As I'm sure has happened to a few others this week, the bits of AB 375 (The California Consumer Protection Act) that came into force this month blindsided me a bit. I've tried to wrap my brain around it... and, it's not working well.
Take, for example, a vendor that uses something like persistant card tokenization or a third-party financial API/broker, but never actually keeps any PII itself. It has been been granted permission via the broker who facilitates access to cards and banks for the purpose of, say, a bookkeeping application. But this information never is actually seen by the vendor, nor perhaps even by the broker. But the process itself allows/requires tokens to be authorized to and from third parties, i.e., to facilitate a transaction or transfer, which in so doing might require the providence of even more information (for example, a verified address for security). Yes these tokens and APIs effectively grant access to information that could be used for other, intrusive, purposes. It might even be surreptitiously aggregated by one or more parties (to determine creditworthiness, etc.). But would all parties really be culpable in this instance?
There certainly is a great deal of money changing hands, the broker almost certainly being paid by the initial vendor, who in turn may be interfacing with other "opaque" brokers who or may not have keep some giant database, or might (likewise) simply be "making introductions".
Having said that, on the one hand, the argument against rather smacks of those arguments the the credit bureaus in days of yore. The whole "we don't make this information; we don't judge; we simple collate the information we're given; our hands are clean" line. And, of course, the CCPA has an explicit carve out for CRAs (or so I've been led to believe). But for everyone else, the provisions for enumeration and deletion, with compliance mandated down the supply chain, almost seems dictate the creation of datastores where none would have otherwise existed otherwise, and possibly mandate Gramm Leach Bliley Act-level recordskeeping on all who wish to do business in California, even where records may not have even existed? Or am I getting the wrong impression, and is tokenization (and/or reliance on third parties and their APIs) seem sufficient to sidestep all this, as written?