Banking and Finance Law Daily Wrap Up, PRIVACY—California enacts “do not track” disclosure law, (Sep 30, 2013)
Organizations Mentioned:CALPIRG
By J. Preston Carter, J.D., LL.M.
“AB 370 makes the invisible practice of online tracking more transparent to consumers, and I applaud the Governor for signing this important bill,” said Attorney General Kamala D. Harris, sponsor of the legislation, upon its Sept. 27, 2013, signing by Governor Jerry Brown. Although the new law, which amends the California Online Privacy Protection Act, does not prohibit tracking, it requires commercial websites and online servicers to disclose how they respond to “do not track” signals.
Existing law. Existing California law requires an operator of a commercial website or online service that collects personally identifiable information through the Internet about consumers residing in California who use or visit its website or service to conspicuously post its privacy policy and to comply with that policy. It also requires that the privacy policy identify the categories of personally identifiable information that the operator collects about individual consumers who use or visit its website service and third parties with whom the operator shares the information.
Amendment. The amendment requires the website or service operator to:
Disclose how the operator responds to Web browser "do not track" signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer's online activities over time and across third-party Websites or online services, if the operator engages in that collection; and
Disclose whether other parties may collect personally identifiable information about an individual consumer's online activities over time and across different Web sites when a consumer uses the operator's Web site or service. This requirement may be satisfied by providing a clear and conspicuous hyperlink in the operator's privacy policy to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice.
CALPIRG response. According to the California consumer group CALPIRG, “In 2011, online advertising industry groups pledged to develop voluntary mechanisms to honor user’s browser-based Do-Not-Track flags. During the past summer, negotiations to set universal Do-Not-Track standards as part of the World Wide Web Consortium fell through after little progress was made towards self-regulation. While some companies have decided to move ahead themselves, consensus and clarity around Do-Not-Track standards are still absent. AB 370 closes the gap left by the advertising industry’s refusal to adopt network-wide standards on how to treat Do-Not-Track requests and what sort of behavior constitutes tracking.”
The law (Ch. 390) takes effect Jan. 1, 2014.
LegislativeActivity: CaliforniaNews IdentityTheft Privacy