
California lawmakers have amended the state's new privacy bill, but the revisions are minor compared to the broad changes sought by the ad industry.
The privacy bill, which was passed
this summer, allows consumers to learn what personal information about them is held by businesses, and to opt out of the sale of that information. The bill's broad definition of personal information
includes cookies, IP addresses and web browsing history -- which appears to cover data used for ad targeting.
The new law, which also contains data security provisions, tasks the state
attorney general with developing enforcement regulations.
The bill mostly drew praise from privacy advocates, but was met with criticism by businesses -- including the ad industry and tech
companies.
Last week, lawmakers passed a set of "technical corrections" aimed at
fixing non-substantive drafting mistakes. One of the amendments provides that the measure won't be enforced until six months after the attorney general adopts regulations, or July 1, 2020, whichever
occurs first. The law was originally slated to take effect on January 1, 2020.
Another amendment clarifies that consumers can only bring private lawsuits over data breaches caused by a
company's failure to implement reasonable security steps.
The Association of National Advertisers and other business groups had pushed for far broader changes -- including one that would have
exempted much of the data relied on by ad-tech companies from the law's definition of "personal information."
The ANA still plans to lobby for broader changes. The group said this week that the new amendments are "useful," but added that they were only "a modest first step in a
sustained, long term effort that will be required to convince policymakers in the next legislative session that the CCPA needs a complete overhaul."
The organization adds that the law has
"serious defects," including that it "threatens to severely impact the offering of financial incentives such as loyalty programs."
The ANA had earlier asked lawmakers for a host of changes to
the measure, including one that would clarify an ambiguity about the circumstances under which companies can offer discounts to consumers who allow their information to be used.
Currently, the
law contains a provision that prohibits companies from charging higher prices to consumers who opt out of data collection and selling. But it also contains another provision that allows businesses to
offer "financial incentives," including cheaper prices, to consumers who allow their data to be collected and sold.