Promising 'Bellwether' or Utter Failure? California Passes Landmark Privacy Law for Online Data

While some critics worry the legislation doesn't nearly go far enough, other observers are saying "California could be the bellwether for the privacy movement" after the state legislature on Thursday unanimously passed and Democratic Gov. Jerry Brown signed into law the nation's toughest digital privacy rules.

As TechCrunchoutlined, once the new law takes effect in January 2020:

• Businesses must disclose what information it collects, what business purpose it does so for and any third parties it shares that data with.
• Businesses would be required to comply with official consumer requests to delete that data.
• Consumers can opt out of their data being sold, and businesses can't retaliate by changing the price or level of service.
• Businesses can, however, offer "financial incentives" for being allowed to collect data.
• California authorities are empowered to fine companies for violations.

Even though it could set a new national standard, as Lee Fang reported earlier this week, citing emails obtained by the The Intercept, "lobbyists for the largest tech companies" quiety fought for the "compromise privacy legislation" in order to keep an even stricter measure off the ballot in November. The ballot initiative, Fang wrote, aimed to enable consumers "to opt out of the sale and collection of their personal data," significantly expand "the definition of personal information to include geolocation, biometrics, and browsing history," and even allow "consumers to pursue legal action for violations of the law."

The California Consumer Privacy Act (AB375) retains several of the initial provisions from the ballot measure, which had the same name as the bill and was backed by real estate mogul Alastair Mactaggart. However, there are a few key differences. For example, the law requires "the disclosure of only the 'category' of a third-party that receives personal information, instead of the identity of the third-party itself," The Vergenoted. "Perhaps most importantly, passing the privacy rules as legislation allows lawmakers to more easily change them, while a ballot measure would be more difficult to amend."

Despite the differences, AB375 is similar enough to the ballot initiative that Mactaggart's campaign agreed to withdraw its measure if the governor signed the law by the withdrawal deadline, which he did. "We are thrilled that AB375 has become law. This is a monumental achievement for consumers, with California leading the way in creating unprecedented consumer protections for the rest of the nation," Mactaggart said Thursday.

The ACLU of Northern California, meanwhile, was not satisfied with the legislation. "Concern for privacy is at an all-time high in the aftermath of the Cambridge Analytica scandal, and yet California has enacted a law that utterly fails to provide the privacy protections the public has demanded and deserves. Nobody should be fooled to think AB375 properly protects Californians' privacy," said Nicole Ozer, the group's technology and civil liberties director.

"This measure was hastily drafted and needs to be fixed," Ozer added. "When that happens next year, effective privacy protections must be included that actually protect against rampant misuse of personal information, make sure that companies cannot retaliate against Californians who exercise their privacy rights, and ensure that Californians can actually enforce their personal privacy rights."

The push for stricter privacy measures comes as part of an international wave of efforts to protect consumers' data following recent breaches and abuses by Big Tech. As Wired explained:

[AB375 is] similar to the General Data Protection Regulation that went into effect in the European Union last month, but adds to it in crucial ways. Under the GDPR, businesses are required to get users' permission before collecting and storing their data. But the way most companies have designed those opt-in pop-ups, "you really don't have a choice," says Ashkan Soltani, former chief technology officer of the Federal Trade Commission who helped author the ballot initiative.