![](\"https:\/\/media.wired.com\/photos\/5b3421a5b63f39453cf64784\/master\/pass\/CaliforniaPrivacy-666266754.jpg\"\/)
<\/p>\n<\/p>\n
Credit to Author: Issie Lapowsky| Date: Thu, 28 Jun 2018 21:57:45 +0000<\/strong><\/p>\n California lawmakers unanimously <\/span>passed a new privacy bill on Thursday that would give residents of the state more control over the information businesses collect on them and impose new penalties on businesses that don\u2019t comply. It is the first law of its kind in the United States.<\/p>\n The so-called California Consumer Privacy Act of 2018 (AB 375) was introduced late last week<\/a> by state assemblymember Ed Chau and state senator Robert Hertzberg, in a rush to defeat a stricter privacy-focused ballot initiative that had garnered more than 600,000 signatures from Californians. The group behind that initiative, Californians for Consumer Privacy, said it would withdraw it if the bill passed. The deadline to withdraw was Thursday, forcing the state legislature to fast-track the bill through the State Senate and Assembly and get it to Governor Jerry Brown's desk by the end of the day. The law takes effect in 2020, but in some ways, Thursday's vote is only the beginning, as business interest groups work to tinker with the legislation's details before then.<\/p>\n In a statement to WIRED following landslide votes in both state houses, Hertzberg said, "Today the California Legislature made history by passing the most comprehensive privacy law in the country. We in California are continuing to push the envelope on technology and privacy issues by enacting robust consumer protections\u2014without stifling innovation.\u201d<\/p>\n The new legislation gives Californians the right to see what information businesses collect on them, request that it be deleted, get access to information on the types of companies their data has been sold to, and direct businesses to stop selling that information to third parties. It\u2019s similar to the General Data Protection Regulation<\/a> that went into effect in the European Union last month, but adds to it in crucial ways. Under the GDPR, businesses are required to get users' permission before collecting and storing their data. But the way most companies have designed<\/a> those opt-in pop-ups, "you really don't have a choice," says Ashkan Soltani, former chief technology officer of the Federal Trade Commission who helped author the ballot initiative.<\/p>\n The ballot initiative would have prevented businesses from denying service to consumers if they opt out of having their data tracked and stored. The law contains similar language, though it creates what Hertzberg calls the "Spotify exception," which allows companies to offer different services or rates to consumers based on the information they provide\u2014for instance, a free product based on advertising. But, the bill states, the difference must be \u201creasonably related to the value provided to the consumer by the consumer\u2019s data."<\/p>\n "The reason why we haven\u2019t been able to do anything in privacy for 20 years is because the special interests are so powerful."<\/p>\n Ashkan Soltani<\/p>\n Had the bill failed, it would have been up to voters to decide whether to support the proposal on the ballot in November. Prior to Thursday's vote, Alastair Mactaggart, the real estate mogul behind the ballot initiative sounded optimistic about his options. "We\u2019re heartened by the momentum behind these endeavors, and the protections that both efforts seek to provide for consumers and our children," he said in a statement.<\/p>\n But ballot initiatives are far more difficult to change once they're passed, because amendments require yet another two-thirds majority vote on the ballot. That may be one reason why opponents within the tech industry reluctantly supported the passage of the bill, says Soltani: It\u2019s easier to change.<\/p>\n \u201cThe senate can vote on amendments and the special interests can lobby on these amendments,\u201d he says. \u201cThe reason why we haven\u2019t been able to do anything in privacy for 20 years is because the special interests are so powerful.\u201d<\/p>\n The tech industry did throw the full weight of its lobbying might\u2014and money\u2014at the fight against the ballot initiative, spending millions of dollars to oppose it through a group called the Committee to Protect California Jobs. They argued that the measure would open them up to liability that would hurt their businesses and their ability to hire. Hertzberg envisioned the bill as a compromise, in part, because it leaves the task of enforcing the law to the attorney general and takes the right to private action by citizens off the table, except in the case of data breaches.<\/p>\n And yet, a report by The Intercept<\/em> revealed<\/a> that lobbyists affiliated with the group TechNet were working behind the scenes to change crucial parts of the bill, as well, including a stipulation that businesses must include a clear button on their websites giving people the ability to opt out of data collection.<\/p>\n Still, in a statement to WIRED just before Thursday\u2019s vote, TechNet\u2019s vice president of state policy and politics, Andrea Deveau, said, \u201cWe believe that the legislature\u200b, not the ballot box,\u200b\u200b is the correct venue to consider this important and compl\u200bex area of policy\u200b.\u201d<\/p>\n Robert Callahan, vice president of state government affairs at the Internet Association, which represents tech companies like Google and Facebook, struck much the same tone. In a statement to WIRED, he said that while the group opposes \u201cmany problematic provisions\u201d within the bill, it at least \u201cprevents the even worse ballot initiative from becoming law in California.\u201d<\/p>\n Facebook initially supported the opposition initiative, but pulled out publicly in April, a month after news broke that a political consulting firm called Cambridge Analytica<\/a> amassed data on tens of millions of American Facebook users for political purposes without their knowledge. \u201cWe took this step in order to focus our efforts on supporting common sense privacy measures in California," the company said at the time.<\/p>\n Now, in a statement to WIRED, Facebook's vice president of state and local public policy, Will Castleberry, said that while the bill is "not perfect," the company supports it and looks forward to "working with policymakers on an approach that protects consumers and promotes responsible innovation.\u201d<\/p>\n The law goes into effect on January 1, 2020. The Internet Association has already hinted at efforts to modify the legislation before implementation. \u201cIt is critical going forward that policymakers and industry work to correct the inevitable, negative policy and compliance ramifications this last-minute deal will create,\u201d Callahan said.<\/p>\n