• by Wendy Davis  @wendyndavis, March 3, 2022

Utah lawmakers on Thursday passed a privacy bill that would give state residents the right to opt out of some forms of behavioral ad targeting.  

The Consumer Privacy Act (SB 227), which was introduced less than three weeks ago, would broadly require companies to allow consumers to access and delete some personal data, and to opt out of its sale. The measure has a specific provision allowing consumers to opt out of targeted advertising.

As with several other state privacy laws, the bill doesn't allow consumers to sue over violations.

Privacy advocates plan to ask Governor Spencer Cox, a Republican, to veto the measure, arguing that it isn't strong enough.

“More work needs to be done on this bill, to make sure it meaningfully protects consumers,” Consumer Reports senior policy analyst Maureen Mahoney said Thursday afternoon.

Earlier this week, Consumer Reports and other eight advocacy groups (including the Consumer Federation of America, Electronic Frontier Foundation and Electronic Privacy Information Center) urged state lawmakers to reject the measure as written.

“The bill needs to be substantially improved before it is enacted; otherwise, it would risk locking in industry-friendly provisions that avoid actual reform,” the organizations said in a letter to Utah legislators.

Among other revisions, the organizations urged lawmakers to require companies to honor global opt-out signals, including “do-not-sell” commands that consumers can send through their browsers.

Two other states -- Colorado and California -- have taken a global opt-out approach.

In Colorado, a recent privacy law will require companies to honor opt-out requests made through browser settings or other global mechanisms.

In California, regulations passed by the state attorney general require companies to comply with requests through the Global Privacy Control -- a tool that consumers can use to transmit an opt-out request to all websites.

The privacy groups also argued that the bill has a “loophole” that could allow companies to continue to serve certain forms of targeted ads, even when consumers attempt to opt out of behavioral targeting.

The ambiguity centers on the bill's definition of “targeted advertising,”

The measure says targeted advertising means ads based on data about people's activities across nonaffiliated websites or apps. The definition also specifically excludes ads based on a company's own data about consumers.

That exemption for first-party data “could allow internet giants like Google, Facebook, and Amazon to serve targeted ads based on their own vast data stores on other websites,” the groups wrote.

“This loophole would undermine privacy interests and further entrench dominant players in the online advertising ecosystem,” the organizations added.

After the governor receives the bill, he will have up to 20 days to veto the measure, sign it, or allow it to become law without his signature.