• by Wendy Davis  @wendyndavis, July 2, 2018

Late last week, California passed a sweeping privacy bill that gives consumers the right to learn what personal information about them is held by businesses, and to opt out of the sale of that information.

But industry observers say that some of the most important provisions in the hastily passed, 10,000-plus-word bill -- signed into law exactly one week after it was introduced -- contain significant ambiguities that could affect the ad industry.

The measure, AB 375, applies to businesses in California with annual revenues more than $25 million as well as those that buy, receive, sell or share personal information of 50,000 or more consumers, households, or devices. The bill allows consumers to learn what information has been collected about them, and to prohibit the sale of that data to outside parties.

The bill's definition of personal information appears broad enough to cover the type of data relied on by many online ad companies -- including cookies, IP addresses and web browsing history. But despite that broad definition, some privacy experts are questioning whether the measure will affect ad tech. That's because the bill has an exception for de-identified data -- defined as information that can't reasonably be linked, directly or indirectly, to a particular consumer. The ad industry has long argued that data such as cookies are only linkable to devices, not to individual users.

That exception may be large enough to give ad tech companies room to argue that they are exempt from the measure, according to Jonathan Mayer, assistant professor of computer science at Princeton. "AB 375 likely won’t have much near-term impact on the third-party online advertising ecosystem," he said on Twitter. "The law has an ambiguous exception for 'deidentified' data, and the advertising sector will argue that it exempts tracking cookies, email hashes, and other common ad identifiers.

Mayer says he believes the bill will have a bigger affect on offline data brokers, retailers and financial services providers -- many of which haven't previously attempted to offer consumers insight into how data about them is compiled.

"There are some problems around data brokers that AB375 has made some progress on," Mayer tells MediaPost. "But AB 375 may not do much to address a lot of problems that have captured our attention around online privacy."

The law, which won't take effect until January of 2020, tasks the state Attorney General with crafting implementing regulations. Those rules could clarify any ambiguities, including ones surrounding the definition of de-identified data.

Another potential ambiguity in the bill centers on its definition of "sale." The measure allows consumers to opt out of the sale of their personal information, but defines sale as a disclosure "for monetary or other valuable consideration."

It's not clear whether that definition covers some of the most controversial types of data transfers, including Facebook's transfer to Cambridge Analytica of data for up to 87 million users -- although revelations about Cambridge Analytica helped drive support for the California law.

Yet another unsettled point comes from a provision in the law addresses whether companies can charge different prices to people who opt out of having their data sold.

One clause in the bill prohibits companies from charging higher prices to consumers who opt out of data collection and selling. But another provision allows businesses to offer "financial incentives," including cheaper prices, to consumers who allow their data to be collected and sold -- provided the price difference "is directly related to the value provided to the consumer by the consumer’s data."

The group Consumers Union, which supported the bill, told lawmakers last week that it opposed the idea that companies should be able to charge higher prices to people who allow their data to be sold. "Under the California Constitution, consumers have an inviolable right to privacy. Consumers should not be charged for exercising that right," the group said in a letter sent to the state legislature on Thursday.

Dan Jaffe, executive vice president for government relations with the Association of National Advertisers, also flags the provisions about differential pricing as one of many uncertainties in the law.

"We think this is extremely bad legislation," Jaffe tells MediaPost. "It was passed in an extraordinarily rapid pace, and there was no chance for anybody to carefully analyze or go over the various provisions of the bill, which are very extensive and very complex."

The ANA dislikes the bill, but considers it preferable to a ballot initiative that would have gone forward had the legislation failed. Still Jaffe says the ANA hopes the measure gets "cleaned up" -- either by the state legislature or Attorney General -- before it takes effect.

"The Attorney General will have the opportunity to spell some of this out further," Jaffe says, referring to the bill's ambiguous provisions. "We have no idea yet how far they will spell this out."