Consumer Federation of California

Silicon Valley is fighting privacy advocates over a California bill, the first of its kind in the nation, that would require companies like Facebook and Google to disclose to users the personal data they have collected and with whom they have shared it.

The industry backlash is against the "Right to Know Act," a bill introduced in February by Bonnie Lowenthal, a Democratic assemblywoman from Long Beach. It would make Internet companies, upon request, share with Californians personal information they have collected’including buying habits, physical location and sexual orientation’and what they have passed on to third parties such as marketing companies, app makers and other companies that collect and sell data.

The bill highlights how lawmakers are seeking to update privacy laws. An update of a 10-year-old law focused on the direct-marketing industry, the bill could have national impact because of California’s size, and it would bring the state’s privacy practices closer to those common in Europe.

"In 2003, the biggest problem people had with privacy was telemarketing," said Ms. Lowenthal. "Today, there are so many different mobile apps that can track location and spending habits that it’s time for an update in state law."

A week ago, a coalition of businesses and trade groups wrote to Ms. Lowenthal urging her to "not move forward" with a bill that seeks to impose "costly and unrealistic mandates" that could leave them vulnerable to lawsuits, according to a copy of the letter reviewed by The Wall Street Journal.

The coalition includes such trade groups as the Internet Alliance, TechNet and TechAmerica, all of which represent major Internet companies.

This past week, Will Gonzalez, a Facebook lobbyist based in Sacramento, aired concerns in a meeting about how the bill would hurt Facebook’s business, according to a legislative aide. Mr. Gonzalez didn’t respond to requests for comment.

Representatives for Facebook and Google declined to comment on the bill.

A number of states have begun tackling digital privacy, including Nevada and Minnesota, which require Internet service providers to keep private some customer information unless they get permission to disclose it. California already requires websites and apps to have privacy policies.

European law requires that companies must disclose to users which data they collect. Several heavyweights, including Facebook and Google, already offer users options to see some information stored about them.

The proposed new California law would go a step further by also requiring Internet companies to disclose what information they have shared with third parties.

"There is real impact for individuals when they don’t know how their information is being collected and when it is being shared in ways they don’t want," said Nicole Ozer, a policy director at the American Civil Liberties Union of California, which co-sponsored the bill.

For example, the law might require Facebook to disclose more about how third-party apps receive information about users through their friends, Ms. Ozer said. An investigation last year by The Wall Street Journal found that some of the most popular Facebook apps seek the email addresses, current location and sexual orientation, among other details, not only of app users but also of their Facebook friends. Facebook said it acts against app developers who are found to violate its policies.

Robert Callahan, director of state government affairs at TechAmerica, said Web companies already seek to protect users’ privacy. But because websites sometimes gather personal information without attaching it to a user’s name, it would be onerous’and perhaps even impossible’for them to provide individuals with the information this bill requires, he said.

"The burden placed on innovative Internet companies in California’would that outweigh the benefit to consumers of having a deluge of amorphous information?" he said.

The ACLU campaign to change the law comes after the group asked members last year to seek data about themselves from big Web firms using the 2003 law designed to help shed light on direct-marketing practices.

Sara Matlin, a 40-year-old attorney in San Mateo, Calif., ended up frustrated when she tried. After she submitted a request to LinkedIn for example, the company wrote back telling her it "does not actively disclose personally identifiable member information to third parties for direct-marketing purposes" and thus the company is "not required to comply" with the existing law.

LinkedIn spokesman Hani Durzy reiterated that the current law doesn’t require the company to provide information about data shared for purposes other than direct marketing, and said that the company is "keeping an eye on" the new bill, but hasn’t taken a position on it.

The bill is in early stages, and many legislators have yet to familiarize themselves with it, according to their aides. The Assembly judiciary committee will hold a hearing on the bill in mid-April.

"If industry weighs in and says this works, maybe this bill is the right vehicle’but that’s not what I’m hearing right now from industry," said Rich Gordon, a Democratic assemblyman from Menlo Park, which is where Facebook is based.