{"id":42017,"date":"2023-04-24T09:46:33","date_gmt":"2023-04-24T08:46:33","guid":{"rendered":"https:\/\/www.elixirr.com\/?p=42017"},"modified":"2025-10-31T10:34:07","modified_gmt":"2025-10-31T10:34:07","slug":"the-clock-is-tiktok-ing-towards-wider-us-data-privacy-legislation-how-can-businesses-prepare-and-exploit-this","status":"publish","type":"post","link":"https:\/\/www.elixirr.com\/en-gb\/the-clock-is-tiktok-ing-towards-wider-us-data-privacy-legislation-how-can-businesses-prepare-and-exploit-this\/","title":{"rendered":"The clock is “TikTok-ing” towards wider US data privacy legislation: how can businesses prepare and exploit this?"},"content":{"rendered":"\n

As TikTok CEO Shou Chew sat in front of the 50 members of the House Committee for Energy and Commerce last month, he found himself on the same hotseat that his counterparts from Meta, Twitter and YouTube had inhabited in the years prior. During the over 4-hour grilling<\/a>, Chew faced questions ranging from national security implications, to the nature of the data sharing relationship between TikTok and its Chinese-parent company ByteDance, to the app\u2019s data collection of US citizens. By the end of the hearing, bipartisan support for the regulation of TikTok was evident. <\/p>\n\n\n\n

Unsurprisingly, the hearing and its attendees have been ridiculed on the very application they are seeking to regulate<\/a>. Many users highlighted the inability of some committee members to grasp the algorithmic workings of the app, whilst others decried the perceived xenophobic rhetoric of several lines of questioning. One criticism levied at the Committee was that US-based organizations had been mishandling and misusing personal data for years and yet, despite public hearings and half-admissions of guilt, no regulation had been imposed on the US tech giants<\/a>. <\/p>\n\n\n\n

While federal data privacy legislation still appears several years away, 2023 will undoubtedly change this landscape for US businesses. As Colorado, Utah, Virginia and Connecticut follow California\u2019s lead in enforcing state data privacy legislation (with 19 other states in varying stages of introducing legislation), organizations processing US citizen data have a unique opportunity to seize a competitive advantage.<\/p>\n\n\n\n

From risk-prevention to rights-promotion<\/h2>\n\n\n\n

Prior to the creation of the Californian Consumer Privacy Act (CCPA), US privacy architecture can best be described as following a sector-based approach. The Graham-Leach-Bliley Act (GLBA), the Health Insurance Portability and Accountability Act (HIPPA), and the Children\u2019s Online Privacy Protection Act (COPPA) provide federal cover for personal data in various high-risk cases \u2013 financial data, health data, and children\u2019s data respectively<\/a>. <\/p>\n\n\n\n

What the CCPA and its affiliates advance is therefore a departure from a sectoral to a territorial approach. Under the CCPA, any Californian resident is required to be provided four key rights: The right to know what information is being collected, the right to delete personal information (with exceptions), the right to opt-out of the sale of their information, and the right to non-discrimination. Therefore, the onus is placed on the rights of the individual, rather than the nature of the data they provide.<\/p>\n\n\n\n

This shift from harm-prevention to rights-promotion echoes that of the CCPA\u2019s European cousin: the General Data Protection Regulation (GDPR). Under the GDPR, EU and UK individuals effectively own their personal information, with severe penalties for organizations that fail to adequately protect or misuse the personal data provided to them<\/a>. Since its inception in 2016 (and as of March 23), failure to adhere to the GDPR has resulted in cumulative fines of almost 2.8 billion Euros<\/a>. Last year, the first fine under the CCPA was issued to the cosmetics giant Sephora, which was ordered to pay $1.2 million for 3 violations following a spot-check by the Californian data privacy authorities<\/a>.<\/p>\n\n\n\n

Get the memo<\/h2>\n\n\n\n

The example of Sephora is a crucial one in understanding the future of US data privacy. Californian Attorney General Rob Bonta issued a combative statement upon its announcement, warning companies that \u201cit\u2019s time for [them] to get the memo: protect consumer data, honor their privacy rights.\u201d <\/p>\n\n\n\n

And US consumers do care.<\/p>\n\n\n\n

A 2019 article<\/a> by Pew Research showed that over half of Americans had decided not to use or to stop using products due to privacy concerns. Meanwhile, research<\/a> showed that 86% of Americans believe businesses and organizations collect too much data, while nearly two thirds of Americans believe threats to their personal data are growing faster than businesses and organizations can keep up. Consequently, 64% of respondents said that the potential risks they faced by providing too much personal data outweighed the benefits of doing business.<\/p>\n\n\n\n

What emerges therefore is a picture of a suspicious, concerned and privacy-seeking US consumer.<\/p>\n\n\n\n

Innovation as a competitive advantage<\/h2>\n\n\n\n

The arrival of wider US privacy legislation must be seen by organizations processing US-citizen data as an opportunity for innovation and reputation enhancement rather than a purely regulatory exercise. The US consumer is looking for the organizations they do business with to prove that they are privacy conscious. Similar to recent trends in environmental social governance (ESG), consumers desire their brands to reflect the same ethical and privacy-focused considerations as they do. <\/p>\n\n\n\n

Major companies such as Meta, Sephora and TikTok are facing an uphill battle to rebuild consumer trust following their public privacy failings. This means that smaller and more agile organizations can seize a competitive advantage and challenge established industry leaders through integrating innovative privacy architecture.<\/p>\n\n\n\n

Consider the following three areas as ripe for innovation:<\/p>\n\n\n\n