California passed the California Consumer Privacy Act of 2018 (AB 375) in June 2018. Although it was a major victory for consumers and privacy advocates, some
industry groups feared it would create hardships for their economic engine, introduce new liabilities, and fail to live up to its promises to protect consumers. Currently Google and Facebook control
more than half of the worldwide market in online advertising, generating billions of dollars a year.
When the California consumer privacy initiatives were introduced, companies in opposition to the legislation -- such as Google, Facebook, Verizon, Comcast and AT&T -- were expected to spend at least $100 million to stop the new laws or reduce their impact. Several of these companies are collectively represented by industry trade groups such as the
Internet Association as well as by the
California Chamber of Commerce. As of last year, Alphabet, the parent company to Google, spent more on lobbyists than any other corporation in America.
Though the consumer privacy bill was unanimously signed into law -- largely due to a groundswell of popular support generated from recent data sharing disclosures such as Facebook's Cambridge Analytica -- additional legislation was expected to amend it.
SB 1121 was introduced as clean up legislation to AB 375. Since its introduction, various groups have proposed changes to clarify or modify its language. Industry groups proposed changes in
this letter. The California Chamber of Commerce has been vocal about opposing the
financial liabilities and hardships that would affect California businesses, and until amendments were made on August 27, they had the bill posted on a list of
job killing legislation. This
video further explains their thoughts. Consumer privacy groups respond to the bill authors
here. And
here is a statement from the Committee To Protect California Jobs. California's Attorney General wrote a letter voicing his own
concerns about the specific implementations of the law.
Additionally several industry groups are pressing for the creation of
federal privacy legislation that would supersede current or future state legislation. And on a related note, Congress has held hearings about data breach notification regulations as recently as
February and
March of this year. As far as data breach laws, individual states currently manage their own regulations. Here is a very helpful
infographic and
report on state data breach laws. California has a list of data breaches as
posted by their Attorney General.
