Existing law prohibits a person, firm, corporation or association, or any employee thereof, from making or disseminating in any advertising device, or in any manner or means whatever, including over the Internet, any statement concerning real or personal property or services, which services that is untrue or misleading, as specified.

This bill would prohibit an operator of a social media Internet Web site with a physical presence in California from engaging in the sale of advertising with a computer software account or user that performs an automated task, and that is not verified by the operator as being controlled by a natural person. The bill would require an operator of a social media Internet Web site with a physical presence in California to verify whether an account or profile it hosts on its Internet Web site is being controlled by a computer software account or user that performs an automated task, and if so, to prominently indicate that to users of its site. The bill would require an operator of a social media Internet Web site with a physical presence in California to require an account or profile it hosts on its Internet Web site that it identifies as being controlled by a computer software account or user that performs an automated task to be linked to a natural person.

Existing law prohibits a person, firm, corporation or association, or any employee thereof, from making or disseminating in any advertising device, or in any manner or means whatever, including over the Internet, any statement concerning real or personal property or services, which is untrue or misleading, as specified.

This bill would prohibit an operator of a social media Internet Web site from engaging in the sale of advertising with a computer software account or user that performs an automated task, and that is not verified by the operator as being controlled by a natural person.

Date of Hearing: May 1, 2018

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 1950 (

Author:Levine) – As Amended Ver:April 19, 2018

SUBJECT: Consumers: Internet privacy

SUMMARY: This bill would amend the California Online Protection Privacy Act (CalOPPA) to require that the privacy policy of an operator of a commercial website or online service that collects personally identifiable information (PII) about individual California consumers also disclose whether the operator utilizes bots for the dissemination of information, and that bots are software that, for purposes of this section, can execute commands, reply to messages, gather information, or perform routine tasks such as online searches, either automatically or with minimal human intervention.

EXISTING LAW:

1. Requires, under CalOPPA, an operator of a commercial website or online service that collects PII through the internet about individual consumers residing in California who use or visit its commercial website or online service to conspicuously post its privacy policy on its website, or in the case of an operator of an online service, make that policy available in accordance with specified law. An operator is only deemed to be in violation of CalOPPA if it fails to post its policy within 30 days after being notified of noncompliance. (Bus. & Prof. Code Sec. 22575(a).)
2. The privacy policy required, above, must, among other things:

• Identify the categories of PII that the operator collects through the website or online service about individual consumers who use or visit its commercial website or online service and the categories of third-party persons or entities with whom the operator may share that PII.
• Describe the process by which the operator notifies consumers who use or visit its commercial website or online service of material changes to the operator’s privacy policy for that website or online service.
• Disclose how the operator responds to web browser “do not track” signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of PII about an individual consumer’s online activities over time and across third-party website or online services, if the operator engages in that collection.
• Disclose whether other parties may collect PII about an individual consumer’s online activities over time and across different website when a consumer uses the operator’s website or service. (Bus. & Prof. Code Sec. 22575(b).)

1. Provides that an operator of a commercial website or online service that collects PII through the website or online service from individual consumers who use or visit the commercial website or online service and who reside in California shall be in violation of this section if the operator fails to comply with the provisions, above, or with the provisions of its posted privacy policy in either of the following ways: (1) knowingly and willfully; or (2) negligently and materially. (Bus. & Prof. Code Sec. 22576.)
2. Defines, for purposes of CalOPPA, the following terms:

• “Operator” means any person or entity that owns a website located on the Internet or an online service that collects and maintains personally identifiable information from a consumer residing in California who uses or visits the website or online service if the website or online service is operated for commercial purposes. It does not include any third party that operates, hosts, or manages, but does not own, a website or online service on the owner’s behalf or by processing information on behalf of the owner
• “Consumer” means any individual who seeks or acquires, by purchase or lease, any goods, services, money, or credit for personal, family, or household purposes. (Bus. & Prof. Code Sec. 22577(c), (d).)

FISCAL EFFECT: None. This bill has been keyed nonfiscal by the Legislative Counsel.

COMMENTS:

1. Purpose of this bill: This bill seeks to provide consumers with a disclosure about the use of “bots” by operators of commercial websites or online services. This is an author-sponsored bill.
2. Author’s statement: According to the author, “Internet privacy requirements need to evolve with changes in technology. The code section AB 1950 would amend was initially enacted to address the need for a privacy disclosure for the use of “cookies,” which a website may use to recognize a user and keep track of that user’s online preferences. This bill adds bots to that disclosure obligation, along with a bot definition for purposes of this section. This serves to update this section to reflect the more recent technological development and widespread utilization of bots in online consumer transactions.”
3. Bill adds new disclosure to CalOPPA mandated privacy policies: In 2003, California enacted CalOPPA to require operators of commercial websites to post privacy policies online and adhere to their requirements. (AB 68 (Simitian, Ch. 829, Stats. 2003).) Among other things, CalOPPA requires a website operator’s privacy policy to identify the categories of PII collected about individual consumers who use or visit the website, as well as to disclose the categories of third-party persons or entities with whom the operator may share that PII. For these purposes, PII means individually identifiable information about an individual consumer collected online by the operator from that individual and maintained by the operator in an accessible form, including any of the following: (1) a first and last name; (2) a home or other physical address, including street name and name of a city or town; (3) an e-mail address; (4) a telephone number; (5) a social security number; (6) any other identifier that permits the physical or online contacting of a specific individual; and (7) information concerning a user that the website or online service collects online from the user and maintains in personally identifiable form in combination with an aforementioned identifier. (Bus. & Prof. Code Secs. 22575 and 22577(a).)

More recently, in 2013, CalOPPA was amended to address a newer industry practice: the use of “cookies” to track and collect data and the growing industry practice of sharing internet usage data with third-parties. Specifically, in 2013, AB 370 (Muratsuchi, Ch. 390, Stats. 2013) was enacted to require that the operator of a commercial website or online service disclose how it responds to a web browser’s “do not track” signal (i.e., whether it complies with a signal indicating a request to disable online tracking of an individual consumer) in its privacy policy and what options an individual consumer may have regarding whether or not to permit this collection. AB 370 also required operators to disclose whether other parties on the website or online service are or may be conducting online tracking about an individual consumer’s online activities over time and across different websites when a consumer uses the operator’s website or service.

This bill seeks to now expand the privacy policy disclosures that must be made by operators to California consumers to also disclose whether the operator utilizes bots for the dissemination of information, and that bots are software that, for purposes of this section, can execute commands, reply to messages, gather information, or perform routine tasks such as online searches, either automatically or with minimal human intervention.

Notably, as amended April 19, 2018, this bill would seemingly not apply to internet service providers or social media platforms because CalOPPA specifically applies only to “operators” of commercial websites and online services collecting PII about California “consumers” for which CalOPPA defines (1) “operator” to mean any person or entity that owns a website located on the internet or an online service that collects and maintains PII from a consumer residing in California who uses or visits the website or online service if the website or online service is operated for commercial purposes, and (2) “consumer” to mean any individual who seeks or acquires, by purchase or lease, any goods, services, money, or credit for personal, family, or household purposes. (See Bus. & Prof. Code Sec. 22577, emphasis added.)

1. Definition of bots? As currently drafted, this bill adds a requirement for operators “to disclose” in their privacy policies “whether the operator utilizes bots for the dissemination of information, and that bots are software that, for purposes of this section, can execute commands, reply to messages, gather information, or perform routine tasks such as online searches, either automatically or with minimal human intervention.” (Emphasis added.)

Staff notes that the second clause of this sentence can be interpreted in two different ways. One plausible reading is as a definition of “bots” for purposes of this section. A second way is for the mandated disclosure in the privacy policy itself to include both: (1) a statement that the operator utilizes a bot; and (2) a statement that bots are, for purposes of CalOPPA, software that can execute commands, reply to messages, gather information, or perform routine tasks such as online searches, either automatically or with minimal human intervention.” Absent the wording, “for purposes of this section,” the second plausible reading would likely have been the most natural reading of the clause–and all things considered, still might be. That being said, without additional clarity, operators could very well violate the resulting statute if they do not include a secondary statement as to what “bots” are. Arguably, having some defined understanding of ‘bots” as part of the disclosure would be appropriate, given that a disclosure that bots are used without any information as to what a “bot” is could very well leave a consumer confused.

Related to the issue of competing readings of this clause is a question as to when an operator would be subject to making the disclosure mandated by this bill. Stated another way, without a clear definition of “bots” under this bill, operators will not have clear notice of the circumstances that trigger the need for them to provide this mandated disclosure. Assuming momentarily that the second clause of the bill is intended to operate as a definition of bots for these purposes (as opposed to being part of the disclosure statement itself, as discussed above), the bill appears to contemplate any and all computer software to be a “bot” warranting disclosure. Again, under this bill, “bots are software that […] can execute commands, reply to messages, gather information, or perform routine tasks such as online searches, either automatically or with minimal human intervention.” (Emphasis added.) To that end, it is difficult to imagine any computer software that cannot at the very least execute commands either automatically or with minimal human intervention. For example, auto-reply messages on one’s email would meet this standard; so too would an auto-reply to a consumer that a payment was received and being processed.

Thus, as currently drafted, it is unclear what benefits this information (that operators utilize computer software) would convey to consumers. As such, this bill raises a policy question as to its utility and need. This is particularly of concern given the overwhelming amount of information in privacy policies and terms and conditions, more generally. The more information in those disclosures, the more they run the risk of becoming less useful to users. Thus, as a matter of public policy, it is important that included disclosures be necessary and truly informative. As stated by a coalition of business and technology stakeholders including the California Chamber of Commerce, CompTIA, CTIA, Internet Coalition, State Privacy and Security Coalition, and TechNet, among others, writing in opposition to this bill:

Privacy policies are important legal documents that explain how an organization gathers, uses, or discloses personal data. To ensure that consumers are able to understand them, privacy policies need to be as clear and concise as possible.

Adding a disclosure requirement as to whether a company utilizes “bots” in a privacy policy would be confusing. Consumers would not expect to see a statement about “bots” in a privacy policy. Such a disclosure would also lengthen and clutter policies – for a benefit that is unclear.

The bill’s definition of a “bot” is so broad that there are many contexts where such a disclosure would not even be relevant to privacy. An internet “bot” is a software application that runs automated tasks over the internet. Typically, “bots” perform tasks that are both simple and structurally repetitive, at a much faster rate than would be possible for a human. Just some examples of the automated tasks “bots” perform include, sending an electronic receipt, notifying a bank customer when their account is overdrawn, or simply performing online searches. So many online platforms utilize “bots” for so many purposes, it essentially renders a disclosure about the use of “bots” meaningless.

If this Committee were to approve this bill, it may wish to require the author to clarify that the disclosure itself must include a clear description of the “bots” it uses, not only for purposes of dissemination of information, but also for collection and maintenance of the consumer’s PII given the purpose of CalOPPA.

Amendments may also be necessary to add a more narrow definition of “bots” to the bill to both ensure that the disclosures are meaningful and to clearly provide notice to operators as to when disclosure is necessary for purposes of disclosure. To that end, the author offers the following amendment in effort to address the concern regarding the overbreadth of what would be considered a “bot” under this bill. By changing the “or” to an “and,” the amendment would require a bot to be required to perform all of the listed functions, and not simply any of them (as any computer software may do):

Author’s amendment:

On page 3, line 28, strike “information, and that” and insert “information. For purposes of this section,”

On page 3, line 28, after “software” strike “that, for”

On page 3, line 29, strike “purposes of this section,” and insert “that”

On page 3, line 30, strike “or” and insert “and”

1. Related legislation: SB 1001 (Hertzberg, 2018) would make it unlawful for any person to use a bot, as defined, to communicate or interact with natural persons in California online, with the intention of misleading and without clearly and conspicuously disclosing that the bot is not a natural person. That bill is currently in the Senate Appropriations Committee.
2. Prior legislation: AB 68 (Simitian, Ch. 829, Stats. 2003) see Comment 3.

AB 370 (Muratsuchi, Ch. 390, Stats. 2013) see Comment 3.

1. Double-referral: This bill is double-referred to the Arts, Entertainment, Sports, Tourism, & Internet Media Committee, where it will be heard if passed by this Committee.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

American Civil Liberties Union of California (previous version of the bill)

Electronic Frontier Foundation (previous version of the bill)

California Chamber of Commerce

California Community Banking Network

California Grocers Association

CompTIA

CTIA

Data and Marketing Association

Internet Association

Internet Coalition

State Privacy and Security Coalition

TechNet

Analysis Prepared by: Ronak Daylami / P. & C.P. / (916) 319-2200