Introduced as a bill, the CCA needs to define a core concept of a protected digital self that is not subject to presumptive communication/contact consent. This is the key that is missing, largely because our communication law is based on location-based communication, rather than post virtualization, internet communications. With communications endpoints strongly bound to people rather than places, the access to communication becomes an act of access to a person – and this typically requires consent. This is what the CCA accomplishes, and to do so it first needs a strong notion of a person in the communication space, the increasingly digital communication space. These are the X’s and Y’s in the technical architecture.
American law has a surprisingly poor track record with regards to defining what it is to be a person. Introducing the internet into this melange of embarrassing faux pas is unlikely to prove successful, so let us skirt the issue and define a person, in the sense of X and Y, as anything that can preserve an identity across multiple channels. This may include a whole host of pre-sentient automatons in our definition, but it is probably better to be overbroad than to continue the tradition of denying rights and responsibilities to “other”, especially as the age of AI dawns. This shifts importance from X and Y to C in our technical architecture, X’s and Y’s are those things identified on multiple C’s – and the idea is to capture “people”, but keeping in mind, we are capturing people over telephones and laptops and as-yet-undefined gadgets, and those people may be a thousand miles away or, perhaps, may be entirely virtual. So what then is a channel, C – these telephones, laptops, etc?
A channel is some “means of communicating” – a specific telephone number, mailing address, messaging handle, or any other system to which the principals (the X, Y’s) connect subject to the CCA. The CCA may need to accrete a list of technologies within its scope, and this is OK, especially if it is done in a systematic and managed fashion – one where the legislation is built to expect growth in this area. In terms of a specific contract, a channel then is a specific phone number – but in terms of legislation a single concept, such as phone number, might be sufficient. A concept like phone number itself might even need to be split up into classes such as land-line (location based) or mobile, or classified in other ways such as recipient paid or otherwise sponsored. These details will evolve in time, however, they will evolve in a pre-determined and expected legislative sandbox, which decreases maintenance and compliance costs associated with the legislation.
So far then, we have X’s, Y’s, and C’s in our legislative technology toolbox. And we have a concept of a protected digital self. We can start to draw a picture then, like this:
Which is a pretty powerful starting point for both technical and legal work involving matters of communication. The TCPA and CAN-SPAM act don’t give you this.
Now, the first fear that jumps to mind, and rightly, is the fear that somehow every communication must be policed by the government in accordance with the CCA. This is not the case. Rather, the CCA only defines the groundwork for determining whether or not a particular act of communication is valid if it matters to you – it gives you a legal standing you didn’t have before. To the extent that technology companies develop tools that help empower you to make use of your legal rights is the extent to which you can choose to police your own communications, but there is no government involvement in your personal communications.
Likewise, for a large business, say a major credit card company that operates a call center – they already have enormous investments in managing detailed information about individual customers or past customers. Tracking do-not-call information is a definite imposition, but it is not an industry-destroying imposition – it is simply another set of attributes to track in the evolving world of digital rights and consumer protections. The credit card example raises another issue, which is also dealt with by existing legislation and can be easily integrated into the CCA, namely that consent can be over-ridden in conditions where it is legally appropriate to do so, such as debt collection, service of process, or emergency notifications.
Small business will not feel the burden of CCA because CCA does not require that businesses screen their customer or past customer contact against external databases such as government do-not-call registries. Rather, a small business is only “at fault” for contacting a customer against that customers wishes if that customer has gone to the trouble of contacting the business and formally notifying the business of the revocation of consent.
The CCA extends the above logic to all organizations, of all types – political, religious, and commercial.
Let’s be very clear here, CCA, our diagram of X’s, Y’s, and C’s is about the explicit notification of positive or negative consent to communicate between people and other people or organizations. A key here is explicit – and this is a thing that is missing. Right now, if you tell a political organization, a religious organization, a company, or a person not to contact you, they have no obligation to listen to you. I repeat, you can shout until you are blue in the face, you can scream and yell, and nothing will happen. If you get so frustrated that you make threats, you will go to prison and the government will destroy your life. The CCA puts the government on your side and gives you a right you should have. No should mean no.
The hard part is to build the CCA legislation itself in such a way that it avoids the common traps. We can not tolerate yet more “big government” legislation – and, in fact, if we get it right, the CCA can be used to reduce other legislation. This can happen if the CCA provides a rich enough basis so that other, more complicated legislation can be recast as applications of the CCA. Similarly, the CCA can be used to extend existing investments, such as the do-not-call registry, to create a broader, more powerful communication restriction registry based on the same institutional momentum and leveraging the same social integration.
A key to CCA’s flexibility comes from the stereotyped structure of the contracts – or at least the contract phrases. We saw that X can allow, disallow, prefer, or delegate and then we note that these actions can be “qualified”. They can be qualified as for a purpose P and/or when a condition T is true. In a sense you really only need to have one “modifier” since for-a-purpose is, strictly speaking, a form of when-a-condition is true, however, it is called out separately for a specific reason.
That reason is simply to map onto how people and organizations communicate and how that connects to legislation and regulation. People have complex relationships that are not easily captured by law, and inter-personal relationships can change rapidly. People need to be able to step into different roles very quickly as situations change and the idea of for-purpose captures that in a general sense.
Take a look at the emerging legislation in California defining workplace disconnect laws precisely because of the intrusion of work into personal time due to digital communications. This is exactly the space where for-purpose and when are expected to shine, to provide a clean and natural way for individuals and employers to capture what work and work-hours mean. By qualifying the communication rules with for-purpose and when clauses, a work associate is not blocked from contacting you after hours – they are only guided into a different communications profile if they need to contact you for non-work related reasons. Perhaps you participate on a local volleyball team or your children attend school together – this is fine, but then appropriate rules apply.
As our personal digital communications get more sophisticated, we expect our devices to make sense of these sorts of preferences and policies to tailor communications to our needs and lifestyles. This is intensely personal and should not be controlled by the government. However, because it involves population-wide cooperation between individuals and organizations, some of them giant and overpowering, some regulation is required to ensure that we the people do not lose our voices and independence entirely. This preservation of individual liberty and agency is the heart of the CCA.