On November 5, 2026, Stauss PLLC founder David Stauss presented to the California Privacy Protection Agency (CalPrivacy) Board as part of the Board’s informational session on notices, disclosures, and privacy rights. Stauss was invited by CalPrivacy staff to present along with Dr. Lorrie Faith Cranor, Matthew Schwartz, and Dr. Jennifer King. The informational session is part of the Board’s two-day meeting in which it will consider initiating rulemaking on possible amendments to the California Consumer Privacy Act regulations. Stauss’ presentation is available here, and his prepared remarks are below.

. . . .

Prepared Remarks of David Stauss to the California Privacy Protection Agency Board at the Board’s November 5, 2026 Meeting

Good afternoon. My name is David Stauss. I am a privacy attorney who primarily works with businesses to comply with US state privacy laws. For nearly a decade, I’ve also worked with state lawmakers and regulators across the country in a non-partisan, non-compensated capacity helping draft state privacy and AI laws. In that capacity, I have tried to help policymakers write clearer, cleaner, and interoperable privacy laws for the benefit of both businesses and consumers.

I’d like to thank the CalPrivacy staff for inviting me to speak to you today. The CalPrivacy staff and this Board are unquestionably the leaders in the United States on data privacy regulation. It is an honor to have the opportunity to speak with you.

As requested, my talk today is focused on two topics – consumer notices and consumer requests. For each, I will first discuss pain points I have seen from the consumer and business perspective. I will also suggest some possible solutions. My goal is to give you a practitioner’s point of view of how these topics play out in the real world. My real goal is to not bore you to sleep.

Turning first to notices, there are many pain points for both consumers and businesses.

For businesses, perhaps the most significant pain point is the differing legal requirements that they face when drafting privacy notices. We’ve heard today about notices being long but we haven’t heard why.

In California alone, businesses may need to comply with the CCPA, the California Online Privacy Protection Act, California’s Shine the Light Law, and the California Erasure Law. Depending on the type and size of the business, additional disclosures may be necessary. For example, data brokers and entities that process the personal information of more than 10 million California residents have additional notice obligations, as do financial service entities.

Obviously, businesses also operate outside California. Although many stakeholders have worked hard to drive interoperability across state privacy laws, there still are differences. Colorado has its own set of rules that govern privacy notices. Connecticut, Louisiana, Minnesota, Oregon, Rhode Island, and Texas also have unique requirements.

There are also state-specific requirements for the collection of certain types of information such as biometric information, including the Illinois Biometric Information Privacy Act, health information, including Washington’s My Health My Data Act, and the information of children under 18 years of age, including the Arkansas Children and Teens’ Online Privacy Protection Act.

Altogether, depending on the type of information a business processes, by my count, there can be over 40 different state laws and regulations that businesses need to consider when drafting consumer notices.

Anecdotally, I was playing around with Claude last night and asked it: “If I printed all the US state privacy laws across all the different topics and stacked them, how high would that be?” It told me 2 to 2.5 feet. Unprompted, it also told me “So the privacy laws of the 50 U.S. states, piled together, produce about as much paper as the comprehensive privacy laws of 172 countries.”

But wait, there’s more. At the federal level, among other laws, HIPAA covered entities and GLBA financial institutions have unique notice requirements, and disclosures need to be made to satisfy TCPA requirements. For international companies, there are even more considerations, including the EU’s GDPR.

The end result is that even for businesses that have simple data processing activities, the length and complexity of privacy notices is daunting. For businesses with more complex data processing activities, the length and complexity of privacy notices only grows.

Pulling this together, at least in my experience, businesses are not writing lengthy and complicated privacy notices because of any improper motive. They are writing them because that’s what the law requires and because that’s what it takes to accurately state their processing activities. And they are spending tons of time and energy and expense to try to get it right.

If this all seems impossible to get right from a business perspective, I wonder what ordinary people think about it all. The reality is that they probably don’t think anything about it because they don’t read privacy notices. Think about that. The very audience these notices are supposed to serve doesn’t read them. If you were a business selling a product that your core buyer did not want to buy, you would go out of business. In the privacy world, we just keep creating more requirements.

So, what are some possible solutions?

I understand that there is some thought to creating template privacy policies for businesses to use. Listen, anything that can help streamline the drafting process is worthwhile. However, that still leaves consumers with a long document of text to read or, more likely, ignore.

Therefore, I respectfully recommend CalPrivacy look at other options to increase transparency and reduce friction.

My primary recommendation is that CalPrivacy revise Regulation 7011 – which is the regulation stating what privacy policies must include and how they need to be presented to consumers – to allow businesses more flexibility in how they present their privacy practices. This could include the use of short form summaries or alternative landing pages where businesses can use graphics and other explanatory tools to make their privacy practices more transparent to consumers.

Let me be clear. I do not think CalPrivacy would frown on these measures today, but in the compliance setting there is always a risk that the more you do, the more you expose yourself to regulatory scrutiny. And that has a chilling effect on innovation.

So, I would create a carrot and not a stick and credit businesses who take these extra steps by creating a safe harbor that says businesses will not be fined for using other transparency measures so long as their privacy policy otherwise complies with law. And, I would motivate these innovations by saying that in any enforcement action, CalPrivacy will positively take into account a business’s attempt to use alternative transparency measures.

To provide some real-world context to the points I’m trying to make, I collected six federal government privacy policies and asked Claude to tell me how many words they contain and how long it would take me to read them.

I chose federal government policies for three reasons. First, they are not subject to the CCPA or state consumer data privacy laws, so the notices should be shorter. Second, the processing activities should be limited and straightforward. Federal agencies should really not be engaging in heavy AdTech activities. Third, there’s no business reason not to be completely transparent.

Yet, even with those qualifications, these policies are still long. They range from about 1,700 words for the Social Security Administration to about 6,000 words for HealthCare.gov, which would take roughly 25 minutes to read. You could run a 5K or you could read that privacy notice.

For reference, when I work with clients to draft a privacy notice, I, like many of my peers, start with a template document. That document, which covers the CCPA and state privacy laws, is 7,000 words, or a 29-minute read. And that’s just the bare-bones legal requirements before we start digging into the actual processing activities.

So, again, the point of all this is that privacy policies are just difficult documents. They are long and dense even if you are just a federal agency.

So, how would my possible solutions make things easier for consumers?

As noted, one idea is to allow businesses to present high-level summaries. Here, I asked Claude to create a 250-word summary of the HealthCare.gov privacy policy. This high-level summary is about a one-minute read. That is a lot more reasonable than 25 minutes. Ultimately, the goal of this document is to give users a high-level preview and then provide links to find out more. I saw this in tomorrow’s materials as a staff recommendation, which was encouraging.

Taking it one step further, I asked Claude to take the HealthCare.gov privacy policy and turn it into a consumer-friendly landing page where users are provided with graphics, short summaries, and drill-down links. It created this colorful interactive page that allows users to quickly identify the topic they want to read more about.

Next, I asked Claude to add a prominent link to allow consumers to exercise their privacy rights, which it did at the top of the page. I will note that, coincidentally, last week the California Attorney General’s office announced a CCPA enforcement action that dealt, in part, with a business not having a prominent way for consumers to exercise their rights and instead having an opt-out buried in a privacy policy. This type of approach helps address those concerns.

Next, I asked Claude to address the case of a company that is required to have many different privacy policies that would apply in different situations. Here, after clicking the “privacy” website footer link, the user is directed to a page that shows the business’ online privacy policy, CCPA privacy policy, GDPR privacy policy, etc. And there are boxes explaining to the consumer when each document applies.

Finally, I asked Claude to create a privacy nutrition label for the HealthCare.gov privacy policy. This is similar to how Apple has a privacy nutrition label for apps, although different in substance and scope.

Pulling this all together, let me emphasize that the goal should not be to mandate one or more of these additional transparency measures. Instead, the goal should be to create an environment where businesses and privacy practitioners can innovate without fear of repercussion with the goal of improving transparency for the benefit of consumers and to credit businesses who are willing to spend the extra time and money to make their policies even more transparent.

Let me turn next to my least favorite topic in all of privacy law – cookie banners. I would argue that cookie banners are the single most prominent way that individuals feel and interact with privacy law on a daily basis. They are ubiquitous. I would also argue that they are universally hated.

To be clear, cookie banners are not required by the CCPA or any other state consumer data privacy law. There is much confusion on when they should be used and why. In my world, the primary reason for their use is to mitigate the risk of California Invasion of Privacy Act claims and other types of privacy litigation.

But cookie banners are a complete mess. This slide shows five cookie banners displayed to a California IP address from the websites of five fast-food companies.

Despite being from the same industry, no two banners are alike. They have different wording. They have different options – one offers a reject button, two offer an agree button, four offer a manage settings button, one just allows you to close the box. Two have “X” options. They also link to various documents, including privacy policies, privacy request webforms, California privacy policies, state privacy policies, and terms of service.

I have no idea how this benefits consumers. On the flip side, I can tell you that these banners are all the result of businesses working extremely hard to comply with the law, and likely paying people like me a lot of money to do so. The universal opt-out mechanism was supposed to solve for this, but it hasn’t. This is an area that is crying out for fixing. There’s a special place in heaven for the people who can fix this mess.

Let’s turn to consumer requests.

For consumers, the pain points I see can be summarized by simply saying “confusion.”

If you look at websites, there are many different types of privacy links with different names and sometimes overlapping purposes. Of course, there’s the privacy policy link but also links for collection notices, cookie preferences, cookie notice, Your Privacy Choices, Do Not Sell or Share My Personal Information, consumer health data privacy notices, and biometric privacy notices, among others.

There’s also no commonality in how to exercise privacy rights, in particular with respect to the structure of privacy request webforms.

And privacy rights also differ by state, leading to even more consumer confusion.

Businesses struggle with the same issues but also struggle with other issues.

For example, businesses struggle with knowing how exactly to respond to consumer requests, including what information to produce.

To try to put this into perspective, I wanted to show a couple of pages from my template manual for helping clients handle consumer requests. To explain, when a client comes to me and needs to figure out how to stand up a consumer request process, this is the document we start with. It provides instructions for accepting requests, processing them, and responding to them, including template responses.

This manual is just for handling US consumer privacy requests under consumer data privacy laws. It does not cover health data privacy laws. It does not cover federal laws. It also does not cover every exemption or exception. Nonetheless, this manual is 49 pages long. That’s long. The text of the entire CCPA on CalPrivacy’s website is 66 pages.

AI has only made things even more complicated. Consumers and authorized agents are using AI to make requests and complain about businesses’ responses to requests. I have spent hours writing responses that say things like “the law you cite does not exist” or “you can’t be a resident of 10 states at once” only to receive a lengthy, substantive, AI-generated reply less than five minutes later. We’ve even seen lengthy responses come back within three minutes of sending a response at 2 a.m.

Ultimately, even for the most seasoned businesses, there is a tremendous amount of effort that goes into operationalizing privacy rights.

This slide shows the different response timelines under various state laws. For requests to know, access, correct, or delete, California requires businesses to acknowledge the request within 10 days, and respond within 45 days, with a possible extension to 90 days if they give notice within the first 45 days. Appeals run on their own clocks: 45 days in some states, 60 in others, and Alabama, California, and Utah have no appeal right at all.

Opt-outs are different. California requires 15 business days. Colorado’s rule says without undue delay while its statute says 45 days. Most other states allow 45 days, and Iowa allows 90 days.

This is a comparison chart showing the differences in the rights provided by the various state consumer data privacy laws. The green boxes are states that provide that right. The yellow boxes are ones that provide the right with some qualification. The red boxes are the states that do not provide that right.

The color scheme is intended to show the wide variation across states just in the rights that they allow for.

So, what could CalPrivacy do?

My primary recommendation is to create a model consumer request webform. CalPrivacy could publish a standard form that any business could adopt: one place to exercise every right, plain-language descriptions, and built-in verification and timelines. And, like the notices proposals I talked about earlier, pair it with a safe harbor, so businesses that use it are treated as compliant on how requests are submitted. I saw in the meeting materials for tomorrow that this is one of the proposals, which is encouraging.

I also offer two related ideas.

First, define what a sufficient response looks like, with examples and template language, especially for requests for specific pieces of personal information.

Second, make clear that customer service issues, like updating a mailing address, can be handled as customer service without triggering CCPA timelines.

Finally, I wanted to end by making a broader request.

Put me out of business.

As a father of three children who I need to put through college, I say that jokingly, but the point is that our goal should be to make all of this easier for consumers and businesses. Clients should pay me for the hard stuff. Not drafting webforms and cookie pop-ups.

Moreover, while I’m here today talking about notices and requests, we could be talking about a host of different operational issues with privacy law.

So, I ask the Board to look beyond enforcement to education and guidance. Best practices, FAQs, and advisory opinions are powerful tools. They allow people in my position to drive compliance with businesses across a host of issues.

This is not imaginary. Foreign data protection authorities use these tools on a regular basis, including the United Kingdom’s Information Commissioner’s Office, which publishes incredibly helpful online FAQs both for businesses and consumers. I’m aware that a form of those exists on CalPrivacy’s website, but I encourage you to go further and see what other regulators have done.

I also encourage you to think about these issues the way that businesses think about these issues – namely, across state lines. I know that your charge is California, but you must recognize that you have an essential role in US privacy law generally.

Let me give you an example. European regulators have a body called the European Data Protection Board that is created by GDPR to bring a commonality of approach to applying GDPR in the various member states.

Think about that. GDPR is just one law and there is a body charged with making sure the various regulators apply it consistently.

In this country, we have dozens of different laws across states and no organization whose goal it is to find commonality and consistency in approach. That hurts consumers and businesses.

Fortunately, there already is a mechanism in place to accomplish this. Various state regulators, including CalPrivacy, participate in a State Privacy Consortium, which is focused on coordinating enforcement activity. The mission of that organization should be broadened to also provide guidance on common areas of law. The consortium also should leverage stakeholders like practitioners, policy advocates, and think tanks to be the engine for that guidance.

I will end by saying this – You will accomplish more for consumers and businesses alike if you lean into proactive guidance than you could ever accomplish through reactive enforcement.

Thank you for your time today. I’m happy to answer any questions.