• by Wendy Davis  @wendyndavis, September 5, 2018

California lawmakers have amended the state's new privacy bill, but the revisions are minor compared to the broad changes sought by the ad industry.

The privacy bill, which was passed this summer, allows consumers to learn what personal information about them is held by businesses, and to opt out of the sale of that information. The bill's broad definition of personal information includes cookies, IP addresses and web browsing history -- which appears to cover data used for ad targeting.

The new law, which also contains data security provisions, tasks the state attorney general with developing enforcement regulations.

The bill mostly drew praise from privacy advocates, but was met with criticism by businesses -- including the ad industry and tech companies.

Last week, lawmakers passed a set of "technical corrections" aimed at fixing non-substantive drafting mistakes. One of the amendments provides that the measure won't be enforced until six months after the attorney general adopts regulations, or July 1, 2020, whichever occurs first. The law was originally slated to take effect on January 1, 2020.

Another amendment clarifies that consumers can only bring private lawsuits over data breaches caused by a company's failure to implement reasonable security steps.

The Association of National Advertisers and other business groups had pushed for far broader changes -- including one that would have exempted much of the data relied on by ad-tech companies from the law's definition of "personal information."

The ANA still plans to lobby for broader changes. The group said this week that the new amendments are "useful," but added that they were only "a modest first step in a sustained, long term effort that will be required to convince policymakers in the next legislative session that the CCPA needs a complete overhaul."

The organization adds that the law has "serious defects," including that it "threatens to severely impact the offering of financial incentives such as loyalty programs."

The ANA had earlier asked lawmakers for a host of changes to the measure, including one that would clarify an ambiguity about the circumstances under which companies can offer discounts to consumers who allow their information to be used.

Currently, the law contains a provision that prohibits companies from charging higher prices to consumers who opt out of data collection and selling. But it also contains another provision that allows businesses to offer "financial incentives," including cheaper prices, to consumers who allow their data to be collected and sold.