California’s sweeping privacy law is on track to take effect in January without major revisions sought by Google Inc. and industry allies.
Lawmakers are poised to modify the California Consumer Privacy Act before they adjourn for the year Sept. 13, but broader changes such as allowing businesses to collect user data for targeted advertising didn’t emerge before the Sept. 10 deadline for bills to be in their final form.
The law limits how Alphabet Inc.'s Google and other companies collect and make money from user data online, threatening a business model that generates billions of dollars in ad revenue.
In recent weeks, Google and other businesses represented by the Internet Association and other tech associations pushed to exempt digital advertising, and in some cases allow companies to continue collecting data even if users opt out.
State Sen. Hannah-Beth Jackson (D) said she and other lawmakers tamped down business efforts that could weaken the law.
“We have held the line on those,” Jackson said. “I think we are in agreement that we need to be thoughtful, that we need to protect the public’s desire and insistence upon privacy and at the same time make sure that we have clarity for the various companies that live in that world.”
At least six bills that address some complaints from business groups could receive final votes by Sept. 13. If the governor signs them, they would modify the law before it takes effect Jan. 1, 2020 and clear the way for Attorney General Xavier Becerra (D) to issue regulations that businesses must follow by July 1, 2020.
Gov. Gavin Newsom (D) hasn’t taken a position on the bills.
The landmark privacy law will give consumers the right to ask a company what data it holds on them and to have that data deleted, as well as to opt out of the sale of their personal information. When it was enacted in 2018 to avert a more sweeping ballot measure, lawmakers pledged to make minor fixes before it kicks in.
Bills to amend the privacy law that could reach Newsom include:
- A.B. 25 by Assemblyman Ed Chau (D) to exempt personal information employers have about their employees from the law’s requirement that it be disclosed or deleted upon request;
- A.B. 846 by Assemblywoman Autumn Burke (D) to allow businesses to offer perks such as grocery store discounts and airline frequent flier miles through customer loyalty programs that rely on consumer data;
- A.B. 874 by Assemblywoman Jacqui Irwin (D) to clarify how public information is exempt from the law;
- A.B. 1146 by Assemblyman Marc Berman to limit opt-out and deletion rights for data held by car dealers necessary for repair and warranty work;
- A.B. 1355 by Chau to make multiple technical changes; and
- A.B. 1564 by Berman to specify that businesses must provide an email address, but not a toll-free number, for consumers to request information.
Before going to Newsom, the bills must be passed by the Senate and go back to the Assembly for a final vote by Sept. 13. The governor would have until Oct. 13 to sign or veto them.
Amendments to several of the bills include changes to the definition of personal information covered by the law. Personal information that a business could “reasonably” link to a consumer would be subject to the law. Personal information wouldn’t include consumer information that is stripped of identifications or aggregated.
Other amendments clarify that information employees share between businesses to complete transactions or engage in business relationships is exempt, and that companies aren’t required to collect consumer data or retain it longer than they would in the normal course of business.
Exempting data exchanged between businesses is consistent with the European Union’s General Data Protection Regulation, said Sara Boot, a lobbyist for the California Chamber of Commerce who lead business efforts to amend the law.
“This is a crucial fix to prevent unnecessary harm to our economy,” she said.
Common Sense Media Founder and Chief Executive Officer James P. Steyer praised lawmakers for keeping the California law largely intact.
“It’s no surprise that after failing to gut the California Consumer Privacy Act tech giants are now rallying Congress to pass a federal law to preempt it,” he said.
Jackson said more amendments to exempt de-identified consumer data used in medical research could come in early 2020, when lawmakers reconvene.
The Chamber of Commerce will continue to push for other changes, Boot said.
“Although well intentioned, the CCPA is a dense and confusing law that will create numerous unintended consequences for consumers and businesses without further revision and clarification,” she said.