California Governor Signs Law Requiring Data Brokers To Register

A new California law requiring “data brokers” -- potentially including online ad networks -- to register with the state attorney general was signed late last week by Governor Gavin Newsom.

The measure (AB 1202) -- one of several recent amendments to the state's sweeping new privacy law -- was opposed by the major advertising organizations.

AB 1202, introduced in February by Assembly member Ed Chau and passed by California lawmakers last month, defines a data broker as a business that “knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.”



That definition has exemptions for banks and some other types of companies, but arguably sweeps in ad networks and other businesses that collect online tracking data about consumers -- including information about web-browsing history, IP addresses and locations.

The Association of National Advertisers, Interactive Advertising Bureau, American Advertising Federation, American Association of Advertising Agencies and Network Advertising Initiative argued to Newsom that the bill “would result in numerous problems,” for consumers, the attorney general and businesses.

The organizations said the definition of data broker was so broad that the measure would apply to “businesses conducting routine activities,” including companies engaged in analytics and fraud detection.

The California Consumer Privacy Act -- slated to take effect January 1 -- gives consumers the right to learn what personal information has been collected about them by companies, to have that information deleted, and prevent the sale or other disclosure of that data to third parties. On Thursday, state Attorney General Xavier Becerra unveiled potential regulations fleshing out the law.

The new law comes more than one year after Vermont passed legislation requiring companies that sell “personal information” about state residents to register.

That law's definition of personal information appears to be narrower than California's.

In Vermont, the definition includes names, birthdates, addresses, biometric data (like fingerprints or retina scans), Social Security numbers and "other information that, alone or in combination with the other information sold or licensed, would allow a reasonable person to identify the consumer with reasonable certainty.”

Next story loading loading..