California’s new privacy law, which just took effect in January, could soon be in for a major overhaul.

In November, state residents will be able to vote on a ballot initiative that
significantly expands the California Consumer Privacy Act, officials announced late Wednesday. The proposed California
Privacy Rights Act, spearheaded by real estate developer Alastair Mactaggart, would build upon the current law in several key respects.

As the law currently stands, state residents have the
right to learn what information has been collected about them by companies, have that information deleted, and prevent the sale of that data.

If passed, the California Privacy Rights Act would give consumers new rights over “sensitive”
information — including precise location data, biometric and health data and information about race, religion, union membership and sexual orientation.

advertisement

advertisement

Among others, the measure would
generally empower consumers to direct businesses to avoid using or disclosing that type of sensitive information.

The bill also would make clear that consumers can opt out of receiving
“cross-context behavioral advertising” — or ad targeting based on information obtained from a consumer’s activity across different businesses or websites and apps.

That new
opt-out language appears aimed at removing an ambiguity around targeted advertising in the current law.

The existing law gives consumers the right to opt out of the sale of their personal data
— including persistent identifiers, browsing history and other data used for ad targeting. But the law also provides that data transfers made for “business purposes,” including
advertising and marketing, are not sales.

Last year, the Interactive Advertising Bureau drew on that ambiguity to suggest that ad-tech companies can sometimes serve
targeted ads to California residents who have opted out of the sale of their data.

The ballot proposal has drawn a mixed reaction from privacy advocates, who praise some parts of the measure
but express concerns about others — including a provision that would allow some service providers to mesh data they receive from consumers with information provided by other companies.

Consumer Reports testified earlier this month that the measure would shore up some loopholes, but also said that it “introduces new new complexities and ambiguities, and explicitly blesses
certain loopholes — like allowing service providers to combine data sets.”

The Association of National Advertisers expressed concerns that the ballot initiative is premature. Dan Jaffe,
group executive vice president for government relations at the ANA, notes that the current law still lacks final regulations, and isn’t yet being enforced by the state attorney general.

“For the business community, there’s an endless finish line,” he says. “We now are going to have, in November, a ballot proposal that would substantially change the privacy
rules — but with no data to call upon as to how those changes would impact anything.”