• by Wendy Davis , Staff Writer @wendyndavis, March 12, 2020

California's top law enforcement official has proposed yet another round of changes to rules aimed at implementing the state's landmark privacy law.

These newest proposed regulations to the California Consumer Privacy Act, unveiled late Wednesday, include some revisions that privacy advocates had sought -- and that the ad industry is likely to oppose.

The law, which took effect in January, gives consumers the right to learn what personal information has been collected about them by companies, have that information deleted, and prevent the sale of that data to third parties.

While the bill is detailed, it also has some messy ambiguities -- which isn't surprising, given that state lawmakers passed the measure just one week after it was introduced in June of 2018. At the time, lawmakers tasked the attorney general with issuing regulations that would clarify any hazy provisions.

So far, Attorney General Xavier Becerra appears to be struggling to come up with rules: His latest proposal flip-flops on proposed regulations issued just last month.

Among the biggest changes, the new proposal does away with a definition of “personal information” that could have allowed companies to traffic in IP addresses and other supposedly “anonymous” data.

In February, Becerra proposed that IP addresses should only be considered “personal information” if they are stored in a way that could reasonably link them to particular people or households. That definition would have allowed companies that collect IP addresses to transfer them to other companies.

Privacy advocates criticized that proposal -- now withdrawn -- arguing that supposedly anonymous information can become personally identifiable if combined with other information. 

The newest proposed regulations also would require companies to honor do-not-sell requests sent through browser-based tools -- regardless of whether consumers affirmatively activate the tools. The version of the rules put forward last month would only have required companies to honor browser-based do-not-sell requests if consumers expressly activated them. 

Becerra's office is accepting comments on the newest proposals through March 27. He is slated to begin enforcement on July 1.