately Facebook is saying there will be a major depletion of “ad effectiveness and limitations on measurements.”So even though Facebook are doing everything they can to publicly denounce the new changes to iOS and consumer tracking, there is nothing these ad platforms like Facebook and more can do.
Reported by <a href="https://9to5mac.com/2021/01/06/facebook-ios-14-privacy-feature-comply/">9to5Mac</a>, Facebook told businesses that while it disagrees with Apple’s solution, it has ‘no choice’ but to show the opt-in prompt and to continue using Apple’s device identifier (IDFA) for advertising. The company states that it believes Apple could block Facebook and its other apps from the App Store if it doesn’t comply, bringing ‘further harm to the businesses and users that rely on our services.’ Apple is essentially bullying Facebook into playing by their rules and regulations regarding consumers because if not Apple can simply remove them from the App Store which would have even bigger implications. 
As previously stated the rivalry between Facebook and Apple has been going on for years now and these two often butt heads. This is not the first time Facebook has sent out a sort of rallying cry to all of their subsidiaries and customers about the potential impact of the new iOS 14 App Tracking Transparency feature. Last month, <a href="https://9to5mac.com/2020/12/18/facebook-now-warning-users-about-impacts-on-ads-due-to-new-ios-14-privacy-features/">9to5Mac reported</a> that Facebook was warning users about the impacts on marketing efforts and that Facebook even took out a<a href="https://9to5mac.com/2020/12/16/facebook-attacks-apple/"> full-page ad</a> in US newspapers to slam Apple’s changes.
What to make of all of this:
In order to give users more transparency on their data, Apple is updating iPhones, but they still do not educate or inform the consumer why that data is essential, particularly for small businesses. The new AppTracking Transparency (ATT) from Apple will hopefully encourage users to opt-in to advertisers who have access to the data, as opposed to the current connotation attached to opting out. Facebook states that this is a power move by Apple forcing them amongst other companies to play by their rules if they want to track and advertise to iPhone users. Ad platforms such as Facebook, Snapchat, Google, and TikTok are now trying to figure out how to help their smaller advertisers get around this, mainly because these platforms are used by so many brands to help drive consumers to their companies. For now it seems like Facebook and all of these other super popular ad platforms are playing ball with Apple’s new ATT and IDFA features, until they figure out a way around it. 
Click <a href="https://www.facebook.com/business/help/331612538028890?id=428636648170202">here</a> to read Facebook’s published reaction to Apple’s new AppTracking Technology features.

Facebook Finally Gives in to iOS 14

The California Attorney General released new modifications for the CCPA.

California Attorney General Xavier Becerra <a href="https://www.jdsupra.com/legalnews/california-ag-releases-fourth-set-of-4978227/">released a new set of modifications to the CCPA</a>. This is the fourth set of amendments and edits to the legislation, with the primary focus of these modifications being about companies who sell and collect consumer data offline and the usage of some sort of a “Do Not Sell My Personal Information” button or symbol. 
What’s New Regarding Offline Data?
The most recent modifications to the CCPA regarding offline consumer data collection and sales were made to help clarify the third set of modifications before because the law stated businesses that “collected” offline data from customers to provide an offline method of opting out of said data collection. Now the most recent amendments are more direct and specific stating that all businesses who sell offline personal data must also provide an offline opt-out method. The differentiation in words used is a huge difference for companies who were able to previously collect and store offline consumer data that they would use to sell online. In the actual text of the <a href="https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-prop-mods-text-of-regs-4th.pdf">legislation on page 2</a>, the California AG provides two exceptions for when a company does not need to provide an opt out notice. A business does not need to provide a notice of right to opt-out if:
<ol>
<li style="font-weight: 400;"> It does not sell personal information</li>
<li style="font-weight: 400;">It states in its privacy policy that it does not sell personal information</li>
</ol>
According to <a href="https://www.jdsupra.com/legalnews/california-ag-releases-fourth-set-of-4978227/">JDSupra</a>, these businesses now have to provide an offline method to let consumers know of their right to opt-out of the sale of their personal information and give them instructions on how to submit an opt-out request. So any brick and mortar store that collects customer information offline must also provide some sort of opting out in generally the same method they are collecting the data in. 
The Do Not Sell My PI Button
The fourth set of CCPA regulation modifications also include a ”Do Not Sell My Personal Information” button that businesses could use on top of a notice of the right for consumers to opt-out of the sale of personal information. In February 2020, the opt-out button appeared in the proposed regulations of the California AG, but was deleted. According to the modifications the opt-out button must be added to the left of the &#8220;Do Not Sell My Personal Information&#8221; text and must be the same size as any other buttons on their website that the company uses.
The CCPA has had many modifications to regulations in such a short time span and companies should be constantly updating their data collection methods while ensuring privacy compliance. Companies need to stay up to date because California recently introduced the CPRA and there will only be more regulations and modifications as California continues to iron out the kinks, with more states looking to follow.
You can learn more about the specifics by viewing the California Attorney General’s inline comments <a href="https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-prop-mods-text-of-regs-4th.pdf">here</a>.

California AG Releases New CCPA Modifications

We're happy to announce today that as of today, we are rebranding Loginhood to Invisit, the first software for e-commerce companies to manage emerging privacy requirements in all of their channels, focused on protecting their performance.

We&#8217;re happy to announce today that as of today, we are rebranding Loginhood to Invisit, the first software for e-commerce companies to manage emerging privacy requirements in all of their channels, focused on protecting their performance.
Since 2018, our team has been building products to help businesses navigate the future of privacy and consumers take ownership of their data. This has included our Chrome Extension, a tool to help consumers protect their privacy and earn rewards for their data, and our consent management platform, a software helping businesses manage CCPA compliance.
Over the last several months, there has been a rise in perhaps the most urgent privacy changes to date: marketing platforms like Facebook and Google began implementing their own privacy restrictions to advertise on their platform. And if compliance was not met, performance would be penalized.
This meant for the first time privacy was no longer just a legal issue. It is now an issue affecting marketing performance and a business’s bottom line. And with the vast complexities surrounding what was actually required for privacy compliance, e-commerce companies are losing more sales every minute this isn&#8217;t handled. This was made clear with Facebook’s Limited Data Use, a recent privacy restriction that caused some e-commerce companies to lose &gt;75% of their sales overnight.
We predict that channel-specific privacy requirements will continue to roll out at a rapid pace, leading to even more confusion and potential sales-loss. Our team believes this is now the most urgent issue in the privacy-realm and one that we are well-equipped to solve.
For these reasons, today we are announcing our re-launch as Invisit, the first privacy management company to monitor and automate every channel-specific privacy requirement to ensure your business doesn’t lose a single sale from non-compliance.
We move forward with many similar goals and have added a few new ones along the way. Our goal in rebranding is to energize our updated, hyper-focused, mission: &#8220;We do privacy. You do business.&#8221;
Contact <a href="mailto:sales@invisit.io">sales@invisit.io</a> today to learn more about how we’re building a privacy-centric future of e-commerce.