A state lawmaker in California has introduced a privacy bill that would require Web companies that gather data about state residents to notify consumers about the collection and allow them to opt out.
The measure (SB 761), introduced by state senator Alan Lowenthal, would cover a broad range of information collected by companies including people's "online activity," device identifiers and Internet Protocol addresses. The bill would apply to a wide array of commercial Web sites, but not to sites run by the federal, state or local government.
Lowenthal's proposed law would require the state attorney general, in conjunction with the California Office of Privacy Protection, to adopt regulations to provide consumers with a way of opting out of online data collection. State residents would be able to sue companies that don't comply for damages of up to $1,000 per violation.
The advocacy group Consumer Watchdog, which is sponsoring Lowenthal's bill, says that if it is enacted, California would become the first state to give people the right to eschew online tracking.
Self-regulatory standards require companies involved in online behavioral targeting — or serving ads to users based on their Web-browsing history — to notify users and allow them to opt out. But those standards are voluntary. In addition, current self-regulatory principles don't require companies to allow users to opt out of tracking itself, but of receiving targeted ads.
Lowenthal isn't the only lawmaker to introduce privacy legislation recently. Congress is currently considering two separate online privacy bills that would broadly require Web companies to inform people about online data collection and allow them to opt out.
The Interactive Advertising Bureau, which has lobbied against federal legislation, says that Lowenthal's bill could prove onerous for Web companies. "Any company doing business with a California resident would have the burden of both identifying them to be a computer user based in California, and then complying with any requirements of quote-unquote 'collecting information,'" says IAB general counsel Mike Zaneis.
Jules Polonetsky, co-chair and director of the industry-funded think tank Future of Privacy Forum, says it seems odd for the Lowenthal bill to exempt governmental agencies, given that the federal government for many years banned the use of tracking cookies that could be used to create profiles of users. That policy was loosened recently, but the federal government still operates under restrictions regarding online data collection.