• by Wendy Davis  @wendyndavis, August 13, 2018

California should reject requests by industry groups to water down the state's new privacy law, a coalition of 20 advocacy groups says in a new letter to lawmakers.

"The sky is not falling, as industry suggests," the ACLU of California, Berkeley Media Studies Group, Center for Digital Democracy, Consumer Action, Electronic Frontier Foundation, Public Knowledge and other advocacy groups say in a letter sent to California lawmakers Monday.

"The law and its particulars do not pose a threat to the California economy," they write. "California has a long tradition of leading the nation on privacy laws as well as having a thriving economy."

The California measure, passed in late June and slated to take effect in January of 2020, allows consumers to learn what personal information about them is held by businesses, and to opt out of the sale of that information. Even though the new law has already been signed, it's still subject to revision through a "technical corrections" process. In theory, that process is supposed to correct non-substantive mistakes.

Last week, the Association of National Advertisers, Chamber of Commerce, Internet Association and other business groups asked California lawmakers to use the "technical corrections" procedure to revise the new privacy law, arguing that parts of the bill are "unworkable."

But the ACLU and other groups say that many of the proposals put forward by the ANA and others go well beyond fixing non-substantive mistakes.

"The majority of the Chamber’s proposals ... are substantive requests made in bad faith, which do not clarify language but instead substantially reduce privacy protections for consumers," the groups write. "Even for the minority of cases where industry has identified legitimate technical concerns, the proposed fixes are overbroad and ultimately narrow protections for consumers."

One example given by the advocacy groups centers on a request by the business groups to narrow the bill's definition of "personal information."

The law's current definition of that phrase includes cookies, IP addresses and web browsing history -- which appears to cover data used for ad targeting. The ad industry has long opposed that definition, arguing that data like cookies, or IP addresses, isn't "personally identifiable" because it's not necessarily attached to consumers' names.

The measure has an exception for "de-identified" data -- defined as information that can't reasonably be linked, directly or indirectly, to a particular consumer. But the ANA and other organizations are also pressing lawmakers to exempt "pseudonymized" data -- which more clearly covers cookies, web browsing history, and other material relied on by ad-tech companies.

The business groups also seek an exemption for "probabilistic identifiers," or identifiers based on characteristics of devices. The business groups say in their letter that those types of identifiers are only "guesses."

The ACLU and other advocates argue that those requested changes would undermine the bill's protections. "The industry seeks removal of 'probabilistic identifiers,' while every day it uses such information to create dossiers on individuals based on data gathered from mobile devices, PCs, gaming platforms and even digital TV," the letter states.

The advocacy groups add that they, too, favor some substantive changes to the new privacy law. One example they give involves the measure's definition of "sale."

While the law allows consumers to opt out of the sale of their personal information, it defines sale as a disclosure "for monetary or other valuable consideration." That definition may not cover some types of data transfers, including Facebook's transfer to Cambridge Analytica of data for up to 87 million users -- even though revelations about Cambridge Analytica helped drive support for the California law.

"To be sure, AB 375 is not as strong as it could be," the groups write. But, they add, the technical corrections process isn't the time to make significant changes.

"Let these substantive issues go through the democratic process in the next session prior to the law’s implementation," the groups say.