Last year, California lawmakers passed the toughest privacy law in the country. Now, legislators may be having second thoughts.

Add another debacle to the long list of Facebook's privacy snafus: The company reportedly obtained and uploaded email contacts of 1.5 million users -- without asking them first.

The Deceptive Experiences To Online Users Reduction Act would prohibit large platforms from using so-called "dark patterns" in their privacy policy interfaces.

Facebook's ad-delivery system sends ads to particular individuals based on whether the ads will be "relevant" to them. That determination can turn on stereotypes, a new paper says.