California lawmakers passed one of the toughest data privacy laws in the United States today, as they faced pressure from an even stronger ballot measure in the state.
The California Consumer Privacy Act of 2018 is set to dramatically change how businesses handle data in the most populous state. Companies that store large amounts of personal information — including major players like Google and Facebook — will be required to disclose the types of data they collect, as well as allow consumers to opt out of having their data sold. The bill, which passed both chambers unanimously, was signed later in the day by Gov. Jerry Brown.
The legislation, which is similar to Europe’s new GDPR protections, is the result of a last-minute attempt to head off a ballot measure that would have brought a slightly different set of privacy rules to the state. The just-passed bill does not fully reproduce the initiative — it would, among other differences, require the disclosure of only the “category” of a third-party that receives personal information, instead of the identity of the third-party itself. But the legislation was close enough that the campaign for the ballot measure agreed to pull its proposal if the bill was signed into law by the deadline to withdraw today.
Perhaps most importantly, passing the privacy rules as legislation allows lawmakers to more easily change them, while a ballot measure would be more difficult to amend. The law is set to come into effect at the start of 2020, giving the tech industry an opportunity to address its grievances.
Companies like Amazon and AT&T lined up to block the ballot measure, pouring millions of dollars into an opposition organization. Alaistair MacTaggart, a real estate mogul largely self-funding the ballot initiative, told The Verge earlier this month that the initiative was polling well. It only recently qualified for a spot on the November ballot.
“We are thrilled that AB 375 has become law,” MacTaggart said in a statement. “This is a monumental achievement for consumers, with California leading the way in creating unprecedented consumer protections for the rest of the nation.”
Correction, 4:26 PM ET: An earlier version of this article incorrectly named the legislation. It is known as the California Consumer Privacy Act of 2018. Additionally, it has been updated to clarify the types of businesses the law applies to.
Update, 5:57 PM ET: Gov. Brown has signed the bill into law.