BILL ANALYSIS                                                                                                                                                                                                    �






                             SENATE JUDICIARY COMMITTEE
                             Senator Noreen Evans, Chair
                              2011-2012 Regular Session


          SB 761 (Lowenthal)                                     
          As Amended April 25, 2011 
          Hearing Date: May 3, 2011                              
          Fiscal: Yes
          Urgency: No                                            
          SK                                                     
                                        SUBJECT
                                           
                                   Online Privacy

                                      DESCRIPTION  

          This bill would require the Attorney General, by July 1, 2012, 
          to adopt regulations that would require online businesses to 
          provide California consumers with a method for the consumer to 
          opt out of the collection or use of his or her information by 
          the business. 

                                      BACKGROUND  

          As consumers live out more and more of their lives online, 
          information about their purchases, web searches, and other 
          online activity is increasingly "collected, analyzed, combined, 
          used, and shared, often instantaneously and invisibly." 
          ("Protecting Consumer Privacy in an Era of Rapid Change," 
          Federal Trade Commission, December 2010.)  

          A recent Wall Street Journal investigation found that "�o]ne of 
          the fastest-growing businesses on the Internet . . . is the 
          business of spying on Internet users.  �The investigation] 
          reveals that the tracking of consumers has grown both far more 
          pervasive and far more intrusive than is realized by all but a 
          handful of people in the vanguard of the industry." ("The Web's 
          New Gold Mine: Your Secrets," Wall Street Journal, July 30, 
          2010.)  In its investigation, the newspaper looked at the 50 
          most popular Web sites in the U.S. and, using a test computer, 
          found that those 50 sites installed a total of 3,180 tracking 
          files on the computer, usually with no warning.  Twelve of those 
          sites installed more than 100 tracking tools apiece.  The 
          article continued: 

                                                                     (more)



          SB 761 (Lowenthal)
          Page 2 of ?



             Tracking technology is getting smarter and more intrusive.  
            Monitoring used to be limited mainly to "cookie" files that 
            record websites people visit.  But the Journal found new tools 
            that scan in real time what people are doing on a Web page, 
            then instantly assess location, income, shopping interests and 
            even medical conditions.  Some tools surreptitiously re-spawn 
            themselves even after users try to delete them.

             These profiles of individuals, constantly refreshed, are 
            bought and sold on stock-market-like exchanges that have 
            sprung up in the past 18 months.

            . . .  advertisers are paying a premium to follow people 
            around the Internet, wherever they go, with highly specific 
            marketing messages.  In between the Internet user and the 
            advertiser, the Journal identified more than 100 
            middlemen-tracking companies, data brokers and advertising 
            networks-competing to meet the growing demand for data on 
            individual behavior and interests.  . . .   The most intrusive 
            monitoring comes from what are known in the business as "third 
            party" tracking files.  They work like this: The first time a 
            site is visited, it installs a tracking file, which assigns 
            the computer a unique ID number.  Later, when the user visits 
            another site affiliated with the same tracking company, it can 
            take note of where that user was before, and where he is now.  
            This way, over time the company can build a robust profile.  
            (Id.)

          While information collected using more sophisticated Web 
          tracking technologies can result in targeted advertisements, it 
          can also result in more detailed profiles that can include, 
          among other things, an individual's age, gender, race, income, 
          marital status, zip code, and recent purchases.  In some cases, 
          tracking advertisers are combining the information obtained 
          online with offline records to make statistically generated 
          assumptions about a consumer.  

          For example, AccuquoteLife.com, a life insurance Web site, 
          tested a new system that determines whether an Internet visitor 
          is a "suburban, college-educated baby-boomer."  For those 
          visitors, the Web site displays a default policy of $2 to $3 
          million, whereas a visitor who is determined to be a rural, 
          working class senior citizen would instead see a default policy 
          for $250,000. (Briefing memo regarding legislative hearing on 
          "Do Not Track Legislation: Is Now the Right Time?" U.S. House of 
          Representatives, Committee on Energy and Commerce, Subcommittee 




          SB 761 (Lowenthal)
          Page 3 of ?



          on Commerce, Trade, and Consumer Protection, November 30, 2010.) 
           Also, Capital One Financial Corp. used statistical assumptions 
          from a tracking firm to "instantly decide which credit cards to 
          show first-time visitors to its website." ("What They Know: On 
          the Web's Cutting Edge, Anonymity in Name Only," Wall Street 
          Journal, August 4, 2010.)

          This activity has not gone unnoticed by regulators.  The Federal 
          Trade Commission (FTC) released a preliminary staff report in 
          December 2010 that endorsed a "Do Not Track" mechanism to allow 
          consumers to opt out of the collection of information about 
          their online activities for targeted ads.  In recommending this 
          mechanism, the FTC noted that in many instances, "�c]ompanies 
          engaged in behavioral advertising may be invisible to most 
          consumers.  . . .  The most practical method of providing 
          uniform choice for online behavioral advertising would likely 
          involve placing a setting similar to a persistent cookie on a 
          consumer's browser and conveying that setting to sites that the 
          browser visits, to signal whether or not the consumer wants to 
          be tracked or receive targeted advertisements."  (Federal Trade 
          Commission, supra, at 63-66.)

          Following the FTC's report, U.S. Rep. Jackie Speier introduced 
          H.R. 654, the "Do Not Track Me Online Act", which would require 
          the FTC to promulgate regulations that require the use of an 
          online opt-out mechanism that a consumer may use to easily and 
          effectively prohibit the collection or use of his or her online 
          information.  The bill has been referred to the Subcommittee on 
          Commerce, Manufacturing, and Trade of the House Energy and 
          Commerce Committee.

          Modeled closely on H.R. 654, this bill would require the 
          California Attorney General to adopt regulations that would 
          require online businesses to provide California consumers with a 
          method for the consumer to opt out of the business' collection 
          or use of his or her information transmitted online. 

                                CHANGES TO EXISTING LAW

          Existing law  , the California Constitution, provides that all 
          people have inalienable rights, including the right to pursue 
          and obtain privacy.  (Cal. Const. art. I, sec. 1.)
           
          Existing law  requires online businesses that collect personally 
          identifiable information about California consumers through the 
          Internet to conspicuously post their privacy policies on their 




          SB 761 (Lowenthal)
          Page 4 of ?



          Web sites.  Those privacy policies must identify the categories 
          of personally identifiable information that the business 
          collects through the Web site and the categories of third-party 
          persons with whom the business may share that information.  
          (Bus. & Prof. Code Sec. 22575.)

           Existing law  establishes the Office of Privacy Protection to 
          "protect the privacy of individuals' personal information in a 
          manner consistent with the California Constitution by 
          identifying consumer problems in the privacy area and 
          facilitating the development of fair information practices in 
          adherence with the Information Practices Act  . . .  and to 
          promote and protect consumer privacy to ensure the trust of the 
          residents of this state."  (Gov. Code Sec. 11549.5 et seq.)

           This bill  would require the Attorney General, by July 1, 2012, 
          to adopt regulations that would require persons or entities who 
          do business in California and collect, use, or store online data 
          containing a consumer's "covered information" to provide a 
          consumer with a method for him or her to opt out of the 
          collection or use of his or her personal information transmitted 
          online.

           This bill  would require that the regulations adopted by the 
          Attorney General shall do the following:
           include a requirement for a business to disclose, in a manner 
            that is easily accessible to a consumer: (1) information on 
            its collection, use, and storage of information practices; (2) 
            how the entity uses or discloses covered information; and (3) 
            the names of the persons to whom the entity would disclose 
            covered information; and 
           prohibit the collection or use of covered information by a 
            business for which a consumer has opted out of such collection 
            or use, unless the consumer changes his or her opt-out 
            preference to allow the collection or use of that information.

           This bill  would provide that the regulations shall not interfere 
          with, affect, or prohibit a commercial relationship between a 
          consumer and a business where the consumer has expressly opted 
          in to the collection and use of his or her covered information 
          by the business for the purpose of engaging in that commercial 
          relationship.  This bill would specify, however, that the 
          regulations may regulate and affect such a commercial 
          relationship if a majority of the business' revenue is derived 
          from online advertising and marketing. 





          SB 761 (Lowenthal)
          Page 5 of ?



           The bill  would provide that the regulations may do the 
          following: 
           include a requirement that a business provide a consumer with 
            a means to access his or her covered information and its data 
            retention and security policies in a format that is clear and 
            easy to understand; and
           include a requirement that some or all of the regulations 
            apply with regard to the collection and use of covered 
            information, regardless of the source.

           This bill  would permit the Attorney General to exempt certain 
          commonly accepted commercial practices, including the following: 

           providing, operating, or improving a product or service used, 
            requested, or authorized by the consumer, including ongoing 
            customer service and support;
           analyzing data related to use of the product or service for 
            purposes of improving the products, services, or operations; 
           basic business functions such as accounting, inventory and 
            supply chain management, quality assurance and internal 
            auditing; 
           protecting or defending rights or property, including 
            intellectual property, against actual or potential security 
            threats, fraud, theft, unauthorized transactions; or other 
            illegal activities; 
           preventing imminent danger to the personal safety of an 
            individual or group of individuals;
           complying with a federal, state, or local law, regulation, 
            rule, or other legal requirement, including disclosures 
            pursuant to a court order, subpoena, summons, or other 
            properly executed compulsory process; and 
           any other category of operational use specified by the 
            Attorney General in regulations.

           This bill  would prohibit a covered business from selling, 
          sharing, or transferring a consumer's covered information. 

           This bill  would provide that a business that willfully fails to 
          comply with the Attorney General's regulations is liable to a 
          consumer in a civil action in an amount equal to the sum of 
          actual damages but in no event less than $100 or more than 
          $1,000 as well as punitive damages.  In the case of a successful 
          action, the business would be liable to the consumer for 
          reasonable attorney's fees and costs.  This bill would specify 
          that such an action must be commenced no later than two years 
          after the date upon which the claimant first discovered or had a 




          SB 761 (Lowenthal)
          Page 6 of ?



          reasonable opportunity to discover the violation.   

           This bill  would define "covered entity" to mean a person or 
          entity doing business in California that collects, uses, or 
          stores online data containing covered information from a 
          consumer in the state.

           This bill  would not apply to government entities or businesses 
          that store information from or about fewer than 15,000 
          individuals provided that the business does not collect or store 
          "sensitive information," as defined or use the information to 
          study, monitor, or analyze consumers' behavior, as its primary 
          business. 

           This bill  would define "covered information" to mean any of the 
          following that is transmitted online:
           the online activity of the individual such as the Internet Web 
            sites and content from those sites accessed; the date and hour 
            of online access; the computer and geolocation from which 
            online information was accessed; and the means by which online 
            information was accessed, such as a device, browser, or 
            application;
           any unique or substantially unique identifier, such as a 
            customer number or Internet Protocol address; and 
           personal information including, a name; postal address or 
            other location; email address; telephone or fax number; 
            government-issued identification number; financial account 
            number; credit card or debit card number; or required security 
            codes or passwords.

           This bill would provide that "covered information" does not 
          include the title, business address, business email address, 
          business telephone or fax number associated with an individual's 
          status as an employee of the organization.  It also would not 
          include an individual's name when collected, stored, used, or 
          disclosed in connection with that employment status or any 
          information collected from or about an employee by an employer, 
          prospective employer, or former employer that directly relates 
          to the employee-employer relationship. 

           This bill  would define "sensitive information" to include any of 
          the following: 
           any information that is associated with an individual's 
            covered information and relates directly to that individual's, 
            among other things: (1) medical history, physical or mental 
            health; (2) race or ethnicity; (3) religious beliefs and 




          SB 761 (Lowenthal)
          Page 7 of ?



            affiliation; (4) sexual orientation or sexual behavior; (5) 
            income, assets, and liabilities or financial records; and (6) 
            precise geolocation information and any information about the 
            individual's activities and relationships associated with that 
            location;
           an individual's unique biometric data, including a fingerprint 
            or retina scan, or social security number; and
           information deemed sensitive pursuant to the regulations 
            adopted by the Attorney General. 
                                        COMMENT
           
           1.Stated need for the bill  

          In support of the bill, the author writes: 

            Internet tracking is invasive and pervasive.  Wherever 
            consumers go online and whatever they do is tracked usually 
            without their knowledge and consent.  What they click on, 
            purchase, or share with others is compiled, analyzed and used 
            to profile them.  The data is often used to target 
            advertising, but can also be used to make assumptions about 
            people in connection with employment, housing, insurance, and 
            financial services; for purposes of lawsuits against 
            individuals; and for government surveillance.

            At the moment there are no state or federal limits on what 
            information can be collected, with whom it can be shared, how 
            long it can be retained or how it can be used.  A "Do Not 
            Track" mechanism would give consumers control over whether 
            their data is collected.

          The sponsor, Consumer Watchdog, writes "�n]early 80 percent of 
          Californians use the Internet and almost 45 percent use 
          Facebook.  However, millions are unaware that their online 
          behavior is being tracked with their data collected and sold to 
          advertisers.  There is no longer any anonymity on the Web.  The 
          most persona information about people's online habits is 
          collected and eventually bought and sold, often instantaneously 
          and invisibly.  Data collection practices have become a business 
          themselves, driven by profits at consumers' expense."  

           2.Requiring the Attorney General to adopt regulations requiring 
            online businesses to provide consumers a method to opt out of 
            the collection or use of their information
           
          This bill would require the Attorney General, in consultation 




          SB 761 (Lowenthal)
          Page 8 of ?



          with the Office of Privacy Protection, to adopt regulations that 
          would require online businesses to provide California consumers 
          with a method for the consumer to opt out of the business' 
          collection or use of his or her information transmitted online. 

          With respect to this bill, the Attorney General has stated her 
          "strong support for state legislation to enhance Internet 
          privacy protections for consumers."  The Attorney General 
          further writes, ". . . SB 761 would have the California 
          Department of Justice assume a substantial regulatory role over 
          Internet privacy.  . . .  there has already emerged some 
          passionate disagreement over whether the bill's approach is the 
          right one.  We are committed to working with you, and with 
          stakeholders and committee staff, to develop a proposal that 
          appropriately balances personal privacy with the operational and 
          business needs of corporate and other entities having an 
          Internet presence." 

          While this bill would largely leave to the Attorney General the 
          details of how to accomplish this mandate, the bill would 
          require that the regulations do two things: (1) require 
          transparency; and (2) prohibit the collection or use of 
          information if a consumer has opted out. 

              a.   Regulations must require transparency 
              
            First, the regulations must include a requirement for a 
            business to disclose, in a manner that is easily accessible to 
            a consumer, all of the following: (a) information on the 
            business' collection, use, and storage of information 
            practices; (b) how the business uses or discloses covered 
            information; and (c) the names of the persons to whom the 
            business would disclose covered information.  

            This provision is intended to address one of the more 
            frustrating issues with respect to the collection and use of 
            consumers' online information for behavioral advertising-the 
            lack of transparency.  As noted earlier, much tracking by 
            third parties is done surreptitiously and consumers have no 
            knowledge that their online behavior is being tracked.  The 
            author notes that some search engines and browsers do have 
            features that provide some consumer control.  For example, 
            while Microsoft's Internet Explorer 8 has features that "allow 
            a user to browse the Web without being tracked," these 
            features often only work if the user resets the privacy 
            controls at the start of each new browsing session.  ("FTC 




          SB 761 (Lowenthal)
          Page 9 of ?



            Backs Plan to Honor Privacy of Online Users," New York Times, 
            December 1, 2010.) 

            Staff notes that opponents of this bill assert that it is 
            unnecessary because consumers can already opt out of data 
            collection using tools on their browser, and write, "�t]he 
            four leading internet browsers-Internet Explorer, Safari, 
            Firefox, and Google Chrome-all provide user-friendly filtering 
            options that block the ability of companies to collect data or 
            track Internet use.  These include features that disable third 
            party cookies and 'in private' browsing features." In its 
            report, the FTC acknowledged these efforts but raised concerns 
            that consumers are often unaware that they have these choices 
            in part because the option may be difficult to find and, even 
            if consumers are aware, they may be confused by a lack of 
            clarity in how choices are presented and implemented.  
            Further, consumers may believe that they have opted out of 
            tracking by blocking third party cookies, but they could still 
            be tracked using a "Flash cookie," which is stored in an area 
            of the computer that is not controlled by the browser and thus 
            is not deleted when other cookies are deleted or cleared from 
            the browser.  (Federal Trade Commission, supra, at 65-66.)  
            The sponsor of this bill also raises concern that there is 
            currently no requirement that a Web site honor a "do not 
            track" request.




              b.   Regulations must prohibit the collection or use of 
               information if a consumer has opted out 
             
            Second, the regulations must prohibit the collection or use of 
            covered information by a business for which a consumer has 
            opted out of such collection or use, unless the consumer 
            changes his or her opt-out preference to allow the collection 
            or use of that information.  

            This provision is intended to make the opt-out method 
            developed by the Attorney General meaningful so that if a 
            consumer opts-out, the business must comply with that choice 
            unless the consumer changes his or her mind. 

            This bill does not contain language providing for how the 
            opt-out method might functionally work.  It is presumed that 
            the Attorney General, through the regulatory process, would 




          SB 761 (Lowenthal)
          Page 10 of ?



            determine this.  The FTC's staff report might provide some 
            guidance in that its recommendation for "the most practical 
            method of providing uniform choice for online behavioral 
            advertising would likely involve placing a setting similar to 
            a persistent cookie on a consumer's browser and conveying that 
            setting to sites that the browser visits, to signal whether or 
            not the consumer wants to be tracked or receive targeted 
            advertisements."  (Federal Trade Commission, supra, at 66.)  
            Yet, it is not clear whether such a method would completely 
            address surreptitious tracking technologies such as Flash 
            cookies which do not remain under the browser's control.

           1.Regulations may include provisions relating to access  

          This bill would provide that the regulations adopted by the 
          Attorney General may include a requirement that a business 
          provide consumers with a means to access their information that 
          is collected and stored by the business.  This provision stems, 
          in part, from a discussion in the FTC's staff report in which 
          Commission staff recommended that consumers be given reasonable 
          access to their data which should be proportionate to the 
          sensitivity of the data and the nature of its use.  (Federal 
          Trade Commission, supra, at 72.)
                                                 
          This provision is intended to address the concern that data 
          brokers and other companies who are unknown to consumers collect 
          their information and combine it with other information about 
          them to sell to third parties.  If a company maintains data 
          about a consumer and makes important decisions about that 
          consumer, it is important that he or she be able to know what 
          information is held about him or her and correct it if it is 
          inaccurate.  

          Access to consumer information maintained by a company raises 
          additional significant policy issues, however.  For example, in 
          order to provide a consumer access to his or her information, 
          the company must be able to authenticate the identity of the 
          consumer.  Otherwise, an identity thief could pose as the 
          consumer and gain access to his or her information. 

          In the online context, opponents of this bill argue that an 
          access requirement would result in companies ". . . ironically 
          �having] to take information that they currently collect and use 
          in non-individually identifying form and instead to collect and 
          keep it in a usuable form to be able to respond to individuals' 
          request to provide data about that individual." 




          SB 761 (Lowenthal)
          Page 11 of ?




           4.   Bill would not affect instances where a consumer has 
            expressly opted in to the    collection of his or her 
            information  

          This bill would provide that the regulations adopted by the 
          Attorney General shall not interfere with, affect, or prohibit a 
          commercial relationship between a consumer and a business where 
          the consumer has expressly opted in to the collection and use of 
          his or her covered information by the business for the purpose 
          of engaging in that commercial relationship.  

          This language is intended to permit those commercial 
          relationships between a consumer and a company where the 
          consumer has expressly opted in to the collection and use of his 
          or her information in order to engage in that commercial 
          relationship.  For example, a consumer may sign up to 
          periodically receive newsletters from a company and provide his 
          or her information.  In this case, the consumer has opted in to 
          the collection.  

          The provision does not apply to, and thus the regulations may 
          affect, a commercial relationship if a majority of the business' 
          revenue is derived from online advertising and marketing.  
          Opponents object to this provision because, they argue, it 
          "gratuitously singles out advertising companies for special 
          regulation.  . . .  Opt-in consent is not a viable compliance 
          route for most tracking models, but the blatant discrimination 
          in this approach is pointless and inappropriate.  California is 
          a leader in the Internet advertising industry.  . . .  
          Disrupting this industry's revenue streams directly affects its 
          ability to create jobs."

          5.   Prohibition against further sale, sharing, or transfer  

          This bill would prohibit a covered business from selling, 
          sharing, or transferring a consumer's information.  While this 
          provision is intended to prohibit any further sale, sharing, or 
          transfer of a consumer's information, it is not intended to 
          prohibit that sharing or transferring if a consumer has 
          expressly opted in to that relationship.  For example, the 
          author and his sponsor indicate that this provision is not 
          intended to prevent a business from completing a commercial 
          transaction with the consumer.  As a result, the following 
          amendment is suggested: 





          SB 761 (Lowenthal)
          Page 12 of ?




             Suggested amendment
             
            On page 6, line 8, after "information" insert "except that the 
            regulations adopted by the Attorney General shall permit a 
            covered entity to enter in to a commercial transaction with a 
            consumer and to collect, store, and share that consumer's 
            covered information solely to complete that transaction."

          Opponents argue that the provision described above would impose 
          "a free-standing flat ban on any covered entity sharing or 
          transferring any covered information, for any purpose at all."  
          While the bill would still limit the selling, sharing, or 
          transferring of information, the amendment suggested above would 
          appear to help address some opposition concern given that it 
          would allow for the collection, storing, and sharing of a 
          consumer's information in order to complete a transaction 
          requested by the consumer.  

          This bill would also permit the Attorney General to exempt from 
          the regulations certain commonly accepted commercial practices, 
          including, among others, providing a product requested by the 
          consumer; allowing for basic business functions such as 
          accounting, inventory and supply chain management, quality 
          assurance and internal auditing; protecting against actual or 
          potential security threats, fraud, theft, unauthorized 
          transactions; or other illegal activities; and preventing 
          imminent danger.   The Attorney General may also exempt any 
          other category of operational use.

          As a result, the regulations may very well not apply to uses in 
          which a company might use tracking to guard against fraud or 
          unauthorized transactions (e.g., attempting to sign up for 
          Facebook or some other online service where the registrant must 
          be over a certain age).  

          6.   Additional support arguments   

          Supporter Privacy Activism writes:

            Online tracking is all but universal and often impossible 
            either to detect or control.  When a user visits a webpage, it 
            almost inevitably contains tiny images or invisible JavaScript 
            that exists for the sole purpose of tracking and recording 
            browsing habits.  These data collecting devices persist on a 
            user's hard drive and enable the site or the tracking company 




          SB 761 (Lowenthal)
          Page 13 of ?



            to collect data over time and to build profiles.  The 
            explosion of social networks makes it far easier to combine 
            third-party tracking data with personal information to create 
            highly detailed personally identifiable profiles. 

          7.   Support if amended position  

          The Electronic Frontier Foundation (EFF) has a "support if 
          amended" position on this bill.  EFF notes that it "has joined 
          the Federal Trade Commission and companies like Mozilla and 
          Microsoft in supporting Do Not Track, a simple, universal, 
          browser-based signaling mechanism that would make it easy for 
          consumer to say 'don't track me.'"  EFF continues:

            . . .  we are particularly troubled by �the bill's] failure to 
            clearly distinguish between first parties and third parties.  
            A 'first party is a website a user knowingly visits and thus 
            has a direct relationship with.  A 'third party,' such as a 
            cross-domain advertising company, is often embedded within a 
            first party site so that consumers may not even realize that 
            the third-party tracking company is present, and thus cannot 
            protect themselves.  While we acknowledge privacy concerns 
            about data collection by first-party websites, we believe that 
            these websites do not currently raise the same serious privacy 
            issues as third parties.  The rampant, cross-domain, invisible 
            data collection by third-party tracking companies is a grave 
            threat to online consumer privacy.  We believe SB 761 should 
            be amended to focus specifically on third parties, ensuring 
            that consumers can easily opt-out of such tracking.

          The author acknowledges the concern and indicates that "�s]ome 
          Websites that raise the largest privacy concerns, such as Google 
          and Facebook, are primarily first party sites.  Consumers are 
          justifiably concerned about protecting their personal data when 
          they visit those sites.  This bill does not mandate that 
          first-party and third-party sites be treated in exactly the same 
          manner under a Do Not Track regulation. There may well be some 
          first-party activities that should be allowed under a Do Not 
          Track mechanism, that would be prohibited for a third-party 
          site.  The bill envisions those distinctions being made through 
          the regulations promulgated by the Attorney General in 
          consultation with the Office of Privacy Protection.  Indeed, the 
          bill specifically provides: 'The regulations shall not interfere 
          with, affect, or prohibit a commercial relationship between a 
          consumer and a covered entity where the consumer expressly opts 
          in to the collection of his or her covered information by the 




          SB 761 (Lowenthal)
          Page 14 of ?



          covered entity for the purpose of engaging in that commercial 
          relationship.'"

          8.   Additional opposition arguments   

          In addition to the arguments described above, opponents of this 
          bill also write that the bill will "harm California's Internet 
          economy and innovation" and would "create a second, conflicting 
          set of standards to which companies would have to conform or 
          else face class action lawsuits.  This would, in turn, create 
          significant confusion and uncertainty for investors, businesses, 
          and consumers.  Online commerce would simply be unworkable if 
          websites were forced to comply with a patchwork of privacy and 
          notice laws.  This would impose an unprecedented and arduous 
          regulatory burden on Internet commerce."

          Opponents further argue that the bill is constitutionally 
          infirm, writing that "�i]nternet commerce is an inherently 
          interstate activity and SB 761 would regulate businesses far 
          beyond California's borders.  Websites cannot restrict who 
          visits their sites and cannot reliably know if a visitor is a 
          California resident.  Therefore every Internet website in the 
          world would need to change their practices in order to comply 
          with the law or risk violating it and facing costly class action 
          lawsuits. As a result, any out-of-state company affected by the 
          law would be entitled to bring a Commerce Clause challenge under 
          42 U.S.C. �1983."

          The U.S. Constitution grants Congress the power to regulate 
          commerce among the states. (U.S. Constitution, art. I, sec. 8.)  
          From this grant of power, the U.S. Supreme Court has inferred 
          that states may not enact laws that burden interstate commerce.  
          (Gibbons v. Ogden (1824) 22 U.S. 1.)  The threshold test for 
          whether a state law violates the dormant commerce clause is 
          whether the law affects interstate commerce.  If the answer to 
          that question is yes, then the court looks to whether the state 
          law discriminates against out-of-staters or whether it treats 
          everyone alike.  A state law that does not discriminate between 
          the two-as this bill arguably would not-generally is upheld 
          unless it is found to place a burden on interstate commerce that 
          outweighs its benefits.  (Pike v. Brace Church (1970) 397 U.S. 
          137.)  In this case, opponents argue that because an online 
          business will not know whether a computer user is in California, 
          all online businesses would have to change their practices to 
          satisfy California law.  Despite that argument, this bill would 
          arguably enforce best business practices.   In addition, the 




          SB 761 (Lowenthal)
          Page 15 of ?



          author's office contends that a company can tell if a consumer 
          is in California based on the consumer's IP address.

          9.   Amendments  

          The following technical amendments are necessary:

             (a)  On page 4, line 36, after "the" insert "covered 
               entity's"

             (b)  On page 4, line 38, after "discloses" strike "that" and 
               insert "covered" 

             (c)  On page 4, line 39, strike the second "that" and insert 
               covered"


           Support  : Attorney General Kamala D. Harris; Common Sense Media; 
          Consumer Federation of California; Electronic Frontier 
          Foundation (if amended); Privacy Activism; 

           Opposition  :  A's; American Advertising Federation; American 
          Express; American Insurance Association; Amway; ANA; AOL; 
          Association of California Insurance Companies; Association of 
          California Life & Health Insurance Companies; Acxiom; California 
          Attractions and Parks Association; California Bankers 
          Association; California Cable & Telecommunications Association;  
          California Chamber of Commerce; CalCom; CTIA, the Wireless 
          Association; Direct Marketing Association; Entertainment 
          Software Association;  Google; iab; Internet Alliance; National 
          Business Coalition on E-Commerce and Privacy; Motion Picture 
          Association of America; NetChoice; Personal Insurance Federation 
          of California;  Privacy & Security Coalition; Technet; Time 
          Warner Cable; Toy Industry Association, Inc.; Yahoo; 24-7 
          RealMedia; 4As, American Association of Advertising Agencies 
                                        HISTORY
           
           Source  :  Consumer Watchdog

           Related Pending Legislation  :  None Known 

           Prior Legislation  :  None Known

                                   **************






          SB 761 (Lowenthal)
          Page 16 of ?