SoylentNews

upstart writes in with a submission, via IRC, for chromas.

Advertisers want exemption from web privacy rules that, you know, enforce privacy

Amid the final rulemaking before the California Consumer Privacy Act (CCPA) is scheduled to take effect next year, five ad industry groups have asked California Attorney General Xavier Becerra to remove a requirement that businesses honor the privacy choices internet users make through browser settings, extensions, or other controls.

[...] The CCPA, which takes effect in January, 2020, will provide Californians with greater legal privacy protections than anywhere else in the US (though still short of Europe's GDPR), putting pressure on federal lawmakers who are trying to formulate consistent privacy rules for the entire country. Meanwhile, technology and ad companies have been trying to gut the CCPA and would welcome a weaker federal standard that supersedes the California law.

The privacy rules includes a consumer right to know whether information is being collected, to request details about the information categories collected, to know what personal information is collected, to refuse to have information collected, to delete collected information, and bans any degredation of service if the user opts to retain their privacy.

Among its requirements, the law says, "If a business collects personal information from consumers online, the business shall treat user-enabled privacy controls, such as a browser plugin or privacy setting or other mechanism, that communicate or signal the consumer's choice to opt-out of the sale of their personal information as a valid request [under the law]."

In a December 6th letter obtained by MediaPost reporter Wendy Davis and provided to The Register as a courtesy, the five ad industry groups – The American Association of Advertising Agencies (4As), the Internet Advertising Bureau (IAB), The Association of National Advertisers (ANA), the American Advertising Federation (AAF), and the Network Advertising Initiative (NAI) – complain to Becerra that such proposals would harm consumer choice.

[...] The Register asked the IAB for comment and a spokesperson pointed to pages 13 and 14 of its letter, which suggests Becerra adopt rules that allow information collecting businesses to ignore privacy controls "if the business includes a 'Do Not Sell My Personal Information' link and offers another method for consumers to opt-out of personal information sale by the business."

In the past, the US Federal Trade Commission has not looked kindly on ignoring browser-expressed privacy choices. In 2012, Google agreed to pay $22.5m for, among other things, circumventing the privacy controls in Apple's Safari browser.

In a statement emailed to The Register, Mozilla stressed that privacy settings should be easy to use and said it would be irresponsible and wrong to ignore the preferences users express through their browser settings.

"Of course, that is also why organizations like the Interactive Advertising Bureau find requirements like those in CCPA so threatening, because those requirements empower people to limit what data advertisers collect about them – and empower regulators to investigate and enforce if they don't," a Mozilla spokesperson said.

"So, the more hurdles that can be thrown in the way of setting adoptions like recognizing browser or plug-in flags, the longer such data can be traded and sold when mechanisms are limited."

Mozilla said that in the absence of standard mechanisms to express privacy preferences, it has enabled Enhanced Tracking Protection by default to help consumers regain control over those attempting to track their browsing activity online. ®

Original Submission