Tech giants push to limit California’s consumer privacy law

For the past two months, residents of Sacramento, Calif., have been inundated by ads on Facebook and Twitter, warning that the government is about to destroy the Internet as they know it.

“The FREE websites and apps you use every day could start costing you,” announced one Twitter ad.

“Using the internet shouldn’t hurt your wallet,” began another that predicted browsing the Web could someday seem like paying at the pump for gasoline.

The ads came from a lobbying organization representing the social media sites on which the ads were viewed. They appeared to target mostly people in or around the state Legislature in Sacramento. And they were part of an effort by Facebook, Google and other tech giants in Silicon Valley to push for changes in the country’s first-ever consumer privacy law before its protections take effect in January.

Adopted last year, the California Consumer Privacy Act grants Web users the right to see the personal information that companies collect about them and stop it from being sold. The law applies only to residents of the Golden State, but its backers hope it might spur regulators around the country to follow suit — and force tech giants to change their practices nationwide.

“We will have in place the first consumer privacy act in the country,” said Sen. Hannah-Beth Jackson, a Democrat.

But business organizations — representing retailers, marketers and tech companies — have responded by seeking sweeping revisions to the law before it goes into effect. So far, they haven’t

been successful in a campaign that privacy advocates deride as an attempt to weaken consumers’ rights. But they haven’t relented, either, with only two weeks remaining in California’s legislative calendar.

The lobbying campaign has involved their own websites: A page on Facebook and an account on Twitter called Keep the Internet Free began posting videos this summer encouraging people to spare online advertisers from adhering to some of California’s new privacy rules.

One set of ads — running on Twitter beginning in midAugust — has about 184,000 views, all in Sacramento, according to Twitter’s ad archive. Only by navigating to the website for Keep the Internet Free are its origins revealed: A line at the bottom of the site says it’s a “project of the Internet Association,” a trade group for Facebook, Google, Microsoft and Twitter.

“I don’t think anything we supported weakened the law at all,” said Kevin McKinley, the director of government affairs in California for the Internet Association. He said the goal has been to make the law “easier for businesses to understand.”

Facebook declined to comment, and Google did not respond to requests for comment.

Privacy advocates anticipated

such a fight given the circumstances that produced California’s novel digital protections law. State legislators adopted the privacy act in an accelerated push in 2018, under an agreement that was meant to stave off an even more aggressive ballot initiative.

But California’s haste also resulted in a law with drafting errors and unresolved issues over what kind of information it covers and how consumers could stop the sale of their data. The holes left tech companies, privacy advocates and lawmakers in a rare alignment that they had to update the law this year — a process that opened the door to another round of legislative wrangling.

Consumer groups including the American Civil Liberties Union, Common Sense Media and the Electronic Frontier Foundation sought to strengthen California’s rules. They aimed to limit the ways companies like Facebook or Google could tap and monetize the law for their own purposes, something the privacy act doesn’t restrict in its current form. Privacy advocates further sought to give consumers the power to sue companies in the event that their personal information was mishandled, an idea backed by California’s attorney general, Xavier Becerra, who will become the act’s chief enforcer when the law goes into effect.

But their efforts to toughen the act faltered. Lawmakers weren’t sold on empowering privacy lawsuits, and advocates faced opposition from well-funded business lobbyists, who argued the proposals would hamstring the Internet and expose companies to unnecessary legal risk. A robust bill to strengthen the privacy act never came to the legislature for a vote.

Organizations like the Internet Association and the California Chamber of Commerce — representing a broad area of Silicon Valley and other industries — mounted their own offensive. They turned out in force for a critical Senate hearing this July, where lobbyists stepped up to a microphone and expressed support for tweaks that would have limited what qualifies as personal information under the act.

California’s current rules grant consumers the right to opt out of the sale of data that’s linked directly to them or that could be linked to them. By trying to narrow what qualifies as personal information, the tech industry essentially would have been restricting how and when consumers can invoke their rights under the state’s privacy law.

Testifying at the hearing, Sarah Boot, who oversees privacy work at the California Chamber of Commerce, said the changes wouldn’t strip people of their new privacy protections. “This is not workable,” she said of the law as written.

The California Chamber of Commerce did not respond to a request for comment.