1/6 Nice to see so many state #privacy initiatives and bills coming along. But there's a mix of promising and disappointing language. As a "power user" of #CCPA, I depend on several features of the law to make opt-outs practical.

2/6 ID verification standards. The CCPA makes opt-out and RtK/RtD work differently, which makes it more likely that opt outs will get through and reflect actual user preferences.

3/6 Authorized agents. 400 data brokers multiplied by 5 minutes for each one equals 33 hours. After the "privacy power users" like me have figured out the process, it needs to scale to regular people.

4/6 Dark patterns coverage. Unless you have general language on dark patterns, sketchy sites will keep adding steps that are technically legal but that limit people's ability to exercise their rights.

5/6 Finally, the definition of what is being opted out of. If an opt-out doesn't affect practices like "$FB Custom Audiences" then the law needs better wording. Otherwise it just messes with regular sites and not the Big Creepy firms that citizens keep asking for protection from.

6/6 More here. https://blog.zgp.org/state-features/ 

(General rule: if your law doesn't make surveillance marketers complain about "patchwork of regulations" and "unclear mandates" or try to lobby for Federal preemption, you must have left them a loophole.)