• by Wendy Davis  @wendyndavis, March 14, 2022

California's privacy law gives state residents the right to learn what inferences about them have been drawn by companies, unless the companies show those inferences are trade secrets, the state attorney general said late last week.

The sweeping California Consumer Privacy Act, which took effect in January of 2020, enables consumers to learn what data about them has been collected by companies, request deletion of that information, and opt out of its sale or transfer.

In an opinion made public on Friday, California Attorney General Rob Bonta said the information covered by that law includes “internally generated” inferences, including ones used to build profiles for marketing purposes.

“Once a business has made an inference about a consumer, the inference becomes personal information -- one more item in the bundle of information that can be bought, sold, traded, and exploited beyond the consumer’s power of control,” the attorney general said in a written opinion.

The opinion came in response to a request by state Assembly member Kevin Kiley, who asked Bonta whether consumers have the right to learn businesses' “internally generated inferences.”

The text of the California Consumer Privacy Act says consumers have the right to learn about the personal information that's been “collected” about them. That law also includes inferences in the definition of "personal information." 

Kiley suggested in his request for guidance that inferences aren't “collected” from consumers, and therefore need not be disclosed, according to the opinion.

Bonta disagreed with that interpretation.

“When a business creates (or buys or otherwise collects) inferences about a consumer, those inferences constitute a part of the consumer’s unique identity and become part of the body of information that the business has 'collected about' the consumer,” the opinion states.

The attorney general adds that the California Consumer Privacy Act doesn't require companies to disclose trade secrets, but that the companies would have to prove the inferences are trade secrets in order to fall within that exception.