• by Wendy Davis , Yesterday

Alabama lawmakers have passed a privacy bill that gives state residents some control over personal data, but doesn't appear to give consumers the right to opt out of common forms of behavioral ad targeting.

Governor Kay Ivey has not yet signed the measure, which was approved last week by the legislature.

The watchdog Consumer Reports is urging Ivey to veto it, arguing that the bill has too many loopholes.

"This legislation adopts a lowest-common-denominator approach to privacy that will not meaningfully protect consumers," Consumer Reports policy analyst Matt Schwartz stated.

If enacted, House Bill 351 includes provisions that would allow people to learn whether companies are processing personal data -- defined as information that's linked or "reasonably linkable" to an identifiable individual.

The bill also would require companies to allow consumers to opt out of targeted advertising -- meaning ads based on data collected across sites and over time -- when the underlying data in itself identifies a consumer.

But the measure doesn't require companies that target ads based on pseudonymous information (such as data linked to alphanumeric mobile device identifiers) to allow opt-outs -- provided the pseudonymous data is stored separately from identifiable data.

Should Ivey sign the bill, Alabama will become the 21st state to enact a comprehensive privacy law, according to the nonprofit IAPP (formerly International Association of Privacy Professionals). 

Several other states with privacy statutes -- including Kentucky, Iowa and Tennessee -- don't give residents the right to opt out of pseudonymous ad targeting. But most state privacy laws appear to require companies to give consumers the right to reject behaviorally targeted ads.

If enacted, the Alabama law measure will take effect next year.