• by Wendy Davis  @wendyndavis, June 2, 2025

The ad industry is pushing California officials to further revise proposed privacy regulations -- including one that would require companies to conduct risk assessments if they harness sensitive location data for advertising.

The proposed regulations regarding location data “could have far-reaching unintended consequences, particularly when applied to commonplace, non-invasive activities like cross-context behavioral advertising,” the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, American Advertising Federation and Digital Advertising Alliance said Monday in a letter to the California Privacy Protection Agency.

Among a host of provisions, the current proposal would require companies to assess privacy risks if they profile consumers based on sensitive locations -- defined in the proposed regulations as including healthcare facilities, educational institutions, political party offices, legal services offices, and religious institutions.

The ad industry argues that this proposed requirement could burden “businesses of all sizes that engage in benign marketing practices -- such as offering a discount at a coffee shop in or near a hospital waiting room or a college cafeteria.”

Ad groups say a “more balanced approach” would involve “clarifying the definition of 'sensitive location' to focus explicitly on places where individuals are in heightened vulnerable states -- while providing explicit guidance that educational institutions, legal services offices, and voluntary civic engagement spaces like political party offices are exempt from onerous risk assessment measures.”

The agency's proposed rules would also require online companies to inform consumers whether opt-out requests sent through a mechanism like the Global Privacy Control -- which sends opt-out signals to every site consumers visit -- are being honored. 

California's privacy law gives consumers the right to opt out of “cross-context” behavioral advertising -- meaning ads served based on activity across different sites. The state's privacy agency interprets that law as requiring companies to honor opt-out requests that consumers transmit through browser-based tools like the Global Privacy Control.

The ad industry says requiring companies to tell consumers about the status of their opt-out requests “would be a significant burden on businesses, particularly small and mid-size firms.”

The groups add that a “lack of standardization” regarding valid opt-out signals would create uncertainty.

“Imposing a requirement to note whether signals have been 'honored,' without providing corresponding clarity regarding which mechanisms constitute valid signals, would create significant confusion and frustration for both consumers and businesses,” the groups write.

A prior version of the proposed regulations would have required risk assessments by companies that use “automated decision-making technology” for behavioral advertising -- including advertising based on first-party data -- and would have required companies to allow consumers to opt out of behavioral advertising based on first-party data.

Those provisions were removed from the current proposal, which was released last month.

The ad groups say they “appreciate” that change, but are concerned that proposed definition of “automated decision-making technology” is too broad.

That definition now includes “any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking” -- including profiling, which is defined in the proposal as the automated processing of personal information to evaluate consumers' personal preferences and interests, among other attributes.

Advocacy group Consumer Reports criticized the decision to roll back proposals regarding first-party behavioral advertising, arguing in a letter sent to the agency Monday that consumers “should have the ability to turn off personalization of offers if they so desire.”