SAN FRANCISCO — Frustrated by a lack of action at the federal level, privacy advocates pushing for an online Do Not Track law are hoping a California measure will kindle a national debate.
Called the Online Tracking Transparency Act, the bill requires websites to inform users whether and how they honor “do not track” signals that users transmit via their browsers. It also requires that sites tell users when advertisers and data brokers are tracking their online movements.
The legislation, which cleared the State Assembly earlier this month, awaits California Gov. Jerry Brown’s signature. It comes as efforts to create standards for online tracking have stalled in Congress and at the World Wide Web Consortium (W3C), an Internet-standards organization.
“I’m hoping the California bill will set off a digital data stampede for other states to begin regulating privacy,” said Jeff Chester, executive director for the Center for Digital Democracy and a member of the W3C Tracking Protection Group. “It’s not clear there is going to be a standard for Do Not Track from the W3C. It’s likely to be a very weak standard.”
Currently, browsers like Mozilla’s Firefox, Microsoft’s Internet Explorer, Apple Safari and Google Chrome offer users the ability to adjust their settings to send a “do not track” signal, showing they don’t want their browsing habits monitored. But websites, advertisers and online data brokers aren’t required to honor that signal.
The California measure has limited goals. It doesn’t force companies to stop tracking but would make their “invisible” practices more transparent, said Joanne McNabb, director of privacy education policy at the California Attorney General’s Office, which sponsored the measure. The governor has not indicated yet whether he will sign the bill.
Silicon Valley’s Internet giants have said little publicly about the bill. Google declined to comment, and Facebook, Yahoo and Apple didn’t respond to requests for comment.
A spokesman for Redmond, Wash.-based Microsoft called the measure “an important step toward improving individual privacy and transparency.” Alex Fowler, Mozilla’s chief privacy officer, said the legislation “will encourage businesses to consider how Do Not Track applies to them, and in turn push Do Not Track one step closer to widespread adoption.”
Tech-industry trade groups have had a mixed reaction to the legislation.
“The Internet is an area that is evolving every day. The users should have the power of choice here, not government regulations,” said Michael Beckerman, president of the Internet Association, whose members include Google and Facebook. “California should not start the precedent of states or even the federal government regulating this since it’s about the relationship between users and Internet companies.”
TechAmerica, another trade group, initially opposed the bill for trying codify a definition of online tracking and lacking nuanced options for firms to describe how they respond to “do not track” signals. But with subsequent amendments, which included giving websites more flexibility in describing their practices, TechAmerica dropped its opposition and now says it has no position on the measure.
California’s legislative activity contrasts with lack of movement at the federal level. A reintroduced Do Not Track bill from Sen. Jay Rockefeller (D-W.Va.), chairman of the Commerce, Science and Technology Committee, has failed to gain traction. Over the summer, the W3C process stalled when the group’s co-chairs rejected a draft proposal from the Digital Advertising Alliance, an industry group.
The Golden State has long been a trailblazer when it comes to consumer privacy, passing the nation’s first online privacy act in 2004. The law, which requires that websites have a privacy policy, became the de facto national policy because tech companies that do business in California or have users there had to follow its rules. More recently, the state’s attorney general, Kamala Harris, has told mobile-app makers they need to post detailed privacy policies. She has sued Delta Air Lines for allegedly not having a privacy policy on its Fly Delta mobile app.
Tech companies have been paying close attention to Internet-related bills in California. This year, the industry lobbied against a Right to Know Act requiring Web companies to inform users about how their information is collected and shared with data brokers and advertisers. The lawmaker sponsoring the bill delayed consideration for a year.
In 2011, a coalition of tech companies succeeded in killing a social networking privacy bill from state Sen. Ellen Corbett. Corbett this year introduced a similar but more narrowly tailored measure requiring websites to remove specific information like a minor’s social security number or phone number from a social network upon a parent’s request. The bill, which has passed the state Senate and is currently in an Assembly committee, is opposed by Facebook, Google and a slew of tech industry associations.
Privacy advocates said they hope the California tracking transparency bill will create a sense of urgency around the need for Do Not Track standards. They say consumers are looking for such protections, pointing to data like a Pew Research Center study out earlier this month that found nearly nine of 10 Internet users have taken steps to erase or cover up their digital tracks, including clearing their browser history, deleting tracking cookies and installing encryption.
The California measure “gives consumers knowledge,” said John Simpson, director of Consumer Watchdog’s Privacy Project. “And if they have knowledge, maybe they can exercise power.”
