• by Wendy Davis , Staff Writer @wendyndavis, August 9, 2018

In late June, California lawmakers passed a sweeping privacy bill that allows consumers to learn what personal information about them is held by businesses, and to opt out of the sale of that information.

The broad measure mostly drew praise from privacy advocates, but was met with vocal criticism by businesses -- including the ad industry and tech companies.

The new law, which won't take effect until January of 2020, is still subject to revision. This month, lawmakers are considering a host of "technical corrections," which would fix drafting errors. In theory, those corrections aim to remedy non-substantive mistakes -- though in reality, the line between "substantive" and "technical" can be fuzzy.

Now, the Association of National Advertisers, Chamber of Commerce, Internet Association, Motion Picture Association of America and other groups are hoping to use this month's technical-corrections process to weaken the bill's privacy protections. The groups this week sent a 20-page letter to California lawmakers, which outlines changes they would like to see.

Dan Jaffe, ANA executive vice president for government relations, writes that the letter offers proposals that will "rectify serious drafting errors in order to create solutions to many of the parts of the bill that would be unworkable or impose major negative consequences."

Included in the business groups' wish list of changes is a change to the law's definition of "personal information," so that it excludes much of the data relied on by the ad industry.

The bill's current definition of personal information includes cookies, IP addresses and web browsing history -- which appears to cover data used for ad targeting. The ad industry has long opposed that definition, arguing that data like cookies, or IP addresses, isn't "personally identifiable" because it's not necessarily attached to consumers' names.

The California measure currently has an ambiguous exception for "de-identified" data -- defined as information that can't reasonably be linked, directly or indirectly, to a particular consumer. But the ANA and other organizations are pressing to exempt "pseudonymized" data -- which more clearly covers cookies, web browsing history, and other material relied on by ad-tech companies.

"The collection, use, retention, sale, and disclosure of information in deidentified or aggregate or pseudonymized form, where it can be used in place of personally identifiable information, is privacy enhancing and beneficial to consumers because it means that the processing of personally identifiable information about them is reduced," the letter states.

"Businesses that can accomplish their legitimate business purposes through the use of deidentified, pseudonymized, and aggregate information can reduce the amount of personally identifiable information that is subject to potential compromise."