• by Wendy Davis , Yesterday

Many businesses are undermining state privacy laws "by relying on flawed geolocation data to selectively ignore consumer opt-out requests," Senator Ron Wyden (D-Oregon) said Monday in a letter sent to attorneys general in 10 states.

The states receiving the letter require companies to honor universal mechanisms such as the Global Privacy Control (GPC) that send ad-targeting opt-out requests to every site consumers visit.

"While some of the largest companies in America honor GPC signals from all visitors to their websites, other companies have chosen to honor GPC signals only from users they believe are physically located in states that require compliance," Wyden writes.

"These companies rely on commercial GeoIP databases to guess a user’s location based on their IP address and deduce which state laws apply," the senator adds. "This practice deprives consumers of their rights under your states’ laws: GeoIP databases are notoriously inaccurate."

Wyden also says that even if a consumer is not physically present in one of those states, he or she still has the right to use universal opt-out tools to reject tracking.

"Ignoring a GPC signal based on a temporary out-of-state location unlawfully deprives consumers of their statutory rights," he writes. "This practice strips away the rights of mobile populations, including out-of-state college students, business travelers, and interstate commuters."

Wyden elaborates that staff at the California Privacy Protection Agency confirmed to his office that California consumers "retain their rights under California’s privacy law, including the right to opt out using GPC, regardless of where they are physically located."

It's not clear whether that statement would hold up in court.

Santa Clara University Eric Goldman tells MediaPost that the interpretation of the law attributed to agency staff is legally dubious, and may conflict with the constitutional principle that generally prevents states from regulating out-of-state activity.

Goldman says that while businesses should honor consumers' expressed preferences, legal interventions "probably aren't the solution."

He adds that the "whole notion of having territory-based laws" limits the reach of state laws.

But Justin Brookman, director of technology policy for Consumer Reports, says states can argue that they have a legitimate interest in safeguarding residents from potential privacy violations.

"If they take a trip, why should that matter?" he says. "California would argue they're still citizens."

Wyden is urging attorneys general to issue guidance recommending that companies honor universal opt-out signals sent by state residents "regardless of their physical location or IP address," or alternatively to give consumers a way to "self-certify their true residency."

Wyden also asks the officials to establish a bipartisan, multi-state task force to enforce the opt-out law.

"A unified coalition of state regulators issuing joint investigative demands and coordinated compliance notices will send an unmistakable message: geographic filtering is a collective enforcement trigger, not a clever legal loophole," he writes.

David LeDuc, vice president for public policy at the industry group Network Advertising Initiative, says the organization "would welcome guidance from the states as to what they expect."

"Senator Wyden raises good points," he says. "There are limitations to IP lookups."

LeDuc adds that potential inaccuracies in those lookups are "one of the best arguments for a national standard."

Wyden's letter went to attorneys general in California, Colorado, Connecticut, Delaware, Maryland, Montana, Nebraska, New Hampshire, New Jersey and Texas.