Consumer Federation of California

Update: AB 1291 has been made into a 2-year bill. See California’s Right to Know Act stalls after opposition from tech lobby

How happy are you with the fact that a long list of Internet companies know so much about you – from your address to your sexual orientation – and are using that information to pad their pockets? How happy are you with the fact that those companies are fighting in the California Legislature to keep it that way?

Few bills in the current session have attracted more ire than AB 1291, an Internet privacy bill authored by Assemblywoman Bonnie Lowenthal, D-Long Beach. A major coalition of business groups, including the California Chamber of Commerce and industry groups that represent big players like Facebook, Google and Microsoft, recently sent a letter to Lowenthal in opposition to the bill. They say it’s “over-broad,” “expensive” and “unworkable.”

They insist that “Californians would be deluged with disclosures” about their personal information. They believe that “this bill would reopen the door to unfair competition lawsuits.” They insist that it’s just too complicated to tell Californians about how their personal information is being used.

They certainly know a lot about how to use all of that complicated information, though – and that’s why a bill like AB 1291 was written in the first place. The bill isn’t perfect, and it could stand to be amended. But the bill’s supporters are absolutely right when they say that the use of our private information by many of these companies has gotten out of hand – and is only going to get worse.

It is indeed disturbing to realize how widespread the practice of selling our personal information to third-party advertisers and data companies has become.

Already there are stories of Americans being turned down for loans because data brokers shared incorrect information, and stories of companies broadcasting very private information (like a pregnancy) on social networks before people have the opportunity to share it with their own families.

Californians want to know more about this – according to the ACLU of California, 82 percent of registered voters are worried about how online companies are using their personal information. They deserve to know more, too.

Most importantly, Californians deserve to have control over how that information is being used. No one should be denied a loan because of reckless data mining, and no one should have aspects of his or her personal life “outed” to the public without that person’s consent. If these companies have the technology to collect all of this information, then surely they have the technology to protect it or take it down.

Where the bill may need some refining is on the matter of legal remedies, especially the prospect that the result could be waves of lawsuits.

Since third-party advertisers and other companies will be involved, it’s extremely important for AB1291 to be specific about punishment for failing to remove a user’s information at that user’s request. Will it be the responsibility of the company that originally mined a user’s profile? Can the third-party company that received the information be exempted from lawsuits – and should it be?

These are important questions that need to be untangled, and unfortunately AB 1291 is too vague about them. But the overall thrust of the bill is clear and necessary – Californians deserve more control over how their personal information is collected and exploited.

The bill is co-sponsored by the ACLU, Electronic Frontier Foundation, Consumer Federation of California, and Electronic Privacy Information Center, among others.