• by Wendy Davis  @wendyndavis, November 27, 2023

California's privacy regulator on Monday floated a proposal that could restrict companies' use of first-party data for advertising.

The potential regulations, released by the California Privacy Protection Agency as a discussion draft, are part of a package of restrictions on the use of “automated decision-making technology,” such as algorithms used to compile ad profiles.

The draft rules would prohibit businesses from harnessing personal data of users between the ages of 13 and 15 to profile them for behavioral advertising purposes without their opt-in consent. The draft proposal's language appears ambiguous regarding whether businesses would also have to allow older teens and adults to opt out of profiling, but the agency suggested in a broad statement issued Monday that its proposal is meant to include that requirement.

The agency said in that statement that the proposed rules would apply to businesses using automated decision-making technology for “profiling a consumer for behavioral advertising,” without referencing that consumer's age. The statement also said the proposed rules would require companies engaged in "behavioral advertising" to provide consumers with the ability to opt out of profiling.

A spokesperson for the agency declined to answer questions about the proposed regulations.

The draft rules define "profiling" as "any form of automated processing of personal information to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements."

The proposal doesn't define "behavioral advertising."

California's sweeping privacy law already requires businesses to allow residents to opt out of "cross-context behavioral advertising" -- meaning ads targeted based on people's activity across different sites, apps or services. That law also requires businesses to obtain opt-in consent from users between the ages of 13 and 15 before sharing their personal information.

But these new rules -- assuming they are enacted, and that they give users 16 and older the right to opt out of profiling -- could also limit companies' use of their own data for advertising.

Such restrictions would be “a bridge too far,” says Stu Ingis, an attorney at the law firm Venable who represents ad organizations.

He adds that requiring publishers to allow people to opt out of profiling for ad purposes would “basically allow people to opt out of advertising,” given that much advertising today is fueled by data.

What's more, he says, the restrictions on the use of first-party data could conflict with the portions of the law that only require companies to allow people to opt out of the sale or transfer of their data for cross-context behavioral advertising.

But privacy advocate John Davisson, director of litigation at the Electronic Privacy Information Center, notes that California's privacy law specifically directs the state privacy agency to issue regulations regarding automated decision-making.

He adds that a rule requiring companies to allow opt-outs would still allow publishers to serve targeted ads to consumers.

“The industry talks about how consumers want targeted advertising,” he says, adding that an opt-out requirement “calls them on their bluff.”

Other potential regulations unveiled Monday would give consumers in public places the right to opt out of profiling via technologies including biometrics (such as facial recognition and speech recognition), license-plate recognition, automated emotion assessment, location trackers and geofencing.

The California Privacy Protection Agency will meet December 8 to discuss the potential regulations.