• by Wendy Davis , Staff Writer @wendyndavis, January 13, 2022

A Washington state lawmaker this week introduced a privacy bill that would create a “do not track” regime for state residents.

The proposed law (SB 5813), unveiled by state Senator Reuven Carlyle, would allow people to use a single mechanism -- such as a browser-based do-not-track command -- to opt out of the processing of their personal data for targeted advertising.

The bill's definition of personal data includes names, email addresses and other obvious identifiers, as well as pseudonymous data like browsing activity and online searches.

The do-not-track provision specifies that any mechanism must reflect a consumer's “affirmative, freely given, and unambiguous choice,” and tasks the state attorney general with establishing specifications.

SB 5813 also includes new provisions regarding children's privacy and data brokers.

Privacy advocates have long supported a do-not-track system for online data, arguing that consumers should be able to wield control over online targeting with a single command, as opposed to opting out on a site-by-site basis.

Years ago, the Federal Trade Commission also endorsed the concept. In 2010, the agency wrote in a staff report: “The most practical method of providing uniform choice for online behavioral advertising would likely involve placing a setting similar to a persistent cookie on a consumer’s browser and conveying that setting to sites that the browser visits, to signal whether or not the consumer wants to be tracked or receive targeted advertisements.”

In the two years following that FTC report, the major browser developers rolled out a “do not track” setting. But online companies weren't obligated to honor those signals -- and most didn't.

Recently, however, the legal landscape has changed.

California's privacy law, which took effect in 2020, requires companies to allow consumers to opt out of the “sale” of their data, and regulations approved by former Attorney General Xavier Becerra require companies to honor global opt-outs -- including requests made through user-enabled browser plug-ins, privacy settings, device settings or other mechanisms.

Current Attorney General Rob Bonta recently said companies must honor requests sent through the Global Privacy Control -- a mechanism developed by advocates and described by Bonta as a “stop selling my data switch.” (The Global Privacy Control, originally unveiled in 2020, is available as a downloadable extension and a command on some browsers, including Firefox.)

Last year, Colorado assed a privacy law that requires companies to honor people's requests to opt out of targeted advertising -- including requests that consumers make through browser settings or other global mechanisms.

Most provisions of the Colorado law will take effect in July 2023, but the requirement to honor global privacy controls won't take effect until 2024.

In addition to the proposed do-not-track legislation, Carlyle also reintroduced the Washington Privacy Act -- which he has attempted to get passed every year since 2019.

Washington isn't the only state to take another look at privacy this year. This week, lawmakers in New York and Florida also re-introduced bills that could restrict advertisers' use of information about consumers.

A Washington state senate committee is slated to hold a public hearing on Carlyle's do-not-track bill on January 20.