California, a primarily blue state and home of Silicon Valley, is unsurprisingly the first U.S. state to get a data privacy law on the books.

The California Consumer Protection Act (CCPA) made its way to the governor's desk by the hands of a millionaire real estate developer Alastair Mactaggart. Since then, in the name of consumer protection, the legislation has set a privacy standard for the rest of the country.

California seized an opportunity. With the tech industry contributing nearly $482 billion to its overall economy — greater than any other state — and GDPR taking hold, the time to be at the forefront of data privacy regulation is now.

While it's too early to tell if the CCPA's language will be replicated for other states' data privacy laws, California has "the greatest opportunity and buy-in from organizations that are going to be deeply impacted so it makes sense for them to lead," said Mitchell Noordyke, Westin fellow for the International Association of Privacy Professionals (IAPP), in an interview with CIO Dive.

The making of a ballot initiative starring Alastair Mactaggart

Mactaggart's role in the process began when attended a dinner party with a Google software engineer a couple years ago. He pressed his friend about privacy and his friend's answers disturbed him. His friend said "if people just understood how much we knew about them, they'd be really worried," according to an open letter from Mactaggart.

Shortly thereafter Mactaggart pushed for a ballot initiative on privacy. The real estate developer spent $3.5 million to put the initiative on California's ballot. The initiative, simply put, freaked a lot of people out, said California Senator Robert Hertzberg, D, in an interview with CIO Dive.

Facebook, Google, Comcast, AT&T and Verizon gave $200,000 each in opposition to Mactaggart's initiative, the equivalent of nickels and dimes for multibillion dollar companies.

The low opposition funds were likely a ploy for companies to "slow walk" the initiative and hold out for federal legislation while also operating primarily in the background, said Noordyke.

There were, however, rumors big tech was planning a $100 million plus opposition campaign, with Google contributing up to $40 million, according to Mactaggart.

If big tech had put in tens of millions of dollars, they would have had a "chilling effect on this," said Hertzberg.

But by May 2018, GDPR was just about to go into effect and big tech secured billions of dollars worth of lawyers and legal support, it had done homework, and was prepared for what the U.S. was going to do next, said Hertzberg. 

Facebook contributed its opposition money in February 2018, but by April the company did an about-face in support of the bill after the Cambridge Analytica scandal broke — a scandal that would inadvertently help the ballot initiative make its way to becoming a law. Data privacy became an unavoidable crisis for lawmakers.

The rest is history

Mactaggart spent two years researching the right language centered on transparency, control and accountability for his ballot initiative after his dinner party. It garnered 629,000 signatures by May 2018, double the requirement to get on the ballot. 

Industry and lawmakers were taking notice of Mactaggart's progress. Around mid-May 2018, Mactaggart was contacted by Hertzberg and Assemblyman Ed Chau for a compromise.

The purpose of the initial negotiations were to get it off the ballot because, as written, it would have trouble passing, said Hertzberg. There was always the possibility it could have passed, but it would have been one of the most expensive ballot battles in California history.

Companies want privacy laws that will still enable innovation but they feared the initiative, as written, imposed "sweeping novel obligations" across businesses of all sizes.

The ballot initiative also "would have been nearly impossible to change because it carried an extremely high threshold of votes required to amend it after it became law," Hertzberg told CIO Dive in an email.

"In the real world, legislation goes through this horrendous process of committee after committee after committee, and everyone uses their political power to kill stuff," said Hertzberg. But "this was not really legislation, this was a situation where basically it was door number one or door number two, it was take it or leave it."

Mactaggart agreed to withdraw the initiative if a law replicating its concerns was passed. The trio got to work on drafting a legislation that would appease Mactaggart and have a chance Governor Jerry Brown would sign and pass it before the June 28, 2018 deadline.

The "door number two" option allowed for a less "painful" version of Mactaggart's initial initiative, said Herztberg. No company wanted to meaningfully fight the initiative because of fear it would hurt their brand by going against consumer privacy.

The new construction of the initiative-turned-bill meant Hertzerg and Chau had to rush it through legislation. The process didn't allow for much negotiation.

The CCPA's enactment date, Jan. 1, 2020, is a saving grace for many California state lawmakers to make changes they weren't able to before the bill reached the governor's desk. Lawmakers were given about a year and a half, from June 2018 to January 2020, to hold hearings and amend the legislation accordingly.

It "wasn't a negotiation between all these companies where they could just stonewall and put their arms up and say 'we're too powerful,'" said Hertzberg.

The negotiations have lead to some amendments with support from the private sector. Organizations including the ACLU, Common Sense Kids Action and Consumer Reports are backing an amendment called the Privacy for All Act of 2019, which expands on the CCPA's right-to-know policy and "returns privacy power to the people," according to the Electronic Frontier Foundation.  Tech companies also back the amendment, including DuckDuckGo and ProtonMail. 

The home of Silicon Valley had an obligation to pursue data privacy legislation because "we're driving so much of it," said Hertzberg. Since "we've passed this legislation, we're in the window of opportunity to actually work on it."