What's Happening?
The California Legislature has passed a package of privacy bills aimed at enhancing consumer protection, particularly concerning sensitive personal information and children's online safety. Assembly Bill 1542 (AB 1542) introduces a general prohibition
on the sale or sharing of sensitive personal data with third parties, expanding upon existing regulations under the California Consumer Privacy Act (CCPA). Senate Bill 923 (SB 923), known as the Expanding Privacy Rights Act, addresses a loophole in the CCPA by extending the right to deletion to cover all non-exempt personal information, regardless of its source. Additionally, Assembly Bill 2246 (AB 2246) replaces the state's Age-Appropriate Design Code Act with a strengthened regime for online services likely to be accessed by children under 18, introducing positive obligations for technology companies and online platform operators. These obligations include implementing age estimation measures, defaulting to high-privacy settings for child users, and presenting privacy information in age-appropriate language. The bills are currently awaiting the Governor's signature.
Why It's Important?
This legislative package is significant for strengthening consumer data privacy in California, a state often at the forefront of privacy regulations in the U.S. AB 1542's prohibition on selling or sharing sensitive personal information will impact all businesses, service providers, and contractors handling such data, potentially leading to a re-evaluation of data handling practices across industries. SB 923's expansion of deletion rights ensures that consumers have greater control over their personal information, regardless of how it was acquired by a business, aligning California with other states like Delaware, Indiana, Maryland, and New Jersey. AB 2246's focus on children's online privacy introduces a new standard for technology companies and online platforms, requiring them to design services with the safety and privacy of minors in mind. This could set a precedent for national regulations, influencing how online services are developed and marketed to younger audiences across the country. The civil penalties for violations underscore the state's commitment to enforcing these new protections.
What's Next?
The immediate next step for these bills is the Governor's decision to sign or veto them. If signed, businesses operating in California, particularly those in the technology sector and those handling sensitive personal information, will need to review and update their data privacy practices to ensure compliance. This will involve implementing new technical measures for data deletion, re-evaluating data sharing agreements, and potentially redesigning online services to meet the enhanced child privacy standards. The enforcement of these laws will primarily fall to the Attorney General and public prosecutors, with civil penalties for negligent and intentional violations. The retroactivity of SB 690, which restricts private lawsuits under CIPA, could also impact a significant volume of existing litigation, shifting enforcement power to the Attorney General. The long-term impact will likely include increased scrutiny on data collection and usage practices, especially concerning vulnerable populations like children, and a potential ripple effect on privacy legislation in other states.
Beyond the Headlines
These bills reflect a broader societal shift towards greater awareness and demand for personal data privacy and protection, particularly for children in the digital age. The emphasis on preventing foreseeable harms to children, including psychological and discriminatory harm, highlights a growing recognition of the non-financial impacts of data practices. The move to restrict private lawsuits under CIPA, while centralizing enforcement with the Attorney General, could streamline legal challenges but also raises questions about the accessibility of justice for individual consumers. The legislative package also underscores the ongoing tension between business practices that rely on data collection and the public's right to privacy. The requirement for online-only businesses to offer web-based submission methods for privacy requests, rather than just email, signifies a push for more user-friendly and accessible privacy controls, reflecting a deeper commitment to empowering consumers in managing their digital footprint.
