Dear Reader,

We in Linux publishing have spent a lot of time holding Microsoft accountable for all the FUD and monkey business they have subjected us to through the years, so it is only fair to acknowledge them when they take a positive step. Microsoft has actually been doing better recently – I have written about Redmond's newfound support for Linux and their open sourcing of core development tools. This month the big news is the announcement that Microsoft will "honor California's new privacy rights throughout the United States."

A little over a year ago, the State of California passed the California Consumer Privacy Act (CCPA), which will take effect on January 1, 2020. The CCPA is a landmark bill that takes on the pertinent and perplexing issue of data privacy in the Internet age. The act establishes the following rights for residents of California:

• The right to know what personal information is collected, used, shared, or sold, both as to the categories and specific pieces of personal information;
• The right to delete personal information held by businesses and, by extension, a business's service provider;
• The right to opt-out of the sale of personal information. Consumers are able to direct a business that sells personal information to stop selling that information. Children under the age of 16 must provide opt-in consent, with a parent or guardian consenting for children under 13;
• The right to non-discrimination in terms of price or service when a consumer exercises a privacy right under CCPA.

The law could have big implications on how Internet companies capture and market user data. California is too big of a market for the big companies to ignore, so they will be forced to comply with it – at least for California residents. Companies that wish to restrict the new rules to only California viewers will need some way of sorting out who is or isn't from California and offering two different web pages for the California and non-California views, a layer of complication that could cause other companies to join Microsoft in simply applying the rules for everyone, but companies that are heavily dependent on selling data might find it difficult to give up the revenue.

According to Microsoft VP Julie Brill, "We are strong supporters of California's new law and the expansion of privacy protections in the United States that it represents. Our approach to privacy starts with the belief that privacy is a fundamental human right and includes our commitment to provide robust protection for every individual. This is why, in 2018, we were the first company to voluntarily extend the core data privacy rights included in the European Union's General Data Protection Regulation (GDPR) to customers around the world, not just to those in the EU who are covered by the regulation. Similarly, we will extend CCPA's core rights for people to control their data to all our customers in the U.S."

CCPA isn't perfect and doesn't solve all the problems related to data privacy. For instance, it only applies to large companies and companies that derive over half their revenue from selling consumer information. The companies that it does apply to are probably out there right now developing workarounds. Still, the CCPA is a significant step back in a world that has recently witnessed a continual march to fewer restrictions and more data mining.

At some level, everything that goes on in the business world is about business. This is all good press for Microsoft, but beyond the PR benefits, it is also an interesting chess move for a company that was left a little behind by the Internet giants. Google, Facebook, and other Internet titans are built from the ground up around the dubious endeavor of extracting value from their users' lives. Microsoft is a bit of a newcomer in this space. Anything Microsoft can do to shake up the market and force competitors out of their comfort zones is good for Microsoft – and also good for us in this case.

I have a feeling the last chapter in the story of the search for user privacy hasn't been written yet. The CCPA could prove unworkable, which will strengthen the hand of industry lobbyists, who will certainly be looking to dial up their game. A backlash could flash, which would require consumer advocates to really bear down to get what they want. And maybe, just maybe, in all the smoke and dust (full disclosure: I'm an optimist), the U.S. Congress will actually step up to their responsibilities and pass some meaningful privacy legislation at the national level.

In the meantime, I commend Microsoft for getting this one right.