The NAI Submits Comments to CalPrivacy Audit Division Technical Inquiry

On November 2, 2026, the NAI responded to the California Privacy Protection Agency’s (CalPrivacy) Audits Division request for technical input on emerging technologies. On how to distinguish a statistical correlation from an actionable sensitive inference, the NAI recommended that the agency recognize the thresholds in its Demographic Health Advertising Best Practices: audience segments covering at least 10% of a region’s population, with a floor of 100,000 individuals, plus careful labeling, data stewardship, and public disclosure of segment criteria. These thresholds are easy to verify without examining model internals, and they preserve data-driven health advertising and its documented public health benefits.

On deidentification, the NAI urged the agency to treat data deidentified under HIPAA’s Expert Determination Method as a defensible standard for the first prong of “deidentified” under the CCPA. It also recommended assessing re-identification risk by a recipient’s actual capabilities, and pairing technical measures with contractual prohibitions on re-linking data and a public commitment not to re-identify. The NAI looks forward to serving as a resource as the Audits Division develops its audit framework.