• by Wendy Davis  @wendyndavis, April 25, 2023

Lawmakers in Tennessee have passed a privacy bill that doesn't appear to give consumers the right to opt out of common forms of online behavioral advertising.  

If signed by Governor Bill Lee, the Tennessee Information Protection Act (Senate Bill 73) would enable people to learn what information about them has been collected, have it deleted, and prevent its sale -- with sale defined as an exchange for money or other “consideration,” broadly meaning something of value.

The bill, which was passed late last week, requires companies that process non-pseudonymous data for ad targeting to disclose how consumers can opt out.

But, as with a law passed this year in Iowa, the Tennessee bill doesn't appear to give consumers the right to reject ad targeting based on pseudonymous data -- such as information stored on cookies -- provided that the pseudonymous information isn't linked to an “identified or identifiable natural person.”

Advocacy group Consumer Reports calls the bill weak, and is urging Lee to veto it.

“Tennessee is on the verge of following a worrisome trend of states passing weak, industry supported privacy laws,” Matt Schwartz, policy analyst at the organization, stated this week. “This bill joins those in Iowa and Indiana by masquerading as a consumer privacy measure, when, in reality, it simply codifies the status quo preferred by large tech companies.”

If enacted, the bill will take effect in July of 2024.

This year, lawmakers in four states have passed comprehensive privacy laws -- Iowa, Indiana, Montana and Tennessee. As of Tuesday, only the bills in Indiana and Iowa were signed by those states' governors.

The Indiana bill allows residents to reject ads that targeted based on data collected over time and across nonaffiliated websites or applications. That bill doesn't give consumers the right to opt out of ad targeting based on first-party data, and doesn't require companies to honor opt-out mechanisms like the Global Privacy Control --  a tool developed by privacy advocates that enables web users to opt out of the sale of their information on a universal basis.

Montana's bill is viewed as stronger by privacy advocates. That bill, which also was passed on Friday, gives residents the right to opt out of the use of data linkable to them -- including pseudonymous data, such as information stored on cookies -- for behaviorally targeted ads.

The Montana bill also obligates companies to provide prominent links that enable consumers to opt out of targeted advertising, and provides that companies must honor opt-out universal signals.

An earlier version of the Montana bill wouldn't have given consumers the right to avoid having pseudonymous data used for ad targeting, and wouldn't have required companies to honor universal opt-out signals.

Advocacy group Consumer Reports voiced approval of the final version of the Montana bill, which was revised after the organization raised concerns about the earlier version.