In late June, California lawmakers
passed a sweeping privacy bill that allows consumers to learn what personal information about them is held by businesses, and to opt out of the sale of that information.
The broad measure
mostly drew praise from privacy advocates, but was met with vocal criticism by businesses -- including the ad industry and tech companies.
The new law, which won't take effect until January of
2020, is still subject to revision. This month, lawmakers are considering a host of "technical corrections," which would fix drafting errors. In theory, those corrections aim to remedy non-substantive
mistakes -- though in reality, the line between "substantive" and "technical" can be fuzzy.
Now, the Association of National Advertisers, Chamber of Commerce, Internet Association, Motion
Picture Association of America and other groups are hoping to use this month's technical-corrections process to weaken the bill's privacy protections. The groups this week sent a 20-page letter to
California lawmakers, which outlines changes they would like to see.
Dan Jaffe, ANA executive vice president for government relations, writes that the letter offers proposals that will "rectify serious
drafting errors in order to create solutions to many of the parts of the bill that would be unworkable or impose major negative consequences."
Included in the business groups' wish list of
changes is a change to the law's definition of "personal information," so that it excludes much of the data relied on by the ad industry.
The bill's current definition of personal information
includes cookies, IP addresses and web browsing history -- which appears to cover data used for ad targeting. The ad industry has long opposed that definition, arguing that data like cookies, or IP
addresses, isn't "personally identifiable" because it's not necessarily attached to consumers' names.
The California measure currently has an ambiguous exception for "de-identified" data --
defined as information that can't reasonably be linked, directly or indirectly, to a particular consumer. But the ANA and other organizations are pressing to exempt "pseudonymized" data -- which more
clearly covers cookies, web browsing history, and other material relied on by ad-tech companies.
"The collection, use, retention, sale, and disclosure of information in deidentified or
aggregate or pseudonymized form, where it can be used in place of personally identifiable information, is privacy enhancing and beneficial to consumers because it means that the processing of
personally identifiable information about them is reduced," the letter states.
"Businesses that can accomplish their legitimate business purposes through the use of deidentified,
pseudonymized, and aggregate information can reduce the amount of personally identifiable information that is subject to potential compromise."