{"id":840,"date":"2021-11-02T16:54:54","date_gmt":"2021-11-02T22:54:54","guid":{"rendered":"https:\/\/ctlj.colorado.edu\/?p=840"},"modified":"2021-11-02T17:04:28","modified_gmt":"2021-11-02T23:04:28","slug":"personal-information-and-artificial-intelligence-website-scraping-and-the-california-consumer-privacy-act","status":"publish","type":"post","link":"https:\/\/ctlj.colorado.edu\/?p=840","title":{"rendered":"Personal Information and Artificial Intelligence: Website Scraping and the California Consumer Privacy Act"},"content":{"rendered":"

Personal Information and Artificial Intelligence:\u00a0Website Scraping and the California Consumer Privacy Act<\/h1>\n

Brian Stuenkel[1]<\/a><\/sup>*<\/h2>\n

Print Version: Personal Information and Artificial Intelligence- Website Scraping and the California Consumer Privacy Act<\/a><\/h3>\n

This note presents a hypothetical in which an upstart technology firm scrapes public-facing webpages and websites, scooping up individuals\u2019 personal identifying information (PII) including names, addresses, phone numbers, and dates of birth (among other information) in the process. In this hypothetical scenario, the tech firm then uses the information gathered to create a dataset containing the PII. The upstart tech firm then uses the dataset to train artificial intelligence (AI) tools. The upstart tech firm is subsequently acquired by a larger software company. Included in the acquisition are both the AI model and the training dataset to be used within the acquiring company\u2019s own \u201ccode stack\u201d or software product suite.<\/em><\/p>\n

In the changing landscape of data privacy laws, this note seeks to answer several questions: First and foremost, is website scraping prohibited by the California Consumer Privacy Act (CCPA)? Second, are data scrapers required to notify consumers under the CCPA and if so, how? Third, what legal obligations may an acquiring company have after receiving the information upon acquisition? Finally, what liability may the acquiring company face in acquiring, storing, or disclosing the PII, or in failing to notify individuals whose information was collected by the small AI firm it acquired?<\/em><\/p>\n

This note considers a particular scenario, however the scenario is designed to highlight some of the problems with an expansive new law, as well as a lack of federal regulation regarding the use of specific types of information when placed in the public sphere without additional safeguards. The state law under which this note seeks to address these questions is the California Consumer Privacy Act, or CCPA.<\/em><\/p>\n

The CCPA and California Privacy Rights Act of 2020 (CPRA) are, at the time of publication, still in flux, with the California Attorney General weighing in with multiple rounds of proposed modifications to the text of the CCPA and the CPRA, expanding the scope of specific provisions, and increasing the resources available to the California Attorney General with which to enforce the obligations of the CCPA. Throughout the last year, the obligations of the parties who are the focus of this note have repeatedly changed. While the author hopes this note is current whenever read, the reader should proceed with caution as the playing field may have shifted yet again.<\/em><\/p>\n

Introduction 430<\/p>\n

I. The Hypothetical 434<\/p>\n

II. The California Consumer Privacy Act 435<\/p>\n

A. Extraterritoriality and the Reach of the CCPA 437<\/p>\n

B. Parties Affected by the CCPA 438<\/p>\n

C. Information Covered by the CCPA 438<\/p>\n

D. Rights and Obligations Created by the CCPA 440<\/p>\n

E. Conduct Covered by the CCPA 441<\/p>\n

1. Web Scraping and the CCPA 444<\/p>\n

2. Web Scraping and Notification 450<\/p>\n

F. Exceptions to CCPA Obligations 454<\/p>\n

G. Remedies and the Role of the California Attorney General 458<\/p>\n

H. The California Privacy Rights Act of 2020 (CPRA) 459<\/p>\n

Conclusion 460<\/p>\n

<\/a> Introduction<\/p>\n

Machine Learning (ML) is a subcategory of Artificial Intelligence (AI). Machine Learning is, at its core, a technology that makes predictions about information absent from input information, or \u201cinput data sets,\u201d and bases those predictions on data that originally trained the algorithm, or \u201ctraining data.\u201d[2]<\/a><\/sup> In ML terms, \u201c[p]rediction is the process of filling in missing information.\u201d<\/a>[3]<\/a><\/sup> Importantly, ML uses feedback to improve its processes, allowing it to make more accurate predictions in the future.<\/a>[4]<\/a><\/sup> One of the first prediction machines was created to play checkers.[5]<\/a><\/sup> This machine, or \u201cmodel,\u201d was trained with simple instructions that primarily consisted of the parameters of the game itself.[6]<\/a><\/sup> Within a relatively short window of playing time, the model was able to play the game better than the average player by using feedback to improve its gameplay strategy.[7]<\/a><\/sup><\/p>\n

Today, modern prediction machines have many more practical applications and are used for more than just beating their programmers at checkers. Prediction machines are ubiquitous: the technology is \u201cin our phones, cars, shopping experiences, romantic matchmaking, hospitals, banks and all over the media.\u201d[8]<\/a><\/sup> Increasingly, AI and predictive ML specifically, are being used in Software-as-a-Service (SaaS) applications.[9]<\/a><\/sup> One result of this development is that smaller companies that could not otherwise afford to build out complete AI divisions for their businesses can subscribe to AI application tools and apply these advanced models to data produced or collected by their own organizations.<\/a>[10]<\/a><\/sup> Examples of these types of software offerings are available as applications on various cloud service providers, including Amazon\u2019s AWS, Microsoft\u2019s Azure, Google\u2019s Cloud Platform, and IBM\u2019s Developer Cloud.[11]<\/a><\/sup> These cloud services provide small and medium businesses (as well as larger businesses) access to pre-built ML models which subscribers use to evaluate operational efficiency and other aspects of their businesses. Though to be sure, it\u2019s not just the old familiar names of big tech occupying the space. New companies are entering the market each year as the demand for cost-effective business solutions continues to grow.<\/a>[12]<\/a><\/sup> In fact, as of 2020, ML and AI are among the fastest growing sectors of the tech industry.[13]<\/a><\/sup><\/p>\n

But let\u2019s get back to the data. At this point you might be asking yourself, where does the data come from that is used to train the ML models? For a small- or mid-size business applying ML to its operations through a subscription format\u2014for example, as a subscriber through Google\u2019s Cloud platform\u2014the data that originally trained the model comes from the developers of the model.[14]<\/a><\/sup> The small business then takes its own data generated through its own business operations\u2014for example, sales records, geographic information, inventory information, customer surveys, etc.\u2014 and inputs this data into the algorithm as \u201cinput data.\u201d[15]<\/a><\/sup> The model then processes the information and makes predictions about future customer interactions.<\/p>\n

To illustrate this concept, let\u2019s look at the example of ML models evaluating the legitimacy of credit card transactions. In this scenario, the model takes certain information about past purchases including: average dollar value of previous purchases; merchants at which a card was previously used; where and when the card was most recently used; and what types of goods the card was used to purchase. The model then uses that information to determine if the card is being used fraudulently in the current purchase.<\/a>[16]<\/a><\/sup> The data that was originally used to train the model establishes the parameters for processing and evaluating new data.[17]<\/a><\/sup> The new data, or input data, about a specific credit card purchase is processed by comparison to previous transactions the model knows were either fraudulent or legitimate.[18]<\/a><\/sup> This allows the model to \u201cflag\u201d transactions it believes are fraudulent, then notify the customer who can then confirm or deny the legitimacy of the transactions, providing yet another data point for the model to improve upon its prediction accuracy.[19]<\/a><\/sup><\/p>\n

Training a model to be accurate requires enormous amounts of data.[20]<\/a><\/sup> Most small and medium businesses likely do not have the amounts of data required to train a useful model, and the costs associated with buying the amounts of data required are simply not economically feasible for firms of that size.[21]<\/a><\/sup> Nor do small and medium businesses typically have the resources required to develop these advanced but costly tools on their own.[22]<\/a><\/sup> That is where AI-as-a-Service comes in. Some of the largest platforms already have well developed AI divisions within their businesses, as previously mentioned, and most of them even offer those services to other businesses through their platforms.[23]<\/a><\/sup> While this note will not deeply explore this specific scenario, the issue of who owns the model and input data\u2014either the AI firm or the business wishing to utilize AI in its operations\u2014depends largely on the parties\u2019 user agreements and terms of service .[24]<\/a><\/sup> But the scenario just mentioned is one in which the medium-sized business simply processes its own data through the AI firm\u2019s algorithm. Whereas here, we are concerned more so with a company developing an ML or AI model and selling all of its assets, including the model and training datasets, to an acquiring company.<\/p>\n

Other mature companies\u2014including Netflix, Salesforce.com, John Deere, Splunk, and others\u2014are hard at work developing these divisions within their own organizations,.[25]<\/a><\/sup> In an effort to keep pace, firms often try to leap-frog their competitors by acquiring companies which develop these sophisticated tools. Where those upstart AI companies get their data is a primary focus of this note.<\/p>\n

<\/a> The Hypothetical<\/p>\n

The following is a hypothetical scenario which serves as the foundation for the analysis in this note.<\/p>\n

In the very real-world scenario where a large, mature software technology firm seeks to establish or improve an ML or AI component of its business. Rather than build-out this portion of its software stack from scratch, the mature technology firm elects to acquire an existing company (the AI startup) that has developed the technology it wants to integrate into its own software offering.<\/p>\n

Unbeknownst to the mature tech firm, the acquisition target built its ML model on training data comprised of information scraped from public-facing websites. When the AI startup scraped public-facing websites, it collected a large amount of data containing PII of individuals, some of which (for our purposes) were California residents. Scraping involves the use of \u201cbots,\u201d or robot applications deployed for automated tasks, which scan and copy the information on webpages then store and index the information.[26]<\/a><\/sup> The AI startup then compiled this data into a format its ML model could accept and process, and used the data to \u201ctrain\u201d the model. In most instances where a similar scenario actually occurs, the industry best practice is to anonymize or pseudonymize the training data to avoid the use or occurrence of PII in the training data altogether.[27]<\/a><\/sup> There are both practical as well as legal reasons that make this practice preferable to alternatives.[28]<\/a><\/sup> However, for our purposes, we will assume that the AI startup cut corners and included the PII in the training data.<\/p>\n

As part of the acquisition of the AI startup, the training data sets were included in the transfer. So, the acquiring company now possesses the PII in large data sets that were used to train the AI model, as well as to whatever degree the PII is contained within the model itself. In reality, this hypothetical is fairly common.[29]<\/a><\/sup> Scenarios just like this, where a maturing tech firm wishes to keep pace with competitors by choosing to buy an upstart company, occurs with increasing regularity.[30]<\/a><\/sup> As mentioned above, this type of leap-frogging allows a company to remain competitive by efficiently utilizing its available resources and simply purchasing an upstart company rather than devoting the time and resources required to build a comparable division for itself.<\/p>\n

<\/a> The California Consumer Privacy Act<\/p>\n

The California Consumer Privacy Act of 2018 (CCPA) took effect on January 1, 2020.[31]<\/a><\/sup> The CCPA was largely a response by the California state legislature to a proposed ballot initiative.<\/a>[32]<\/a><\/sup> The resulting law was drafted in less than a week and, by some accounts, contains multiple drafting errors, typos, and less than ideal policies.<\/a>[33]<\/a><\/sup> \u201cThe CCPA is arguably the most comprehensive\u2014and complex\u2014data privacy regulation in the United States. It may also be one of the most hastily put together pieces of privacy legislation in recent history.\u201d[34]<\/a><\/sup> Some feel the CCPA is an effort to keep pace with European privacy law, namely the European Union\u2019s General Data Protection Regulation (GDPR).<\/a>[35]<\/a><\/sup> Like the CCPA, the GDPR also creates affirmative duties and corresponding individual rights. For example, both the CCPA and GDPR require notices to individual data subjects (though the CCPA uses a different term in lieu of \u201cdata subject\u201d); create individual rights to access the data that companies collect about the individual; and provide a right of erasure (more commonly known as the \u201cright to be forgotten\u201d).<\/a>[36]<\/a><\/sup> Additionally, both the CCPA and GDPR require businesses to notify customers about what information they collect and how they use and process the information they collect.[37]<\/a><\/sup> They both apply the \u201cbusiness requirement\u201d to the collection of data on and offline.[38]<\/a><\/sup> And both apply to a wide range of businesses across sectors (though the CCPA has certain carveouts specifically for industries already covered by specific federal regulations).[39]<\/a><\/sup><\/p>\n

The stated goal of the CCPA is \u201cto further Californians\u2019 right to privacy by giving consumers an effective way to control their personal information.\u201d[40]<\/a><\/sup> The CCPA creates a number of statutory rights for California residents, discussed in greater detail below in Section D.[41]<\/a><\/sup> The most relevant to our hypothetical are the rights and obligations that provide California residents with a say in preventing companies that collect the residents\u2019 information from selling it to other businesses, and require the companies doing the collecting to notify consumers \u201cat the time of collection.\u201d[42]<\/a><\/sup><\/p>\n

<\/a> Extraterritoriality and the Reach of the CCPA<\/p>\n

By its own terms, the CCPA seems to reach outside its borders, asserting jurisdiction over any company that meets its definition of doing \u201cbusiness in the state,\u201d \u201cpotentially appl[ying] to any business throughout the globe that has\/gets personal information about California residents the moment the business takes the first dollar from a California resident.\u201d[43]<\/a><\/sup> This is particularly noteworthy given the sectoral patchwork approach to U.S. privacy law generally.[44]<\/a><\/sup> Moreover, \u201cthe law\u2019s purported application to businesses not physically located in California raises potentially significant dormant Commerce Clause and other Constitutional problems.\u201d[45]<\/a><\/sup> While these considerations are outside the scope of this note, they highlight yet more potential problems with a law which purports to extend its own jurisdiction throughout the United States and beyond.<\/p>\n

If a business collects the personal information of 50,000 or more California consumers in a year, by its language, the CCPA reaches the business even if it does not actually \u201cdo business in the state of California.\u201d[46]<\/a><\/sup> For businesses physically located near the California state line in neighboring border states, which many California residents may visit annually, this may mean they are swept up by the CCPA even if these businesses do not have an online presence. Though this observation is not completely relevant to this note, it highlights the public policy concerns of allowing California\u2019s laws to reach beyond its borders to capture businesses with no direct ties to California.<\/p>\n

<\/a> Parties Affected by the CCPA<\/p>\n

The CCPA affects companies \u201cdoing business in\u201d California, but only if they buy or sell consumer information of 50,000 (or more) California \u201cconsumers\u201d or \u201cdevices\u201d (100,000 or more effective January 1, 2023)[47]<\/a><\/sup>; or have a gross annual revenue of $25 million or more[48]<\/a><\/sup>; or derive at least fifty percent of their revenue from sharing personal information from consumers.[49]<\/a><\/sup> However, the CCPA contains accommodations and carve-outs for small-businesses, non-profits, and other institutions and businesses which are covered by federal laws, such as the Gramm-Leach-Bliley Act (regulating financial institutions), the Fair Credit Reporting Act (regulating consumer reporting agencies), and the Health Insurance Portability and Accountability Act (regulating health care providers).[50]<\/a><\/sup><\/p>\n

Unlike the thresholds and carveouts for companies \u201cdoing business\u201d in California, the consumer definition has no such exceptions. The CCPA\u2019s definition of \u201cconsumer\u201d is given substance through its reference and application to \u201cnatural [resident] person(s).\u201d[51]<\/a><\/sup> \u201cResident\u201d is further defined by the CCPA to include \u201c(1) every individual who is in the State for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the State who is outside the State for a temporary or transitory purpose.\u201d[52]<\/a><\/sup> The statute provides for the protection of natural persons who are residents of California, \u201chowever identified, including by a unique identifier.\u201d[53]<\/a><\/sup> This definition is consistent with the GDPR\u2019s definition of \u201cdata subject,\u201d which is \u201can identified or identifiable natural person.\u201d[54]<\/a><\/sup><\/p>\n

<\/a> Information Covered by the CCPA<\/p>\n

The CCPA provides for activities of qualifying businesses engaged in collection, use, and sale (among other things) of \u201cpersonal information\u201d (or PII) of California resident consumers.[55]<\/a><\/sup> Like some of its other provisions, the CCPA gives qualifying information a robust definition as that which \u201cidentifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.\u201d[56]<\/a><\/sup> The statute goes on to list a number of qualifying pieces of PII which includes without limitation:<\/p>\n

[R]eal name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver\u2019s license number, passport number .\u00a0.\u00a0. [i]nternet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer\u2019s interaction with an Internet Web site, application, or advertisement .\u00a0.\u00a0. [a]udio, electronic, visual, thermal, [and even] olfactory\u201d information.[57]<\/a><\/sup><\/p>\n

Importantly, expressly excluded from its definition of consumer information are \u201cdeidentified\u201d and \u201caggregate\u201d information.[58]<\/a><\/sup> The CCPA defines \u201caggregate personal information\u201d as \u201cinformation that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device.\u201d[59]<\/a><\/sup> \u201cDeidentified information\u201d is statutorily defined as \u201cinformation that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer,\u201d (with three additional requirements proscribing how the company may use the deidentified consumer information).[60]<\/a><\/sup><\/p>\n

Notably, nowhere does the CCPA \u201cattempt to harmonize the overly broad definition of \u2018personal information\u2019 with deidentification or aggregation.\u201d[61]<\/a><\/sup> In fact, some commenters have suggested that the inclusion of \u201creasonable\u201d in the definition of \u201cdeidentified information\u201d creates an unintended gap because a business otherwise covered by the statute could claim that even if the consumer information is re-identifying in fact<\/em>, if the process of re-identifying the resident consumer requires more than a \u201creasonable\u201d effort, the consumer\u2019s personal information is therefore not covered by the statute.[62]<\/a><\/sup><\/p>\n

Most importantly for our purposes, this definition includes the personal information a California resident consumer willingly places on publicly available web pages. The CCPA provides that \u201cpublicly available information\u201d is excluded from the statutory definition of \u201cpersonal information.\u201d[63]<\/a><\/sup> However, this exclusion is severely limited in that \u201c\u2018publicly available\u2019 [only] means information that is lawfully made available from federal, state or local government records<\/em>.\u201d[64]<\/a><\/sup> In other words, only information contained in federal, state, or local government records, which is also lawfully made publicly available (for example, in property tax assessor files, registered voter files, court filings, motor vehicle records, professional and business licenses, etc.) is excluded from the statutory definition of \u201cpersonal information\u201d and therefore not subject to the provisions of the CCPA.<\/p>\n

<\/a> Rights and Obligations Created by the CCPA<\/p>\n

The CCPA creates a number of rights for California \u201cconsumers.\u201d The primary rights created by the CCPA include 1) the right of a consumer to request information from a business regarding what information the business collects about the consumer,[65]<\/a><\/sup> 2) the right of a consumer to request that information collected about the consumer be deleted by the business,[66]<\/a><\/sup> 3) the right to \u201copt-out\u201d of the sale of the consumer\u2019s information by the collecting business to a third-party,[67]<\/a><\/sup> and 4) the consumer\u2019s right to not be discriminated against by the business if the consumer chooses to exercise its rights under the CCPA.[68]<\/a><\/sup><\/p>\n

These rights are not unqualified. For example, a consumer\u2019s right to request that a business or service provider delete their personal information is limited by whether the business requires the personal information for a number of potential reasons.[69]<\/a><\/sup> Those reasons can include \u201cdetecting security incidents,\u201d engaging in \u201cpublic or peer-reviewed\u201d research, and notably, a determination by the business itself whether it requires the \u201cuse [of] the consumer\u2019s personal information, internally, in a lawful manner that is compatible with the context in which the consumer provided the information.\u201d[70]<\/a><\/sup><\/p>\n

This last exception clearly places a great deal of discretion in the hands of the business by allowing the business to make its own determination to whether it deems the information necessary for internal use. This exception is notable because it exempts businesses from compliance with one of the strongest rights a consumer can exercise\u2014the right to require the business to delete personal information about the consumer. By its own terms, the language of this exception establishes a relatively low bar for a business wishing to retain the information and likely only prevents the business from selling the information to a third-party as the information may only be retained for \u201cinternal\u201d use.[71]<\/a><\/sup> This exception may also play an important role in determining what the mature tech firm in our hypothetical scenario may do with the personal information it receives as an included asset in its acquisition of the AI startup. Because the AI startup has used personal information as training data for its AI algorithm, there is reason to believe its continued use of the training data and\/or algorithm may fit this exception. This potential outcome is explored later in this note.<\/p>\n

<\/a> Conduct Covered by the CCPA<\/p>\n

The CCPA defines information \u201ccollecting\u201d very broadly, as \u201cbuying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means<\/em>. This includes receiving information from the consumer, either actively or passively, or by observing the consumer\u2019s behavior.\u201d[72]<\/a><\/sup> This definition reaches a vast number of businesses and business activities.[73]<\/a><\/sup> However, the text of the CCPA appears most concerned with the sort of direct interactions between consumers and websites which require some form of PII from the consumer in order to register and verify the user, or allow the consumer to purchase or download something from the site.[74]<\/a><\/sup> Large websites such as Facebook, LinkedIn, and Amazon all qualify under this definition because they each require registered users to log into the site with an account before a user can upload information about themselves or purchase goods.[75]<\/a><\/sup> The websites use such information to verify the user is legitimate, but may also use the information for other purposes.<\/p>\n

All of the statutory consumer-rights that the CCPA creates are \u201cintended to further the [state] constitutional right of privacy and to supplement existing laws relating to consumers\u2019 personal information.\u201d[76]<\/a><\/sup> However, the primary right created by the CCPA is the California consumer\u2019s right to request information from these types of businesses regarding what information the businesses collect about the consumer, and to whom the businesses provides that information.[77]<\/a><\/sup> Furthermore, this right does not have any listed exemptions and all qualifying businesses must comply with \u201cverifiable consumer requests.\u201d[78]<\/a><\/sup> Rather than make each consumer dig through a websites\u2019 terms of use looking for contact information, the CCPA requires businesses covered by the statute to \u201c[m]ake available to consumers two or more designated methods for submitting requests for information required to be disclosed [by the business] .\u00a0.\u00a0. including, at a minimum, a toll-free telephone number.\u201d[79]<\/a><\/sup> But a \u201cbusiness that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information\u201d is only required to \u201cprovide an email address for submitting requests for information.\u201d[80]<\/a><\/sup> The CCPA requires that websites create a \u201cclear and conspicuous link\u201d on the website\u2019s homepage that consumers can access to make the requests detailed above.[81]<\/a><\/sup><\/p>\n

Without this type of direct interaction, which firms engaged in data scraping have no practical way of accomplishing, there does not seem to be a technologically satisfying solution for website scrapers to notify consumers. When performed within the bounds of applicable law, notwithstanding the CCPA, scraping is the copying and indexing of information placed on public-facing webpages. The activity can be done manually or by automated process as described below. But there is no direct interaction between the party doing the scraping and the consumers who make the information publicly available.<\/p>\n

However, it is only by virtue of the fact that websites have a way to inform their users \u201cat the point of collection\u201d about their data collection practices, and the users of their rights under the CCPA, that the CCPA can be effective at all. Without this type of direct interaction with consumers, which firms engaged in data scraping conduct do not have a meaningful way of replicating, an entire industry is left in limbo.<\/p>\n

The language of the statute, specifically the proposed bill\u2019s recitals, further implies that the websites the CCPA is exclusively directed at are those with which consumers interact directly.[82]<\/a><\/sup> Because websites like Facebook and LinkedIn require users to register with the site to create profiles and change information about themselves, those businesses have a readily available medium by which they can notify users of their rights under the CCPA, namely their own websites. In fact, they are required to use this medium under the CCPA to do just that.[83]<\/a><\/sup> Furthermore, because they manage and maintain that medium they are responsible for what happens to the users\u2019 PII in their possession.[84]<\/a><\/sup> That is, if those businesses collect or sell user\u2019s PII, or otherwise contract for a third-party\u2019s use of PII, they are required by the CCPA to respond to consumer inquiries regarding what specific PII is being used by third-parties and by whom the PII is being used, and importantly, offer consumers an easy way to request that their information not be sold to those or other third-parties.[85]<\/a><\/sup><\/p>\n

For websites the size of Facebook, LinkedIn, and Amazon, the primary difficulty encountered by these requirements is not likely responding to consumers or making sure they know who is using the information, but rather managing the massive amounts of data they collect. But for smaller companies without the resources of these tech giants, simply ensuring that service provider contracts meet the requisite level of control is undoubtedly a daunting task.<\/p>\n

<\/a> Web Scraping and the CCPA<\/p>\n

For our hypothetical, the threshold question is whether the conduct of scraping a website constitutes \u201ccollecting\u201d information under the CCPA\u2019s expansive definition. An important subsequent question is whether or not it should<\/em> qualify. Because the definition of \u201ccollect\u201d under the CCPA includes \u201cobtaining\u201d or \u201cgathering\u201d consumer PII \u201cby any means<\/em>,\u201d the conduct of scraping a website seems to fall squarely within that description.[86]<\/a><\/sup> As discussed above, third-party scrapers use bots to index or otherwise gather information found on public-facing webpages.[87]<\/a><\/sup> Internet search engines operate this way and a whole industry has popped up around strategically ensuring a given website is among the top results from search queries conducted using search engines like Google and Bing.<\/a>[88]<\/a><\/sup> SEO, or Search Engine Optimization, is the practice of positioning a website to be among top search results for certain key terms in search engines like Google and Bing.[89]<\/a><\/sup> In fact, Forbes estimated (based on Borrell Associates research conducted in 2016) that in the U.S. alone, $80 Billion would be spent on SEO in 2020.[90]<\/a><\/sup> These popular search engines work by crawling \u201chundreds of billions\u201d of webpages, gathering information from them and then organizing that information in massive Search indexes.[91]<\/a><\/sup> When a search is conducted on one of the engines, the terms in the search are processed by Google\u2019s trademarked algorithm and the results a user sees are web pages Google has indexed which the algorithm thinks you\u2019ll most want to visit.[92]<\/a><\/sup><\/p>\n

Overall, the body of case law treating the conduct of web scraping is sparse, however several recent cases have addressed scraping by businesses who appropriate the scraped information and use the information in one form or another. In Spokeo v. Robins<\/em> the website at issue, Spokeo.com, scraped and compiled information from multiple public-facing web pages to compose reports about the individual subjects of search queries performed on its site.[93]<\/a><\/sup> Users of Spokeo.com are able to search for people based on name, email address, home address and other criteria.[94]<\/a><\/sup> Spokeo.com\u2019s users ranged from inquisitive romantic partners to prospective employers performing background research on job applicants.[95]<\/a><\/sup> Primarily at issue in the U.S. Supreme Court\u2019s decision was whether or not the plaintiff\u2019s, Robins\u2019s, complaint was sufficient to establish standing.[96]<\/a><\/sup> The conduct alleged by the complainant was that Spokeo.com violated the Fair Consumer Reporting Act (FCRA) when it presented false information about Robins in the form of a \u201cconsumer report.\u201d[97]<\/a><\/sup><\/p>\n

Not at issue in Spokeo<\/em> was the conduct of scraping third-party websites, but rather reporting on the information that was obtained through that scraping.[98]<\/a><\/sup> So, while this case is perhaps the only case involving website scraping to come before the U.S. Supreme Court, the Court\u2019s decision does not provide a great deal of insight as to how the court would treat the conduct of website scraping specifically.<\/p>\n

In Associated Press v. Meltwater Holdings, <\/em>decided before Spokeo<\/em>, the court considered whether Meltwater\u2019s conduct of crawling various websites for AP\u2019s stories and scraping \u201csnippets\u201d of the stories for use in notifying and informing Meltwater\u2019s own customers of certain stories, violated the Copyright Act.[99]<\/a><\/sup> The U.S. District Court for the Southern District of New York, deciding on cross motions for summary judgment, considered the defenses proffered by Meltwater whose primary defense was based on the \u201cfair use\u201d doctrine.[100]<\/a><\/sup> Meltwater\u2019s services, for which its subscribers paid thousands of dollars annually, included crawling websites and reproducing verbatim portions of news stories based on user search terms.[101]<\/a><\/sup> In the content reported to Meltwater\u2019s users, directly at issue in the case, were thirty-three copyrighted stories originally reported by the Associated Press (AP).[102]<\/a><\/sup><\/p>\n

Arguing that it functioned primarily as an internet search engine, Meltwater claimed that it \u201ctransformed\u201d the AP copyrighted content thereby making its conduct exempt through the so-called \u201cfair use\u201d doctrine.[103]<\/a><\/sup> While this case gets closer to the conduct we are most concerned about, namely the crawling and scraping of websites, its focus is on the rights enjoyed by parties with intellectual property rights, namely copyrights, in the scraped content.[104]<\/a><\/sup> In our hypothetical, individual consumers do not have copyrights in their names or other personal information. That being said, the case does have some relevance in that the court considered the \u201ctransformation\u201d defense presented by Meltwater.[105]<\/a><\/sup> Because the \u201cfair use\u201d doctrine is specifically an affirmative defense in copyright infringement litigation, [106]<\/a><\/sup> it is not clear how under the CCPA a similar defense might be made.<\/p>\n

Still, the CCPA does include certain express exemptions of specific conduct, which are covered later in this article. In Meltwater<\/em>, the court considered the extent to which the scraped information was transformed reasoning that the \u2018fair use\u2019 doctrine is designed to protect the use of copyrighted materials where \u201cnew aesthetics, new insights and understandings\u201d are produced.[107]<\/a><\/sup> But likewise, it is not designed to protect use where the copyrighted material is merely \u201crepackage[d].\u201d[108]<\/a><\/sup> Unconvinced by Meltwater\u2019s arguments, the court reasoned that Meltwater\u2019s use of the copyrighted content was not sufficiently transformative and exploitive of AP\u2019s work in a manner which unfairly injured AP.[109]<\/a><\/sup><\/p>\n

Most recently, in hiQ Labs v. LinkedIn<\/em>, a case that reached the Ninth Circuit Court of Appeals on noteworthy procedural grounds, the court was confronted with the question of whether LinkedIn could prevent hiQ Labs from scraping information from public facing user-profiles hosted by LinkedIn\u2019s website on the grounds that the conduct allegedly violated the Computer Fraud and Abuse Act (CFAA) of 1986, the Digital Millennium Copyright Act (DMCA), and the common law of trespass.[110]<\/a><\/sup> The Ninth Circuit Court of Appeals limited its ruling to the issue of preliminary injunctive relief ordered by the District Court.[111]<\/a><\/sup> There, hiQ Labs sought to prevent LinkedIn from prohibiting hiQ\u2019s access to the profiles by way of an injunctive order.[112]<\/a><\/sup> The court correctly limited its review of the lower court\u2019s decision by evaluating whether the decision of the lower court was \u201cillogical, implausible, or without support in the record.\u201d[113]<\/a><\/sup><\/p>\n

In its review, the court seemingly relied heavily on both third-party doctrine and the court\u2019s understanding of the phrase, \u201cwithout authorization\u201d as found in the CFAA, to support its finding that both LinkedIn\u2019s users and LinkedIn itself had assumed the risk that a third-party might view the public-facing user-profile information (containing personal information such as name, email address, education and employment history), and that LinkedIn did not adequately limit the public\u2019s access to the webpages in question to meet the CFAA\u2019s meaning of \u201cwithout authorization.\u201d[114]<\/a><\/sup><\/p>\n

Because both LinkedIn and the individual users made the information available to the public by making the user profiles viewable to anyone with a web browser, and because LinkedIn did not claim any ownership of the user data by virtue of the terms of service in its user agreements, the users effectively assumed the risk that a third-party might view the information.[115]<\/a><\/sup> The court reasoned, \u201c[i]t is likely that when a computer network generally permits public access to its data, a user\u2019s accessing that publicly available data will not constitute access without authorization under the CFAA.\u201d[116]<\/a><\/sup> Furthermore, in its evaluation of the lower court\u2019s finding as to which party\u2019s individual interests were most aligned with that of the public interest, the court again found that hiQ Labs\u2019 interest weighed heaviest.[117]<\/a><\/sup> It reasoned that,<\/p>\n

[G]iving companies like LinkedIn free rein to decide, on any basis, who can collect and use data\u2014data that the companies do not own, that they otherwise make publicly available to viewers, and that the companies themselves collect and use\u2014risks the possible creation of information monopolies that would disserve the public interest.[118]<\/a><\/sup><\/p>\n

This language from the court reflects the precarious position U.S. privacy law finds itself in at the current moment. The barrier between public and private is small but significant for both the individuals whose information is swept up by parties scraping web pages viewable by the public, and the companies which host and use the information their users provide. Making all that information public\u2014which is not private\u2014result which the decision in hiQ Labs<\/em> lends itself to, is arguably one of the biggest issues the CCPA seeks to address.<\/p>\n

The decision in hiQ Labs <\/em>came in the wake of two other Ninth Circuit decisions, United States v. Nosal<\/em>, 844 F.3d 1024 (9th Cir. 2016) (Nosal II<\/em>), and Facebook v. Power Ventures<\/em>, 844 F.3d 1058 (9th Cir. 2016). In Nosal II<\/em>, the court reasoned that the CFAA\u2019s use of the phrase \u201cwithout authorization\u201d extended to the access of a password protected area of a website by an unauthorized person using valid login credentials.[119]<\/a><\/sup><\/p>\n

More notable is the court\u2019s decision in Power Ventures <\/em>though, where the court found that Power Ventures\u2019s receipt of a cease and desist letter from Facebook made any subsequent access of Facebook computers by Power Ventures in excess of the authorization and access rights otherwise permitted.[120]<\/a><\/sup> In Power Ventures<\/em>, power.com accessed Facebook user profiles after having been given Facebook user\u2019s valid login credentials, then collected and aggregated this data with data from the same user\u2019s other social media accounts, and put all the information in one place for the user to access at power.com.[121]<\/a><\/sup><\/p>\n

Despite having received a cease-and-desist notice and Facebook blocking the IP address from which Power Ventures was accessing Facebook computers, Power Ventures continued to access those computers, even changing its IP address to one that had not been blocked.[122]<\/a><\/sup> Facebook also sought for Power Ventures to utilize Facebook\u2019s Application Programing Interfaces (APIs) and abide by Facebook\u2019s Terms of Use for third-party developers, which Power Ventures resisted.[123]<\/a><\/sup><\/p>\n

The court in hiQ Labs<\/em>, likely realizing the similarities to the situation in Power Ventures<\/em>, distinguished hiQ Labs<\/em> from Power Ventures<\/em> noting an important difference between the facts presented: the Facebook computers which Power Ventures accessed were only accessible to users with valid login credentials.[124]<\/a><\/sup> Stated differently, the information accessed in Power Ventures<\/em>\u2014the user-profile data\u2014was password-protected and not open to the public, whereas the information in hiQ Labs<\/em> was public-facing, meaning anyone with a web browser could view the profiles.[125]<\/a><\/sup> This difference is foundational to the court\u2019s decision in hiQ Labs<\/em>. Had the user profiles been accessible only by those with valid login credentials, it seems safe to say the court\u2019s decision would have been in much the same vein as Power Ventures<\/em> and Nosall II<\/em>. Many commenters hailed the decision in hiQ<\/em> Labs<\/em> as a victory for web scraping and web scrapers.[126]<\/a><\/sup> But this victory may be short-lived as the CCPA\u2019s broad mandate may begin to chip away at this sort of activity.<\/p>\n

Because of the unique procedural posture of hiQ Labs<\/em>, the court did not issue a decision on the merits of the underlying arguments, and expressly limited its opinion to the finding for preliminary injunctive relief as ordered by the lower court.[127]<\/a><\/sup> The substance of the arguments LinkedIn made in its reply to the motion for preliminary injunctive relief were left largely unconsidered by the court, though on review the 9th Circuit Court of Appeals still took note of the fact that LinkedIn\u2019s user agreements expressly state that LinkedIn does not claim any ownership of the content its users add to the site.[128]<\/a><\/sup> As of writing this, LinkedIn has filed a petition for certiorari to the United States Supreme Court.[129]<\/a><\/sup><\/p>\n

Given the language of the CCPA, our hypothetical AI startup, crawling and scraping public-facing webpages, is probably engaged in \u201ccollecting\u201d personal information. But, as discussed above, courts have been reluctant to limit the use of such public-facing information by third parties if the information does not enjoy copyright status (or some other IP right) and is not used in some other prohibited manner such as producing credit reports under the FCRA (as was the case in Spokeo<\/em>). This reluctance goes directly to the core of the next question: whether the scraping of information placed on public facing pages should<\/em> be considered conduct covered by the CCPA?<\/p>\n

<\/a> Web Scraping and Notification<\/p>\n

As discussed above, the CCPA\u2019s expansive definition of \u201ccollect\u201d seems to capture web scraping activity. But where does this leave web scrapers and the information they collect from public-facing webpages?<\/p>\n

The CCPA\u2019s \u00a71798.100(b) requires any qualifying business collecting covered consumer information to notify the consumers \u201cat or before the point of collection\u201d about which categories of information it plans to collect, and for what purposes.[130]<\/a><\/sup> However, in the proposed hypothetical, the businesses are not operating the sites that the bots are crawling and scraping. Rather, they are more like unexpected and perhaps unwelcome guests of a private dinner party held at a public restaurant. For a website or platform operating with consumer data of California residents the CCPA mandates that the website must disclose at the point of collection which information it seeks to collect and for what purposes it collects that information.[131]<\/a><\/sup> But where the CCPA seems to create affirmative duties for these legitimate websites, the language of the statute may not reach the bots operating as unwelcome guests recording and indexing everything they encounter.<\/p>\n

Several reasons for excluding the activity of crawling and scraping information from public-facing webpages have already been mentioned or alluded to here. First, and perhaps the most straightforward of those reasons, is that the websites with which a consumer interacts with directly are most able to limit what types of information a user places on those sites. If the California legislature wanted to prevent consumers from placing any CCPA defined \u201cpersonal information\u201d on a website, it could enact a law providing for that purpose, though it seems equally clear that this is not a satisfying solution to the issues which the CCPA hopes to address. There is good reason to place \u201cpersonal information\u201d in the public sphere and there is also reason to find that when a consumer does so, that information has become part of the public domain. For example, the individual users of LinkedIn want to place true information about themselves in their profiles so potential employers and others can view it and hire them. Likewise, sole proprietors and others may place \u201cpersonal information\u201d about themselves on public-facing websites so that current and prospective customers know who they are doing business with.<\/p>\n

Next, large search engines like Google and Bing use this method to scan and index hundreds of billions to trillions of web pages returning hundreds of millions of results for many searches frequently in fractions of a second.[132]<\/a><\/sup> By its own count, Google has indexed more than thirty trillion web pages.[133]<\/a><\/sup> The benefit of these tools is hard to overstate. These search engines have become an integral part of the everyday experience for millions of Americans (and probably billions of others around the world) allowing widespread access to unprecedented amounts of information.[134]<\/a><\/sup> \u201cGoogle\u201d is now so synonymous with \u201csearch\u201d that its more often used contemporary meaning is as a verb, \u201cto obtain information about (someone or something) on the World Wide Web.\u201d[135]<\/a><\/sup> Preventing Google from indexing the information from public-facing websites would be extremely disruptive to users as well as entire industries that rely on the functionality of Google\u2019s search engine to function.<\/p>\n

First Amendment considerations are noteworthy here too. Where an individual has placed information in the public sphere on public-facing webpages accessible to anyone with a web browser, preventing certain entities from accessing and using the information in a way that is not obviously detrimental to any party potentially runs afoul of constitutional rights to free speech. While this consideration is relevant and particularly noteworthy, adequately exploring this topic is beyond the scope of this article.<\/p>\n

Lastly, a practical reason why website scraping should not be covered by the CCPA is that there is no technologically satisfying way to notify individual consumers whose information appears on public facing webpages being scraped by a third-party, short of notifying the website host that our hypothetical AI firm is engaged in scraping them. As we\u2019ve seen, website scraping is not some activity used only by state-agencies engaged in clandestine information gathering.[136]<\/a><\/sup> Rather, it is technology which has contributed in part to the reason why the phrase, \u201cGoogle it\u201d has become so popular in common vernacular. Once reserved for the largest companies, scraping competitors\u2019 websites for information related to product offerings, price, etc. is now a common operation among many online retailers.[137]<\/a><\/sup> And for some businesses, like the AI startup from our hypothetical, the ability to access and use this information is what allows the company to exist at all.<\/p>\n

While many of the bots deployed by sites like Google and Bing announce their arrival to a webpage and identify themselves as bots, presumably for their indexing functions discussed above, others attempt to camouflage or otherwise conceal themselves.[138]<\/a><\/sup> Many websites deploy bot blockers to stop certain bots they don\u2019t want scraping their pages while allowing those they do.[139]<\/a><\/sup> But in the war of the bots, each side is continuously upping the ante making bot-identifiers more savvy and bot-camouflaging more stealthy.<\/p>\n

Bots which identify themselves as such, alerting the website to its activities can conceivably serve as notice to the website, and by extension the individual users posting PII to the site (via the hosting websites\u2019 terms of use), that the bot is collecting their information. Websites aware of such bot activity should include some language in their terms of use to the effect that information which is public facing is subject to collection by known and unknown third parties. However, this is not a satisfying solution. Imagine reading a statement like this as a consumer\u2014you wouldn\u2019t know where to begin to look for the unknown third parties scraping and collecting your information.<\/p>\n

Our hypothetical AI startup, quietly going about its business of scraping and collecting information from public-facing webpages, should probably have its own website and a way for consumers to make requests that their information not be collected. But assuming our AI startup company is not actively engaged in selling the personal information it collects, for example as a \u201cdata broker,\u201d how is any individual consumer to know their information has even been collected?[140]<\/a><\/sup> Short of the bot making itself known to the websites it scrapes, and thus risking being blocked, there is no way for the required notification to occur \u201cat or before the point of collection\u201d as required by the CCPA.<\/p>\n

Gateways as simple as requiring users to login with valid credentials are enough to make public-facing webpages private as the court\u2019s in Nosal II<\/em> and Power Ventures<\/em> highlight. But as hiQ<\/em> demonstrated, the courts have been unwilling to create a general policy whereby information which is made public by the person it identifies enjoys some special privacy rights.[141]<\/a><\/sup><\/p>\n

If there is not an easy way for a consumer to request from an AI company developing an algorithm the information the AI firm has collected about them (through their scraping activity), most consumers are not likely to go to great lengths to seek it out and in this scenario the CCPA has lost its teeth.<\/p>\n

On March 11, 2020, during the course of writing this paper, the Attorney General of California issued proposed regulations to \u201cestablish procedures to facilitate consumer\u2019s new rights under the CCPA and provide guidance to businesses for how to comply.\u201d[142]<\/a><\/sup> Under the proposed regulations, a business such as our hypothetical AI startup would not be required to provide a notice at the point of collection to consumers whose personal information was collected during the scraping of public webpages hosted by other websites.[143]<\/a><\/sup> Because the startup is not collecting the information directly from the consumer, but rather from the webpages with which the consumers interacted, the startup is therefore not collecting the consumers personal information \u201cdirectly<\/em> from<\/em>\u201d the consumer.[144]<\/a><\/sup> The business would have remaining obligations under the proposed regulations before it could \u201csell\u201d the \u201cpersonal information\u201d but as explained below, the CCPA contains express exceptions under its definition of \u201csell\u201d which are not modified by the proposed regulations.<\/p>\n

These proposed regulations have been adopted and render much of the above analysis moot. However, the distinction between what would or would not qualify as a \u201csale\u201d remains integral to this discussion. This note anticipates only the complete acquisition of the AI startup by a mature tech firm which may seem like a \u201csale\u201d on its surface\u2014after all, the AI startup is in fact being sold to another party\u2014but as explained below, this transaction should not qualify under the CCPA\u2019s definition of \u201csale.\u201d<\/p>\n

<\/a> Exceptions to CCPA Obligations<\/p>\n

Though the CCPA covers the sale of PII to third-parties, under the statute\u2019s definition of \u201csell\u201d a specific exception is made for a company\u2019s sale of its assets to another company.[145]<\/a><\/sup> In our hypothetical, where the AI startup sells the PII as part of a training dataset to a mature tech firm, the sale would not itself constitute the sale of PII under the CCPA\u2019s definition.[146]<\/a><\/sup><\/p>\n

Section 1798.140(t)(2)(D) by its language generally excludes from the statutory definition of \u201csale\u201d situations where a company sells controlling stake of its operations and assets to another company\u2014an acquisition or merger. However, the definition goes on to require that the personal information must be used for the same purposes as, and within the scope of the stated terms of the company which originally acquired the consumer information.[147]<\/a><\/sup> Furthermore, \u201c[i]f a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer.\u201d[148]<\/a><\/sup> This begs the question as to whether the company that scraped the PII from websites is in violation of the CCPA if it uses the information differently from the website that hosted the user information originally. If for example, a user\u2019s information was placed on public-facing pages of a website and a different company scrapes that website for the user-information, the company scraping the website has at no time made any promises to the hosting site\u2019s users. Because it is not the business that originally collected the information (the website being scraped), there may be no affirmative obligations on the party doing the scraping\u2014only on the party that was being scraped.<\/p>\n

More importantly, the CCPA exempts from the definition of \u201csale,\u201d the acquisition of a company which has collected personal information from California consumers: a \u201cbusiness does not sell personal information when, [t]he business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition [], or other transaction in which the third party assumes control of all or part of the business.\u201d[149]<\/a><\/sup><\/p>\n

The acquiring business may only use the information assets acquired from the target of the acquisition consistent with the disclosures to the consumers regarding how the information would be used by the business which originally collected the information.[150]<\/a><\/sup><\/p>\n

For the sake of argument, let\u2019s assume that our AI startup is sold to a large software company with a lot of notoriety and a large footprint. Because our AI startup is scraping the websites of other businesses, it has not had the ability to notify consumers that their information is being collected in this manner and thus has made no promises or representations as to how the information is being used, what information is being collected, or to whom the information is being sold (because it is not engaged in the sale of the PII). Let\u2019s also assume that the mature tech company has been preparing for the CCPA requirements and has a webpage and a form dedicated to informing consumers about their rights under the CCPA and allowing consumers to make requests for information from the company.<\/p>\n

Does the big software company, having recently acquired the training dataset containing PII as well as the AI algorithm from our AI startup, now have to disclose the personal information it has acquired as a result of the acquisition? Probably not. The CCPA distinguishes, probably inadvertently, between information collected by the big software company and personal information collected by some other business which it now owns as a result of the acquisition.[151]<\/a><\/sup> The language of the first consumer right created under the CCPA reads as follows: \u201c[a] consumer shall have the right to request that a business that collects a consumer\u2019s personal information<\/em> disclose to that consumer the categories and specific pieces of personal information the business has collected<\/em>.\u201d[152]<\/a><\/sup> For example, if the big software company did not have any direct interaction with the consumer and never collected consumer personal information itself, but acquired such information through the acquisition, the \u2018acquisition exception\u2019 exempts its acquisition of the information from the definition of collection. The definition of \u201ccollect\u201d should be limited by the language of the acquisition exemption which reads,<\/p>\n

If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices .\u00a0.\u00a0.\u00a0.[153]<\/a><\/sup><\/p>\n

In the event of our hypothetical acquisition, the party that originally collected the information is dissolved and only the mature tech company remains. Thus, only the acquiring company can notify the consumers whose information was collected as to whether it plans to use differently the information included as an asset in the acquisition. The fact that this section goes into detail about how the acquiring party (the \u201cthird-party\u201d) may use the information, and notes that the information was collected prior to the acquisition, counsels that the acquiring company has not \u201ccollected\u201d the consumer information by the CCPA\u2019s definition.[154]<\/a><\/sup> So, while the CCPA\u2019s definition of \u201ccollects\u201d is broad, the inclusion of this language under the acquisition exception should be read to limit the definition of \u201ccollect\u201d under the specific hypothetical contemplated in this note.<\/p>\n

However, the big software company probably has every reason to comply with the consumer request and disclose every piece of personal information it has about the consumer. The CCPA outlines several exceptions for which a business can deny a consumer\u2019s request to delete their information, including among them, \u201cinternal uses that are reasonably aligned with the expectations of the consumer based on the consumer\u2019s relationship with the business,\u201d[155]<\/a><\/sup> and to \u201c[o]therwise use the consumer\u2019s personal information, internally, in a lawful manner that is compatible with the context in which the consumer provided the information.\u201d[156]<\/a><\/sup> First and foremost, if the information is necessary for the internal use of the business\u2014as may be the case if the information is used in the training dataset of an AI algorithm underlying a portion of the company\u2019s software stack\u2014it can claim this reason and be exempt from a consumer request to delete the information.[157]<\/a><\/sup> The statute\u2019s broad language arguably exempts the acquiring company which itself made no representations when the information was transferred through acquisition and where the scraping company (the AI startup) similarly made no representations when performing the scraping activity.[158]<\/a><\/sup> However, the software company will still be required to respond to the consumer request for information as no qualifying business is exempt from this obligation and here, the software company likely qualifies as a \u201cbusiness\u201d covered by the CCPA due to its size and digital footprint.<\/p>\n

Secondly, from a more practical business perspective, the software company should honor consumer requests to maintain goodwill among its customers. No business will want a reputation as a company that does not take seriously the privacy concerns of its customers. Along the same lines, a business which is not responding promptly or adequately may soon find itself in the crosshairs of the California Attorney General.<\/p>\n

<\/a> Remedies and the Role of the California Attorney General<\/p>\n

Despite being regarded as the most robust privacy law in the United States, the CCPA creates only a limited private right of action for violations.[159]<\/a><\/sup> A private civil action is limited to disclosure of \u201cnonencrypted or nonredacted personal information,\u201d a defined subset of consumer information found in the California data breach statute.[160]<\/a><\/sup> \u201cEncrypted\u201d information, according to the definition provided there, means \u201crendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.\u201d[161]<\/a><\/sup> The California Attorney General, delaying enforcement of the CCPA until July of 2020, provided companies additional time, allowing them to make necessary changes to their business practices in order to comply with the regulation.<\/a>[162]<\/a><\/sup> The law itself provides that an individual consumer may institute a civil action for statutory damages between $100\u2013$750 per incident.[163]<\/a><\/sup> Additionally, violations of the statute are enforceable by the California Attorney General with fines up to $7,500 per incident.[164]<\/a><\/sup> While the statute does not define \u201cincident,\u201d it does provide the criteria allowing a consumer to institute a civil action:<\/p>\n

Any consumer whose nonencrypted and nonredacted personal information .\u00a0.\u00a0. is subject to unauthorized access and exfiltration, theft, or disclosure as a result of the business\u2019s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action.\u00a0.\u00a0.\u00a0.[165]<\/a><\/sup><\/p>\n

The California Attorney General has issued multiple rounds of proposed modifications to the CCPA.[166]<\/a><\/sup> These proposed modifications changed, and changed again the requirements of businesses not collecting information from consumers,[167]<\/a><\/sup> and left some questions unanswered, but what seems clear is that the California Attorney General will have limited resources with which to enforce the CCPA\u2019s mandates. Some commenters have predicted that initial enforcement efforts will likely be aimed at larger business collecting vast amounts of personal information as opposed to small and medium sized businesses.[168]<\/a><\/sup><\/p>\n

<\/a> The California Privacy Rights Act of 2020 (CPRA)<\/p>\n

The CPRA, a California ballot measure which passed in November 2020, makes several important changes to the CCPA.[169]<\/a><\/sup> Effective January 1, 2023,[170]<\/a><\/sup> the CPRA changes the statutory definition of \u201cpersonal information,\u201d[171]<\/a><\/sup> provides a definition for an entirely new term, \u201c[s]ensitive personal information,\u201d[172]<\/a><\/sup> and imposes obligations on businesses which \u201cshare\u201d consumers\u2019 personal information,[173]<\/a><\/sup> among other amendments to the CCPA.<\/p>\n

Again though, the statute provides that \u201csharing\u201d does not include the transfer of a consumer\u2019s information \u201cas an asset that is part of a merger, acquisition.\u00a0.\u00a0.\u201d consistent with the carveout to the statutory definition of \u201csale.\u201d The carveouts remaining unchanged, coupled with the revised definitions of \u201cpersonal information,\u201d indicate that a similar outcome to the hypothetical scenario considered here will likely result after the bill\u2019s effective date. Notably, the statutes\u2019 definition of \u201ccollects\u201d is unchanged by the CPRA.[174]<\/a><\/sup><\/p>\n

The statute makes several other noteworthy changes. One particularly relevant change is the creation of the California Privacy Protection Agency (the Agency).[175]<\/a><\/sup> The Agency is tasked with implementing and enforcing the CCPA\u2019s obligations.[176]<\/a><\/sup> Broadly, the Agency is charged with \u201cprotect[ing] the fundamental privacy rights of natural persons with respect to the use of their personal information,\u201d[177]<\/a><\/sup> and \u201cseek[ing] to balance the goals of strengthening consumer privacy while giving attention to the impact on businesses.\u201d[178]<\/a><\/sup><\/p>\n

<\/a> Conclusion<\/p>\n

As noted earlier, this paper explores the implications presented under a very specific scenario and against a backdrop of federal law that deals with specific types of information sector by sector, industry by industry. With this backdrop in mind, the California legislature passed one of the most\u2014if not the <\/em>most\u2014robust privacy laws in the United States. As described, the law creates a number of rights for California residents and a number of obligations on businesses doing business in California and collecting consumers\u2019 personal information.<\/p>\n

The specific scenario envisioned in this note was intended to illustrate the difficulties of crafting a far-reaching privacy law like the CCPA, by demonstrating at least one example where the law is not truly capable of adequately dealing with current business practices. While the CCPA\u2019s broadly drafted language brings the conduct of the hypothetical AI startup within its reach, it also provides for the release of our hypothetical company from its grasp. These problems further counsel that a federal omnibus privacy law is needed. The sectoral and state-by-state patchwork of digital privacy laws creates a tangled web of legislation in which businesses increasingly find themselves caught up. The CCPA, with its progressive approach to creating a more consumer-friendly environment for web users, may be a model, but certainly should not be the standard for an omnibus federal privacy law.<\/p>\n

    \n
  1. * J.D. Candidate, University of Colorado Law School \u2191<\/a><\/li>\n
  2. . See<\/em> Nick Heath, What is machine learning? Everything you need to know<\/em>, ZDNet (Dec. 16, 2020, 11:21 AM), https:\/\/www.zdnet.com\/article\/what-is-machine-learning-everything-you-need-to-know\/ [https:\/\/perma.cc\/6CPF-4BGG] (describing the various ways training data is incorporated into ML algorithms to predict outcomes). \u2191<\/a><\/li>\n
  3. . Ajay Agrawal et al., Prediction Machines: The Simple Economics of Artificial Intelligence 24 (2018) (explaining the development of prediction machines as a category of machine learning algorithms). \u2191<\/a><\/li>\n
  4. . See generally <\/em>A.L. Samuel, Some Studies in Machine Learning Using the Game of Checkers<\/em>, 3 IBM J. Res. & Dev. 210 (1959) (describing the rote-learning process whereby the model is more easily able to recall the information the more the model encounters it or repeats it). \u2191<\/a><\/li>\n
  5. . Donald Michie, \u201cMemo\u201d Functions and Machine Learning<\/em>, 218 Nature 19, 19 (1968) (referencing the early efforts of A.L. Samuel to create an AI algorithm that could not only play but beat the human playing against the machine). \u2191<\/a><\/li>\n
  6. . See <\/em>Samuel, supra <\/em>note 3, at 208\u201318 (describing the operations of A.L. Samuel\u2019s checkers-playing model which is largely credited as the first functioning ML model able to improve itself and function more efficiently). \u2191<\/a><\/li>\n
  7. . Id.<\/em> at 221. \u2191<\/a><\/li>\n
  8. . Agrawal et al., supra <\/em>note 2, at 1. \u2191<\/a><\/li>\n
  9. . Rachel Wilka et al., How Machines Learn: Where Do Companies Get Data for Machine Learning and What Licenses Do They Need?<\/em>, 13 Wash. J. L. Tech. & Arts 217, 220 (2018). \u2191<\/a><\/li>\n
  10. . See<\/em> Ashish Datta, How Small Businesses Can Integrate Machine Learning Into Their Model<\/em>, Forbes (Dec. 12, 2017, 9:00 AM), https:\/\/www.forbes.com\/sites\/theyec\/2017\/12\/12\/how-small-businesses-can-integrate-machine-learning-into-their-model\/#7904812ead61 [https:\/\/perma.cc\/XVE2-78GH] (describing what options exist for small and medium businesses wishing to integrate ML into their business models and evaluating what benefits ML has historically brought to ventures of these sizes). \u2191<\/a><\/li>\n
  11. . See <\/em>Janakiram MSV, The Rise Of Artificial Intelligence As A Service In The Public Cloud<\/em>, Forbes (Feb. 22, 2018, 10:13 AM), https:\/\/www.forbes.com\/sites\/janakirammsv\/2018\/02\/22\/the-rise-of-artificial-intelligence-as-a-service-in-the-public-cloud\/#11302580198e [https:\/\/perma.cc\/7MEY-6HKM] (detailing the predominant cloud platforms and their AI-as-a-Service offerings). \u2191<\/a><\/li>\n
  12. . See<\/em> Louis Columbus, Roundup Of Machine Learning Forecasts And Market Estimates, 2018<\/em>, Forbes (Feb. 18, 2018, 7:00 PM), https:\/\/www.forbes.com\/sites\/louiscolumbus\/2018\/02\/18\/roundup-of-machine-learning-forecasts-and-market-estimates-2018\/#4eb8a15a2225 [https:\/\/perma.cc\/58DX-K8NK] (analyzing market forecasts for growth of AI sector of technology markets) [hereinafter 2018 Forecasts & Estimates<\/em>]. \u2191<\/a><\/li>\n
  13. . See <\/em>Louis Columbus, Roundup Of Machine Learning Forecasts And Market Estimates, 2020<\/em>, Forbes (Jan. 19, 2020, 2:22 PM), https:\/\/www.forbes.com\/sites\/louiscolumbus\/2020\/01\/19\/roundup-of-machine-learning-forecasts-and-market-estimates-2020\/?sh=8d24cd15c020 [https:\/\/perma.cc\/5DSD-2SU3] (providing analysis on the ML market and global trends in 2020). \u2191<\/a><\/li>\n
  14. . Cloud AutoML<\/em>, Google Cloud, https:\/\/cloud.google.com\/automl [https:\/\/perma.cc\/RL9V-EYGN]. \u2191<\/a><\/li>\n
  15. . See<\/em> Datta, supra <\/em>note 9 (describing the way small businesses can capitalize on ML using their own data). \u2191<\/a><\/li>\n
  16. . Cf.<\/em> id.<\/em> (comparing scenarios in which a credit card company would examine for fraudulent activity using manual methods and ML); Jungwoo Ryoo, How Do Companies Know When Someone Else is Using Your Credit Card?<\/em>, Slate (Nov. 22, 2017, 11:48 AM), https:\/\/slate.com\/technology\/2017\/11\/how-companies-can-tell-when-someone-else-is-using-your-credit-card.html [https:\/\/perma.cc\/6LVL-NKPJ] (examining the modern practice of using ML algorithms to detect credit card fraud). \u2191<\/a><\/li>\n
  17. . Ryoo, supra <\/em>note 15. \u2191<\/a><\/li>\n
  18. . Id<\/em>. \u2191<\/a><\/li>\n
  19. . See<\/em> Datta, supra <\/em>note 9. \u2191<\/a><\/li>\n
  20. . See<\/em> Theophano Mitsa, How Do You Know You Have Enough Training Data?<\/em>, Towards Data Sci. (Apr. 22, 2019), https:\/\/towardsdatascience.com\/how-do-you-know-you-have-enough-training-data-ad9b1fd679ee [https:\/\/perma.cc\/EZ99-EMTP] (explaining data input formulas that require vast amounts of data to be effective). \u2191<\/a><\/li>\n
  21. . Daniel Newman, Why AI As A Service Will Take Off In 2020<\/em>, Forbes (Jan. 7, 2020, 1:06 PM), https:\/\/www.forbes.com\/sites\/danielnewman\/2020\/01\/07\/why-ai-as-a-service-will-take-off-in-2020\/#6672c3c33669 [https:\/\/perma.cc\/2D8S-2RR9]. \u2191<\/a><\/li>\n
  22. . Id<\/em>. \u2191<\/a><\/li>\n
  23. . Id<\/em>. \u2191<\/a><\/li>\n
  24. . Brian Higgins, When It\u2019s Your Data But Another\u2019s Stack, Who Owns The Trained AI Model?<\/em>, News and Analysis of AI Tech. & L. (Jan. 31, 2018), http:\/\/aitechnologylaw.com\/2018\/01\/who-owns-cloud-trained-ai-model\/ [https:\/\/perma.cc\/LU9T-93PS]. \u2191<\/a><\/li>\n
  25. . Sam Daley, 10 Publicly Traded Companies Innovating With AI<\/em>, Built In (Dec. 4, 2018), https:\/\/builtin.com\/artificial-intelligence\/publicly-traded-ai-companies [https:\/\/perma.cc\/29DS-KHUL]. \u2191<\/a><\/li>\n
  26. . See <\/em>Associated Press v. Meltwater U.S. Holdings, Inc., 931 F. Supp. 2d. 537, 544 (S.D.N.Y. 2013) (describing how \u201cweb crawler\u201d applications function. These bots are capable of scanning millions of web pages daily and are limited primarily by the protocols of the servers of the websites the bots are programmed to scan. If the websites observe that the bots do not honor the protocols established by the websites, the bots can be denied from accessing the sites. To be clear, there is much practical use for \u201ccrawling\u201d by bots\u2014this is primarily the way search engines like Google rank pages and return relevant search results for their users). \u2191<\/a><\/li>\n
  27. . Erika McCallister et al., Nat\u2019l Inst. of Standards & Tech., U.S. Dep\u2019t of Commerce, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) 4\u20135 (Apr. 2010) (recommending that businesses seek to purposefully limit the amount and extent of PII they collect from consumers as well as de-identifying or anonymizing the PII contained in data sets and limiting the access to the data sets). \u2191<\/a><\/li>\n
  28. . See<\/em> Id<\/em>. at 2\u20133 (suggesting that the OECD\u2019s Fair Information Practices have been adopted by the U.S. Department of Commerce and have also been used to inform both U.S. federal laws as well as international legislation, namely the European Union\u2019s General Data Protection Regulation). \u2191<\/a><\/li>\n
  29. . Brad Janssen, Matthew Knouff, & Rani Habash, Data privacy and security issues in M&A transactions: Part one<\/em>, iapp (Apr. 26, 2016), https:\/\/iapp.org\/news\/a\/data-privacy-and-security-issues-in-ma-transactions-part-one\/ [https:\/\/perma.cc\/2ATR-BPLK]. See also<\/em> 2018 Forecasts & Estimates<\/em>, supra <\/em>note 11 (\u201cMachine learning\u2019s potential impact across many of the world\u2019s most data-prolific industries continues to fuel venture capital investment, private equity (PE) funding, mergers, and acquisitions all focused on winning the race of Intellectual Property (IP) and patents in this field.\u201d). \u2191<\/a><\/li>\n
  30. . See<\/em> 2018 Forecasts & Estimates<\/em>, supra <\/em>note 11. \u2191<\/a><\/li>\n
  31. . Cal. Civ. Code \u00a7 1798.198 (West, Westlaw through Ch. 9 of 2021 Reg.Sess.). \u2191<\/a><\/li>\n
  32. . See <\/em>Eric Goldman, An Introduction to the California Consumer Privacy Act (CCPA)<\/em>, IAPP 1 (July 9, 2018), https:\/\/iapp.org\/media\/pdf\/resource_center\/Intro_to_CCPA.pdf [https:\/\/perma.cc\/VQ3F-V475]. \u2191<\/a><\/li>\n
  33. . Id<\/em>. at 2; Cf.<\/em> David Zetoony, California Consumer Privacy Act (CCPA) Practical Guide<\/em>, Bryan Cave Leighton Paisner 1\u20132 (Feb. 2020), https:\/\/ccpa-info.com\/wp-content\/uploads\/2019\/09\/bclp-practical-guide-to-the-ccpa.pdf [https:\/\/perma.cc\/W88A-CWWF] [hereinafter Zetoony, CCPA Practical Guide<\/em>]. \u2191<\/a><\/li>\n
  34. . California Amendment to Privacy Law Official<\/em>, Bryan Cave Leighton Paisner (Sept. 26, 2018), https:\/\/www.bclplaw.com\/en-US\/thought-leadership\/california-amendment-to-privacy-law-official-the-definitive.html [https:\/\/perma.cc\/NT3B-THY4]. \u2191<\/a><\/li>\n
  35. . Zetoony, CCPA Practical <\/em>Guide, supra <\/em>note 32, at 2. \u2191<\/a><\/li>\n
  36. . What You Need to Know About the New General Data Protection Regulation (GDPR)<\/em>, Bryan Cave Leighton Paisner (Feb. 17, 2016), https:\/\/www.bclplaw.com\/en-US\/thought-leadership\/what-you-need-to-know-about-the-new-general-data-protection.html [https:\/\/perma.cc\/RBN6-22VG]. \u2191<\/a><\/li>\n
  37. . Id.<\/em>; Cal. Civ. Code \u00a7 1798.145 (West, Westlaw through Ch. 9 of 2021 Reg. Sess.) (describing the exemptions granted to businesses and individuals attempting to comply with California Consumer Protection laws). \u2191<\/a><\/li>\n
  38. . Cf.<\/em> What You Need to Know About the New GDPR<\/em>, supra <\/em>note 35 (noting that the GDPR applies to \u201ccompanies doing business in the EU\u201d); Cal. Civ. Code \u00a7 1798.145 (Westlaw). \u2191<\/a><\/li>\n
  39. . Cf. <\/em>Zetoony, CCPA Practical <\/em>Guide, supra <\/em>note 34; Cal. Civ. Code \u00a7 1798.100 (Westlaw) (observing obligations which apply to \u201cbusinesses that collect personal information\u201d). \u2191<\/a><\/li>\n
  40. . Assemb. B. 375 \u00a7 2(i), 2017\u20132018 Leg., Reg. Sess. (Cal. 2017). \u2191<\/a><\/li>\n
  41. . Max N. Helveston, Reining in Commercial Exploitation of Consumer Data<\/em>, 123 Penn. St. L. Rev. 667, 690 (2019). \u2191<\/a><\/li>\n
  42. . Id<\/em>.; Cal. Civ. Code \u00a7 1798.140 (Westlaw). \u2191<\/a><\/li>\n
  43. . Cal. Civ. Code \u00a7 1798.140(c)(1) (Westlaw); Goldman, supra <\/em>note 31, at 2. \u2191<\/a><\/li>\n
  44. . See <\/em>Jane K. Winn, Can a Duty of Information Security Become Special Protection for Sensitive Data under US Law?<\/em> (Sept. 9, 2008), https:\/\/papers.ssrn.com\/sol3\/papers.cfm?abstract_id=1265775 [https:\/\/perma.cc\/3BGC-6H47] (describing the \u201cpatchwork\u201d of U.S. privacy laws). \u2191<\/a><\/li>\n
  45. . Goldman, supra <\/em>note 31, at 2. \u2191<\/a><\/li>\n
  46. . Cal. Civ. Code \u00a7 1798.140(c)(1)(B) (Westlaw) (doing business in the state of California is one of the potential qualifiers in (c)(1), but not the only one so a \u201cbusiness\u201d under the CCPA could do business in another state yet still collect the personal information from at least 50,000 California consumers in a year); see also <\/em>Zetoony, CCPA Practical Guide<\/em>, supra<\/em> note 34, at 3. \u2191<\/a><\/li>\n
  47. . Cal. Civ. Code \u00a71798.140(c)(1)(B) (amended 2020); see also <\/em>\u00a7 1798.140(c)(1)(B) (Westlaw) (effective Jan. 1, 2023). \u2191<\/a><\/li>\n
  48. . Cal. Civ. Code \u00a7 1798.140(c)(1)(A) (Westlaw). \u2191<\/a><\/li>\n
  49. . Id.<\/em> \u00a7 1798.140(c)(1)(C) (Westlaw) (This definition is amended by the CPRA which takes effect Jan. 1, 2023). \u2191<\/a><\/li>\n
  50. . Cal. Civ. Code \u00a7 1798.145(c)(1), (d)(2), (d)(3)(e) (Westlaw); Zetoony, CCPA Practical Guide<\/em>, supra<\/em> note 34, at 3. \u2191<\/a><\/li>\n
  51. . Cal. Civ. Code \u00a7 1798.140(g) (Westlaw) (The CCPA\u2019s definition of consumer makes direct reference to California Code of Regulations which already contains a definition of \u201cresident.\u201d See<\/em> 18 Cal. Code Regs. \u00a7 17014 (2020). \u2191<\/a><\/li>\n
  52. . 18 C.C.R. \u00a7 17014. \u2191<\/a><\/li>\n
  53. . Cal. Civ. Code \u00a7 1798.140(g) (Westlaw). \u2191<\/a><\/li>\n
  54. . Council Directive 2016\/679, art. 3, 2016 O.J. (L 119) 33. \u2191<\/a><\/li>\n
  55. . Zetoony, CCPA Practical Guide<\/em>, supra<\/em> note 34, at 3\u20134. \u2191<\/a><\/li>\n
  56. . Cal. Civ. Code \u00a7 1798.140(o)(1) (Westlaw). \u2191<\/a><\/li>\n
  57. . Id.<\/em> \u00a7 1798.140(o)(1)(A),(F),(H) (Westlaw). \u2191<\/a><\/li>\n
  58. . Id.<\/em> \u00a7 1798.145(a)(5) (Westlaw). \u2191<\/a><\/li>\n
  59. . Id.<\/em> \u00a7 1798.140(a) (Westlaw). \u2191<\/a><\/li>\n
  60. . Id.<\/em> \u00a7 1798.140(h)(1)\u2013(3) (Westlaw). \u2191<\/a><\/li>\n
  61. . See<\/em> Goldman, supra <\/em>note 31, at 3 (describing the broad and overly inclusive definitions of \u201cconsumer information\u201d and the statutes\u2019 lack of a cohesive framework for determining what information is included or excluded from the definition). \u2191<\/a><\/li>\n
  62. . Id<\/em>. at 4. \u2191<\/a><\/li>\n
  63. . Cal. Civ. Code \u00a7 1798.140(o)(1)(K)(2) (Westlaw). \u2191<\/a><\/li>\n
  64. . Id. <\/em>(emphasis added). \u2191<\/a><\/li>\n
  65. . Id.<\/em> \u00a7 1798.100(a) (Westlaw). \u2191<\/a><\/li>\n
  66. . Id.<\/em> \u00a7 1798.105(a) (Westlaw). \u2191<\/a><\/li>\n
  67. . Id.<\/em> \u00a7 1798.120(a) (Westlaw). \u2191<\/a><\/li>\n
  68. . Id.<\/em> \u00a7 1798.125(a)(1) (Westlaw). \u2191<\/a><\/li>\n
  69. . Id.<\/em> \u00a7 1798.105(d)(1)\u2013(9) (Westlaw). \u2191<\/a><\/li>\n
  70. . See<\/em> id<\/em>. \u2191<\/a><\/li>\n
  71. . Id.<\/em> \u00a7 1798.105(d)(9) (Westlaw). \u2191<\/a><\/li>\n
  72. . Id.<\/em> \u00a7 1798.140(f) (Westlaw) (emphasis added). \u2191<\/a><\/li>\n
  73. . It is not difficult to imagine the vast number of scenarios which would bring a business, online or otherwise, within the reach of the CCPA, given its definition of \u201ccollecting\u201d personal information. To name a few of the most common from personal experience\u2014registering a profile for a site or platform, downloading a whitepaper, entering a contest or sweepstakes, purchasing goods, downloading an app, etc. \u2191<\/a><\/li>\n
  74. . See<\/em> Assemb. B. 375 \u00a7 2(a)\u2013(i), 2017\u20132018 Leg., Reg. Sess. (Cal. 2017). As discussed later, the text of the CCPA indicates that the law primarily targets websites directly interacting with consumers and collecting consumer information which consumers provide, and at the third parties with which the collecting websites transact. \u2191<\/a><\/li>\n
  75. . All three of these presumably have income great enough to be included within the scope of the CCPA. In addition, they each collect \u201cpersonal information\u201d about their users\u2014some perhaps more than others. \u2191<\/a><\/li>\n
  76. . Cal. Civ. Code \u00a7 1798.175 (Westlaw). \u2191<\/a><\/li>\n
  77. . Id. <\/em>\u00a7 1798.100(a) (Westlaw). This is the first statutory right listed by the CCPA and seeks most pointedly to accomplish the goal of providing Californians with more information about how their state constitutional right to privacy may be affected by their sharing of personal information with whom businesses the consumer engages. \u2191<\/a><\/li>\n
  78. . Stuart D. Levi, California Consumer Privacy Act: A Compliance Guide,<\/em> Skadden, Arps, Slate, Meagher & Flom LLP 13\u201322 (Mar. 20, 2019), https:\/\/www.skadden.com\/insights\/publications\/2019\/03\/california-consumer-privacy-act [https:\/\/perma.cc\/W8HK-Y7B9]. \u2191<\/a><\/li>\n
  79. . Cal. Civ. Code \u00a7 1798.130(a)(1)(A) (Westlaw). \u2191<\/a><\/li>\n
  80. . Id.<\/em> \u2191<\/a><\/li>\n
  81. . Id.<\/em> \u00a7 1798.135(a)(1) (Westlaw). \u2191<\/a><\/li>\n
  82. . See<\/em> Assemb. B. 375 \u00a7 2(a)\u2013(i), 2017\u20132018 Leg., Reg. Sess. (Ca. 2017) (Notably recital (d) which reads as follows: \u201cAs the role of technology and data in the everyday [sic] lives of consumers increases, there is an increase in the amount of personal information shared by consumers with businesses<\/em>. California law has not kept pace with these developments and the personal privacy implications surrounding the collection, use, and protection of personal information.\u201d (Emphasis added)). \u2191<\/a><\/li>\n
  83. . See<\/em> Cal. Civ. Code \u00a7 1798.135(a)(1) (Westlaw). \u2191<\/a><\/li>\n
  84. . The definition of \u201cbusiness\u201d is defined to include the conduct and uses the businesses engage in regarding \u201cpersonal information.\u201d It provides in part, a business is \u201ca legal entity .\u00a0.\u00a0. that collects consumers\u2019 personal information\u00a0or on the behalf of which\u00a0that\u00a0information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers\u2019 personal information.\u201d Id. <\/em>\u00a7 1798.140(c)(1) (Westlaw). \u2191<\/a><\/li>\n
  85. . Id.<\/em> \u00a7\u00a7 1798.135, 1798.140 (Westlaw). \u2191<\/a><\/li>\n
  86. . Id. <\/em>\u00a7 1798.140(e) (Westlaw) (emphasis added). \u2191<\/a><\/li>\n
  87. . Scraping is not a new practice and the market for data from online sources was reported to have been in the hundreds of millions of dollars as far back as 2009. See<\/em> Julian Angwin & Steve Stecklow, \u2018Scrapers\u2019 Dig Deep for Data on Web<\/em>, Wall St. J. (Oct. 12, 2010, 12:01 AM), https:\/\/www.wsj.com\/articles\/SB10001424052748703358504575544381288117888 [https:\/\/perma.cc\/2YL6-LGA6]. \u2191<\/a><\/li>\n
  88. . How Search organizes information<\/em>, Google, https:\/\/www.google.com\/search\/howsearchworks\/crawling-indexing\/ [https:\/\/perma.cc\/N35M-5QWT]. \u2191<\/a><\/li>\n
  89. . See<\/em> Search Engine Optimization (SEO) Starter Guide<\/em>, Google, https:\/\/support.google.com\/webmasters\/answer\/7451184?hl=en [https:\/\/perma.cc\/U3MH-K8BM]. \u2191<\/a><\/li>\n
  90. . TJ McCue, SEO Industry Approaching $80 Billion But All You Want Is More Web Traffic<\/em>, Forbes (July 30, 2018, 3:41 AM), https:\/\/www.forbes.com\/sites\/tjmccue\/2018\/07\/30\/seo-industry-approaching-80-billion-but-all-you-want-is-more-web-traffic\/#4dc38daa7337 [https:\/\/perma.cc\/J367-CEHT]. \u2191<\/a><\/li>\n
  91. . How Search organizes information<\/em>, supra<\/em> note 87. \u2191<\/a><\/li>\n
  92. . Search algorithms: How Search algorithms work<\/em>, Google, https:\/\/www.google.com\/search\/howsearchworks\/algorithms\/ [https:\/\/perma.cc\/2LKL-FNKP]. \u2191<\/a><\/li>\n
  93. . Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1544, 1546 (2016). (\u201cSpokeo conducts a computerized search in a wide variety of databases and provides information about the subject of the search.\u201d \u201cSpokeo markets its services to a variety of users, including not only \u2018employers who want to evaluate prospective employees,\u2019 but also \u2018those who want to investigate prospective romantic partners or seek other personal information.\u2019\u201d). \u2191<\/a><\/li>\n
  94. . Id. <\/em>at 1546. \u2191<\/a><\/li>\n
  95. . Id<\/em>. \u2191<\/a><\/li>\n
  96. . Id<\/em>. at 1547\u201348. \u2191<\/a><\/li>\n
  97. . Id<\/em>. at 1545\u201346. \u2191<\/a><\/li>\n
  98. . Id.<\/em> at 1544. \u2191<\/a><\/li>\n
  99. . Associated Press v. Meltwater U.S. Holdings, Inc.<\/em>, 931 F. Supp. 2d 537, 541\u201342 (S.D.N.Y. 2013). \u2191<\/a><\/li>\n
  100. . Id.<\/em> at 541. \u2191<\/a><\/li>\n
  101. . Id<\/em>. at 543. \u2191<\/a><\/li>\n
  102. . Id<\/em>. at 542. \u2191<\/a><\/li>\n
  103. . Id<\/em>. at 550. \u2191<\/a><\/li>\n
  104. . See id<\/em>. at 557\u201361. \u2191<\/a><\/li>\n
  105. . Id<\/em>. at 550. \u2191<\/a><\/li>\n
  106. . Id<\/em>. (\u201cThe fair use doctrine, although of common law origin, has been codified at 17 U.S.C. \u00a7 107. This section provides that \u2018[n]otwithstanding the provisions of sections 106 and 106A, the fair use of a copyrighted work \u2026 for purposes such as criticism, comment, news reporting, teaching \u2026 scholarship, or research, is not an infringement of copyright.\u2019\u201d). \u2191<\/a><\/li>\n
  107. . Id<\/em>. at 551. \u2191<\/a><\/li>\n
  108. . See id.<\/em> \u2191<\/a><\/li>\n
  109. . Id<\/em>. at 552\u201353. \u2191<\/a><\/li>\n
  110. . hiQ Labs v. LinkedIn Corp., 938 F.3d 985, 992 (9th Cir. 2019). Initially, LinkedIn sent hiQ a cease-and-desist letter demanding hiQ discontinue its practice of scraping the public facing pages hosted by LinkedIn. hiQ then filed suit against LinkedIn and sought a preliminary injunctive order preventing LinkedIn from stopping hiQ\u2019s activity. \u2191<\/a><\/li>\n
  111. . Id<\/em>. at 993. \u2191<\/a><\/li>\n
  112. . Id<\/em>. at 992\u201393. \u2191<\/a><\/li>\n
  113. . Id<\/em>. at 993 (citing Doe v. Kelly, 878 F.3d 710, 713 (9th Cir. 2017)). \u2191<\/a><\/li>\n
  114. . Id.<\/em> at 1003 (analyzing the meaning of \u201cwithout authorization\u201d in the context of the CFAA, 18 U.S.C. \u00a7 1030(a)(2) (1986)). \u2191<\/a><\/li>\n
  115. . Id.<\/em> at 1003\u201304. \u2191<\/a><\/li>\n
  116. . Id.<\/em> at 1003. \u2191<\/a><\/li>\n
  117. . Id.<\/em> at 1005. \u2191<\/a><\/li>\n
  118. . Id. <\/em>at 1005.<\/em> \u2191<\/a><\/li>\n
  119. . See<\/em> United States v. Nosal, 844 F.3d 1024, 1035\u201337 (9th Cir. 2016). \u2191<\/a><\/li>\n
  120. . See<\/em> Facebook v. Power Ventures, Inc., 844 F.3d 1058, 1062 (9th Cir. 2016). \u2191<\/a><\/li>\n
  121. . Id<\/em>. \u2191<\/a><\/li>\n
  122. . Id<\/em>. at 1063. \u2191<\/a><\/li>\n
  123. . Id<\/em>. \u2191<\/a><\/li>\n
  124. . hiQ Labs v. LinkedIn Corp., 938 F.3d 985, 1002 (9th Cir. 2019). \u2191<\/a><\/li>\n
  125. . Id<\/em>. \u2191<\/a><\/li>\n
  126. . Camille Fischer & Andrew Crocker, Victory! Ruling in hiQ v. Linkedin Protects Scraping of Public Data<\/em>, Elec. Frontier Found. (Sept. 10, 2019), https:\/\/www.eff.org\/deeplinks\/2019\/09\/victory-ruling-hiq-v-linkedin-protects-scraping-public-data [https:\/\/perma.cc\/4AVN-5249]. \u2191<\/a><\/li>\n
  127. . hiQ Labs<\/em>, 938 F.3d at 995 (Explaining the purview of the court\u2019s review, \u201c[a]s usual, we consider only the claims and defenses that the parties press on appeal. We recognize that the companies have invoked additional claims and defenses in the district court, and we express no opinion as to whether any of those claims or defenses might ultimately prove meritorious.\u201d). \u2191<\/a><\/li>\n
  128. . Id<\/em>. (Writing, \u201chiQ advanced several affirmative claims in support of its request for preliminary injunctive relief, here we consider only whether hiQ has raised serious questions on the merits of its claims either for intentional interference with contract or unfair competition, under California\u2019s Unfair Competition Law, Cal. Bus. & Prof. Code \u00a7 17200 et seq. <\/em>Likewise, while LinkedIn has asserted that it has \u2018claims under the Digital Millennium Copyright Act and under trespass and misappropriation doctrines,\u2019 it has chosen for present purposes to focus on a defense based on the CFAA, so that is the sole defense to hiQ\u2019s claims that we address here.\u201d). \u2191<\/a><\/li>\n
  129. . Petition for a Writ of Certiorari, LinkedIn Corp. v. hiQ Labs.<\/em>, No. 19-1116 (S. Ct. filed Mar. 9, 2020) (S. Ct. docket files) reh\u2019g denied<\/em>, No. 17\u201316783 (9th Cir. Nov. 8, 2019). \u2191<\/a><\/li>\n
  130. . Cal. Civ. Code \u00a7 1798.100(b) (West, Westlaw through Ch. 9 of 2021 Reg. Sess.). \u2191<\/a><\/li>\n
  131. . Id.<\/em> \u2191<\/a><\/li>\n
  132. . John Koetsier, How Google searches 30 trillion web pages, 100 billion times a month<\/em>, VentureBeat (Mar. 1, 2013, 12:43 PM), https:\/\/venturebeat.com\/2013\/03\/01\/how-google-searches-30-trillion-web-pages-100-billion-times-a-month\/ [https:\/\/perma.cc\/329E-SRRA]. \u2191<\/a><\/li>\n
  133. . Id.<\/em> \u2191<\/a><\/li>\n
  134. . How Search works: Overview: Organizing the content of the web<\/em>, Google, https:\/\/www.google.com\/search\/howsearchworks\/ [https:\/\/perma.cc\/QU36-JCC3] (describing the scope of Google\u2019s index, \u201c[t]he index is like a library, except it contains more info than all the world\u2019s libraries put together\u201d). \u2191<\/a><\/li>\n
  135. . Google<\/em>, Merriam-Webster, https:\/\/www.merriam-webster.com\/dictionary\/google?utm_campaign=sd&utm_medium=serp&utm_source=jsonld [https:\/\/perma.cc\/924F-RHRC]. \u2191<\/a><\/li>\n
  136. . Mehul Srivastava & Tim Bradshaw, Israeli group\u2019s spyware \u2018offers keys to Big Tech\u2019s cloud\u2019<\/em>, Fin. Times (July 18, 2019), https:\/\/www.ft.com\/content\/95b91412-a946-11e9-b6ee-3cdf3174eb89 [https:\/\/perma.cc\/DJW4-W25A]. \u2191<\/a><\/li>\n
  137. . Klint Finley, \u2018Scraper\u2019 Bots and the Secret Internet Arms Race<\/em>, WIRED (July 23, 2018, 7:00 AM), https:\/\/www.wired.com\/story\/scraper-bots-and-the-secret-internet-arms-race\/ [https:\/\/perma.cc\/JKY2-A9K6]. \u2191<\/a><\/li>\n
  138. . Id.<\/em> \u2191<\/a><\/li>\n
  139. . Id.<\/em> \u2191<\/a><\/li>\n
  140. . Cal. Civ. Code \u00a7 1798.99.80 (West, Westlaw through Ch. 9 of 2021 Reg. Sess.) defines data broker as \u201ca business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship\u201d; \u00a7 1798.99.82 requires data brokers to register with the California Attorney General. \u2191<\/a><\/li>\n
  141. . hiQ Labs v. LinkedIn Corp., 938 F.3d 985, 1005 (9th Cir. 2019). \u2191<\/a><\/li>\n
  142. . California Attorney General Issues Proposed CCPA Regulations<\/em>, JD Supra (Oct. 11, 2019), https:\/\/www.jdsupra.com\/legalnews\/california-attorney-general-issues-50572\/<\/a> [https:\/\/perma.cc\/926T-RMWC]. \u2191<\/a><\/li>\n
  143. . Cal. Code Regs. tit. 11 \u00a7 999.305(d) (2020). \u2191<\/a><\/li>\n
  144. . Cal. Code Regs. tit. 11 \u00a7 999.305(d) (2020) (emphasis added). \u2191<\/a><\/li>\n
  145. . Cal. Civ. Code \u00a7 1798.140(t)(2)(D) (Westlaw). \u2191<\/a><\/li>\n
  146. . See id.<\/em> \u2191<\/a><\/li>\n
  147. . Id.<\/em> \u2191<\/a><\/li>\n
  148. . Id.<\/em> \u2191<\/a><\/li>\n
  149. . Id.<\/em> \u2191<\/a><\/li>\n
  150. . Id.<\/em> \u2191<\/a><\/li>\n
  151. . Cal. Civ. Code \u00a7 1798.100(a) (Westlaw). \u2191<\/a><\/li>\n
  152. . Id.<\/em> (emphasis added). \u2191<\/a><\/li>\n
  153. . Cal. Civ. Code \u00a7 1798.140(t)(2)(D) (Westlaw). \u2191<\/a><\/li>\n
  154. . Id.<\/em> \u2191<\/a><\/li>\n
  155. . Cal. Civ. Code \u00a7 1798.105(d)(1)\u2013(9) (Westlaw). \u2191<\/a><\/li>\n
  156. . Id.<\/em> \u00a7\u00a7 1798.105(d)(7), 1798.105(d)(9) (Westlaw). \u2191<\/a><\/li>\n
  157. . See<\/em> Cal. Civ. Code \u00a7 1798.105(d) (Westlaw).<\/em> \u2191<\/a><\/li>\n
  158. . Tara N. Cho et al., New CCPA Changes\/Clarifications; Some Final, Some Contingent (2 Months to Go)<\/em>, Nat. L. Rev. (Oct. 24, 2019), https:\/\/www.natlawreview.com\/article\/new-ccpa-changesclarifications-some-final-some-contingent-2-months-to-go [https:\/\/perma.cc\/CV3G-NVEY]. \u2191<\/a><\/li>\n
  159. . See <\/em>Cal. Civ. Code \u00a7 1798.150(a)(1) (Westlaw). \u2191<\/a><\/li>\n
  160. . Id.<\/em> \u2191<\/a><\/li>\n
  161. . Cal. Civ. Code \u00a7 1798.82(i)(4) (Westlaw). \u2191<\/a><\/li>\n
  162. . John Stephens, California Consumer Privacy Act<\/em>, A.B.A. (Feb. 14, 2019), https:\/\/www.americanbar.org\/groups\/business_law\/publications\/committee_newsletters\/bcl\/2019\/201902\/fa_9\/ [https:\/\/perma.cc\/UP5T-UKXQ]. \u2191<\/a><\/li>\n
  163. . Cal. Civ. Code \u00a7 1798.150(a)(1)(A) (Westlaw). \u2191<\/a><\/li>\n
  164. . Stephens, supra <\/em>note 160. \u2191<\/a><\/li>\n
  165. . Cal. Civ. Code \u00a7 1798.150 (Westlaw). \u2191<\/a><\/li>\n
  166. . See<\/em> California Consumer Privacy Act, 41-Z Cal. Reg. Notice Reg. 1341 (Oct. 11, 2019). \u2191<\/a><\/li>\n
  167. . Id<\/em>. \u2191<\/a><\/li>\n
  168. . Allison Schiff, It May Seem All Quiet On The CCPA Front, But Don\u2019t Get Complacent: CCPA Enforcement Has Begun<\/em>, AdExchanger (Sept. 28, 2020, 12:35 AM), https:\/\/www.adexchanger.com\/privacy\/it-may-seem-all-quiet-on-the-ccpa-front-but-dont-get-complacent-ccpa-enforcement-has-begun\/ [https:\/\/perma.cc\/FSN8-MH22]. \u2191<\/a><\/li>\n
  169. . Brandon P. Reilly & Scott T. Lashway, The California Privacy Rights Act Has Passed: What\u2019s in It?<\/em>, manatt (Nov. 11, 2020), https:\/\/www.manatt.com\/insights\/newsletters\/client-alert\/the-california-privacy-rights-act-has-passed [https:\/\/perma.cc\/GE6U-DRD9]. \u2191<\/a><\/li>\n
  170. . 2020 Cal. Legis. Serv. Prop 24 (West). \u2191<\/a><\/li>\n
  171. . Cal. Civ. Code \u00a7 1798.140(v)(1)(L)(2) (West, Westlaw through Ch. 9 of 2021 Reg. Sess.) (effective Jan. 1, 2023) (amending the definition to include, \u201cinformation that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media, or by the consumer; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.\u201d). \u2191<\/a><\/li>\n
  172. . Id<\/em>. \u00a7 1798.140(ae) (Westlaw) (defining the term capaciously, the changes reflect the desire by California officials and the state\u2019s electorate to broaden privacy rights over time and to provide Californians with a privacy right styled in a more \u201cEuropean\u201d fashion). \u2191<\/a><\/li>\n
  173. . Id<\/em>. \u00a7 1798.100(d) (Westlaw); Id<\/em>. \u00a7 1798.140(ah) (Westlaw) (defining \u201csharing\u201d as \u201csharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer\u2019s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged\u201d). \u2191<\/a><\/li>\n
  174. . Compare id<\/em>. \u00a7 1798.140(e) (Westlaw) with<\/em> id<\/em>. \u00a7 1798.140(f) (Westlaw). \u2191<\/a><\/li>\n
  175. . Id<\/em>. \u00a7 1798.199.10 (Westlaw). \u2191<\/a><\/li>\n
  176. . Id<\/em>. \u00a7 1798.199.40(a) (Westlaw). \u2191<\/a><\/li>\n
  177. . Id<\/em>. \u00a7 1798.199.40(c) (Westlaw). \u2191<\/a><\/li>\n
  178. . Id<\/em>. \u00a7 1798.199.40(l) (Westlaw). \u2191<\/a><\/li>\n<\/ol>\n

     <\/p>\n","protected":false},"excerpt":{"rendered":"

    Personal Information and Artificial Intelligence:\u00a0Website Scraping and the California Consumer Privacy Act Brian Stuenkel[1]* Print Version: Personal Information and Artificial Intelligence- Website Scraping and the California Consumer Privacy Act This note presents a hypothetical in which an upstart technology firm scrapes public-facing webpages and websites, scooping up individuals\u2019 personal identifying information (PII) including names, addresses, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[13,9,8],"tags":[],"class_list":["post-840","post","type-post","status-publish","format-standard","hentry","category-13","category-printed","category-volume19"],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false,"portfolio_item-thumbnail":false,"portfolio_item-thumbnail@2x":false,"portfolio_item-masonry":false,"portfolio_item-masonry@2x":false,"portfolio_item-thumbnail_cinema":false,"portfolio_item-thumbnail_portrait":false,"portfolio_item-thumbnail_portrait@2x":false,"portfolio_item-thumbnail_square":false},"uagb_author_info":{"display_name":"Brian Stuenkel","author_link":""},"uagb_comment_info":0,"uagb_excerpt":"Personal Information and Artificial Intelligence:\u00a0Website Scraping and the California Consumer Privacy Act Brian Stuenkel[1]* Print Version: Personal Information and Artificial Intelligence- Website Scraping and the California Consumer Privacy Act This note presents a hypothetical in which an upstart technology firm scrapes public-facing webpages and websites, scooping up individuals\u2019 personal identifying information (PII) including names, addresses,…","featured_media_urls":[],"_links":{"self":[{"href":"https:\/\/ctlj.colorado.edu\/index.php?rest_route=\/wp\/v2\/posts\/840","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ctlj.colorado.edu\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ctlj.colorado.edu\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ctlj.colorado.edu\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ctlj.colorado.edu\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=840"}],"version-history":[{"count":2,"href":"https:\/\/ctlj.colorado.edu\/index.php?rest_route=\/wp\/v2\/posts\/840\/revisions"}],"predecessor-version":[{"id":854,"href":"https:\/\/ctlj.colorado.edu\/index.php?rest_route=\/wp\/v2\/posts\/840\/revisions\/854"}],"wp:attachment":[{"href":"https:\/\/ctlj.colorado.edu\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=840"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ctlj.colorado.edu\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=840"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ctlj.colorado.edu\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=840"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}