California lawmakers on Friday passed a bill requiring “data brokers” --potentially including online ad networks -- to register with the state attorney general.
Governor Gavin Newsom has until October 13 to sign the bill.
The measure (AB 1202) -- which was opposed by the major ad organizations -- defines data broker as a business that “knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.”
That definition has exemptions for banks and some other types of companies, but arguably sweeps in ad networks and other businesses that collect online tracking data about consumers -- including information about web-browsing history, IP addresses and locations.
The bill generally incorporates the same definitions as the state's broad California Consumer Privacy Act, slated to take effect in January. That bill will give consumers the right to learn what personal information has been collected about them by companies, have that information deleted, and prevent the sale of that data.
That bill's definition of “personal information” includes data that could potentially be linked to individuals -- including data used for ad targeting, such as persistent identifiers, browsing history and IP addresses.
Dan Jaffe, executive vice president for government relations at the Association of National Advertisers, says the group believes privacy issues “should be handled on a national, not state basis.”
He adds the California bill is likely going to affect “a vast number of companies” beyond traditional data brokers.
The ANA, American Advertising Federation, American Association of Advertising Agencies, Interactive Advertising Bureau and Network Advertising Initiative said in a March letter to lawmakers that the bill “would result in numerous problems for consumers, the California Attorney General, and businesses, making California a more difficult place to innovate and regulate, and hurting workers and consumers in nearly all sectors of the state’s economy.”
The state's new data-broker measure comes more than one year after Vermont passed a bill requiring companies that sell “personal information” about state residents to register.
That law's definition of personal information appears to be narrower than California's. In Vermont, the definition includes names, birthdates, addresses, biometric data (like fingerprints or retina scans), Social Security numbers and "other information that, alone or in combination with the other information sold or licensed, would allow a reasonable person to identify the consumer with reasonable certainty.”