The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

This bill would require a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all or part of the transferor to comply with a consumers opt out direction to the transferor.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

This bill would incorporate additional changes to Section 1798.120 of the Civil Code proposed by AB 1949 to be operative only if this bill and AB 1949 are enacted and this bill is enacted last.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

This bill would require a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all or part of the transferor to comply with a consumers opt out direction to the transferor.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

This bill would incorporate additional changes to Section 1798.120 of the Civil Code proposed by AB 1949 to be operative only if this bill and AB 1949 are enacted and this bill is enacted last.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

This bill would require a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all or part of the transferor to comply with a consumers opt-out direction to the transferor.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

Existing law requires the Department of Technology to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law defines automated decision system as a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons.

This bill would state the intent of the Legislature to enact legislation that would create a disclosure requirement for content generated through artificial intelligence.

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 1824

Author:(Valencia)

As Amended Ver:August 22, 2024

Majority vote

SUMMARY

Requires a business that assumes control of all or some part of a transferor business that includes the transfer of a consumer's personal information to comply with a consumer's direction to the transferor pursuant to the California Consumer Privacy Act (CCPA).

Senate Amendments

Add language to avoid chaptering out issues with AB 1949 (Wicks, 2024).

COMMENTS

The CCPA grants residents of the state the right to direct a business not to sell or share their personal information at any time (Civil Code Section 1798.120). However, businesses often change through mergers, bankruptcy, or acquisition. In the event of one of those changes, a business may be absorbed into another business entirely or it may start operating under a merged or combined entity. Theoretically, the opt-out preferences of the customers of a company being acquired should transfer to the new business; however, that may not always be the case.

While the CCPA ensures that at any time consumers can direct a business to not sell or share their data. However, the CCPA is silent on consumers' rights when there is a merger or acquisition that takes place, potentially leaving consumers' personal data vulnerable to disclosure. The purpose of this bill is to remove any ambiguity about what happens to consumers' opt-out preferences when businesses combine, by requiring the business that acquires personal consumer information from the original business to honor the preferences of those consumers

According to the Author

Companies increasingly want to collect raw personal data, some companies have even built entire business models around the collection and sale of consumer data. Data is desirable because it provides granular information about its users and allows companies to deploy targeted advertising, understand product desirability, and grow profits, to name a few reasons. Therefore, there is a need to ensure consumers understand how the collection of their personal information is being used. The CCPA is silent on consumers' rights when there is a merger or acquisition that takes place, leaving consumers' personal data vulnerable to businesses who they may be unfamiliar with or may not want to share their data and personal information with.

Arguments in Support

In support of the bill, Oakland Privacy states:

Mergers and acquisitions can be a time of enhanced privacy risks, especially when the merging companies are large, national or even multi-national in scope. The transfer of large databases can raise security risks of a breach or a hack, and the integration of differing privacy policies can result in reduced protections for users/consumers in the merged entity. The International Association of Privacy Professionals (IAPP) outlines the demands that large mergers can place on in-house privacy counsels. By requiring a second look at existing customer opt-out requests during merger implementation, AB 1824 protect user/consumers and their privacy rights during these complex transactions.

Arguments in Opposition

None on file.

FISCAL COMMENTS

According to the Appropriations Committee:

Minor and absorbable cost to the California Privacy Protection Agency to enforce violations of the requirement added by this bill.

VOTES:

ASM PRIVACY AND CONSUMER PROTECTION: 11-0-0

YES: Bauer-Kahan, Joe Patterson, Bryan, Dixon, Hoover, Irwin, Lowenthal, Ortega, Ward, Wicks, Wilson

ASM APPROPRIATIONS: 14-0-1

YES: Wicks, Sanchez, Arambula, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Grayson, Haney, Hart, Jim Patterson, Pellerin, Ta

ABS, ABST OR NV: Villapudua

ASSEMBLY FLOOR: 73-0-7

YES: Addis, Aguiar-Curry, Alanis, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Juan Carrillo, Wendy Carrillo, Cervantes, Chen, Connolly, Davies, Dixon, Essayli, Mike Fong, Vince Fong, Friedman, Gabriel, Gallagher, Garcia, Gipson, Grayson, Haney, Hart, Holden, Hoover, Irwin, Jackson, Jones-Sawyer, Kalra, Lackey, Lee, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Rendon, Reyes, Luz Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Soria, Ta, Ting, Valencia, Villapudua, Waldron, Wallis, Ward, Wicks, Wilson, Wood, Zbur

ABS, ABST OR NV: Calderon, Megan Dahle, Flora, Low, Mathis, Weber, Robert Rivas

SENATE FLOOR: 40-0-0

YES: Allen, Alvarado-Gil, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dahle, Dodd, Durazo, Eggman, Glazer, Gonzalez, Grove, Hurtado, Jones, Laird, Limón, McGuire, Menjivar, Min, Newman, Nguyen, Niello, Ochoa Bogh, Padilla, Portantino, Roth, Rubio, Seyarto, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk

UPDATED

VERSION: August 22, 2024

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0004846

 THIRD READING  

Bill No: AB 1824

Author: Valencia (D)

Amended: 8/22/24 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 11-0, 6/4/24

AYES: Umberg, Wilk, Ashby, Caballero, Durazo, Laird, Niello, Roth, Stern, Wahab, Wiener

SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8

ASSEMBLY FLOOR: 73-0, 5/2/24 (Consent) - See last page for vote

SUBJECT: California Consumer Privacy Act of 2018: opt-out right: mergers

SOURCE: Author

DIGEST:

This bill requires a business that assumes control of all or some part of a transferor business that includes the transfer of a consumer’s personal information to comply with a consumer’s direction to the transferor pursuant to the California Consumer Privacy Act (CCPA).

Senate Floor amendments of 8/22/24 add language to avoid chaptering out issues with AB 1949 (Wicks, 2024).

ANALYSIS:

Existing law:

1. Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
2. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120.)
3. Provides that the obligations imposed by the CCPA shall not restrict a business’s ability to carry out certain conduct, including complying with federal, state, or local laws or to cooperate with law enforcement. This also includes cooperating with a government agency’s request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury where certain circumstances are met. (Civ. Code § 1798.145(a).)
4. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
5. Establishes the California Privacy Rights Act of 2020 (CPRA), which amends the CCPA and creates the California Privacy Protection Agency (PPA), which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
6. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)

This bill provides that a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all of, or part of, the transferor shall comply with a consumer’s direction to the transferor made pursuant to this subdivision. It includes a finding that this furthers the purposes of the CPRA.

Background

The California Consumer Privacy Act of 2018 (CCPA) grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale or sharing of information; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) It places attendant obligations on businesses to respect those rights. In the November 3, 2020 election, voters approved Proposition 24, which established the CPRA. The CPRA amends the CCPA, limits further amendment, and creates the PPA.

In response to privacy concerns related to tech-industry mergers, this bill requires a business that assumes control of all or some part of a transferor business that includes the transfer of a consumer’s personal information to comply with a consumer’s direction to the transferor pursuant to the right to opt out of the sale or sharing of personal information pursuant to the CCPA.

This bill is author-sponsored. It is supported by Oakland Privacy and Protection of the Educational Rights of Kids (PERK) Advocacy. The Committee received no timely opposition. For a more thorough assessment of this bill, please see the Senate Judiciary Committee analysis.

Comments

According to the author:

Companies increasingly want to collect raw personal data, some companies have even built entire business models around the collection and sale of consumer data. Data is desirable because it provides granular information about its users and allows companies to deploy targeted advertising, understand product desirability, and grow profits, to name a few reasons. Therefore, there is a need to ensure consumers understand how the collection of their personal information is being used. AB 1824 will protect consumers’ rights to privacy when there are mergers that take place by requiring the merging business to notify newly acquired consumers of their right to opt-out of the sale or sharing of their data.

This bill is motivated in part by privacy concerns that arose out of the acquisition of WhatsApp by Facebook (now Meta). According to a ProPublica report:

Deploying an army of content reviewers is just one of the ways that Facebook Inc. has compromised the privacy of WhatsApp users. Together, the company’s actions have left WhatsApp — the largest messaging app in the world, with two billion users — far less private than its users likely understand or expect. A ProPublica investigation, drawing on data, documents and dozens of interviews with current and former employees and contractors, reveals how, since purchasing WhatsApp in 2014, Facebook has quietly undermined its sweeping security assurances in multiple ways. (Two articles this summer noted the existence of WhatsApp’s moderators but focused on their working conditions and pay rather than their effect on users’ privacy. This article is the first to reveal the details and extent of the company’s ability to scrutinize messages and user data — and to examine what the company does with that information.)

Many of the assertions by content moderators working for WhatsApp are echoed by a confidential whistleblower complaint filed last year with the U.S. Securities and Exchange Commission. The complaint, which ProPublica obtained, details WhatsApp’s extensive use of outside contractors, artificial intelligence systems and account information to examine user messages, images and videos. It alleges that the company’s claims of protecting users’ privacy are false. “We haven’t seen this complaint,” the company spokesperson said. The SEC has taken no public action on it; an agency spokesperson declined to comment.

Facebook Inc. has also downplayed how much data it collects from WhatsApp users, what it does with it and how much it shares with law enforcement authorities.^[1]

This bill amends the “right to opt-out” of the sale or sharing of personal information by clarifying that a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all of, or part of, the transferor is required to comply with a consumer’s direction to the original business pursuant to the opt-out right.

When a consumer exercises their right under the CCPA to restrict the sharing or selling of their personal information, they are seeking to protect their information and to keep it from being used in unknown ways by other entities. Therefore, the consumer likely expects that protection and limitation to continue regardless of whether the relevant business changes hands. This bill clarifies the law to ensure that consumers’ expectations are met.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

SUPPORT: (Verified 8/23/24)

Oakland Privacy

Protection of the Educational Rights of Kids – Advocacy

OPPOSITION: (Verified 8/23/24)

None received

ARGUMENTS IN SUPPORT: Oakland Privacy states:

While theoretically an opt-out request should be seamlessly transferred from the original business where it was filed to the new merged entity, that may not necessarily happen in the hubbub of a merger transaction. Even an administrative delay as existing opt-outs are transferred may result in unwanted sales or shares of data as the new entity acquires and processes the consumer/user records of the acquired entity.

This is especially the case if the merger partner is an aggressive seller or sharer of consumer information which is not unlikely in a major technology or retail merger. While this may be understandable, the direct outcome of administrative delay is that the user/consumer’s privacy rights are disregarded for some period of time and they are unable to receive the protections they are entitled to under law.

Similarly, when two businesses combine, a consumer/user may have different statuses with both of them: in one case a higher trust level with company A which resulted in not filing an opt-out request or even explicitly opting-in to some sales or transfers and in the case of company B, a much lower trust level and an opt-out request.

When company A and company B merge, these requests would have to be synthesized and that should not result in the least privacy-friendly untrusted company B voiding or disregarding an opt-out request. Market examples of this might include airline mergers that impact frequent flyer advantage plans, supermarket mergers affecting pricing discount plans, the Amazon/Roomba merger, and Facebook’s acquisition of WhatsApp.

Mergers and acquisitions can be a time of enhanced privacy risks, especially when the merging companies are large, national or even multi-national in scope. The transfer of large databases can raise security risks of a breach or a hack, and the integration of differing privacy policies can result in reduced protections for users/consumers in the merged entity. The International Association of Privacy Professionals (IAPP) outlines the demands that large mergers can place on in-house privacy counsels. By requiring a second look at existing customer opt-out requests during merger implementation, AB 1824 protect user/consumers and their privacy rights during these complex transactions.

ASSEMBLY FLOOR: 73-0, 5/2/24

AYES: Addis, Aguiar-Curry, Alanis, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Juan Carrillo, Wendy Carrillo, Cervantes, Chen, Connolly, Davies, Dixon, Essayli, Mike Fong, Vince Fong, Friedman, Gabriel, Gallagher, Garcia, Gipson, Grayson, Haney, Hart, Holden, Hoover, Irwin, Jackson, Jones-Sawyer, Kalra, Lackey, Lee, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Rendon, Reyes, Luz Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Soria, Ta, Ting, Valencia, Villapudua, Waldron, Wallis, Ward, Wicks, Wilson, Wood, Zbur

NO VOTE RECORDED: Calderon, Megan Dahle, Flora, Low, Mathis, Weber, Robert Rivas

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

8/23/24 21:36:14

**** END ****

1. Peter Elkind, Jack Gillum & Craig Silverman, How Facebook Undermines Privacy Protections for Its 2 Billion WhatsApp Users (September 7, 2021) ProPublica, https://www.propublica.org/article/how-facebook-undermines-privacy-protections-for-its-2-billion-whatsapp-users [as of June 17, 2024]. ↑

 THIRD READING  

Bill No: AB 1824

Author: Valencia (D)

Amended: 3/19/24 in Assembly

Vote: 21

SENATE JUDICIARY COMMITTEE: 11-0, 6/4/24

AYES: Umberg, Wilk, Ashby, Caballero, Durazo, Laird, Niello, Roth, Stern, Wahab, Wiener

SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8

ASSEMBLY FLOOR: 73-0, 5/2/24 (Consent) - See last page for vote

SUBJECT: California Consumer Privacy Act of 2018: opt-out right: mergers

SOURCE: Author

DIGEST:

This bill requires a business that assumes control of all or some part of a transferor business that includes the transfer of a consumer’s personal information to comply with a consumer’s direction to the transferor pursuant to the California Consumer Privacy Act (CCPA).

ANALYSIS:

Existing law:

1. Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
2. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120.)
3. Provides that the obligations imposed by the CCPA shall not restrict a business’s ability to carry out certain conduct, including complying with federal, state, or local laws or to cooperate with law enforcement. This also includes cooperating with a government agency’s request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury where certain circumstances are met. (Civ. Code § 1798.145(a).)
4. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
5. Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
6. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)

This bill provides that a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all of, or part of, the transferor shall comply with a consumer’s direction to the transferor made pursuant to this subdivision. It includes a finding that this furthers the purposes of the CPRA.

Background

The California Consumer Privacy Act of 2018 (CCPA) grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale or sharing of information; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) It places attendant obligations on businesses to respect those rights. In the November 3, 2020 election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the California Privacy Protection Agency (PPA).

In response to privacy concerns related to tech-industry mergers, this bill requires a business that assumes control of all or some part of a transferor business that includes the transfer of a consumer’s personal information to comply with a consumer’s direction to the transferor pursuant to the right to opt out of the sale or sharing of personal information pursuant to the California Consumer Privacy Act (CCPA).

This bill is author-sponsored. It is supported by Oakland Privacy and Protection of the Educational Rights of Kids (PERK) Advocacy. The Committee received no timely opposition. For a more thorough assessment of this bill, please see the Senate Judiciary Committee analysis.

Comments

According to the author:

Companies increasingly want to collect raw personal data, some companies have even built entire business models around the collection and sale of consumer data. Data is desirable because it provides granular information about its users and allows companies to deploy targeted advertising, understand product desirability, and grow profits, to name a few reasons. Therefore, there is a need to ensure consumers understand how the collection of their personal information is being used. AB 1824 will protect consumers’ rights to privacy when there are mergers that take place by requiring the merging business to notify newly acquired consumers of their right to opt-out of the sale or sharing of their data.

This bill is motivated in part by privacy concerns that arose out of the acquisition of WhatsApp by Facebook (now Meta). According to a ProPublica report:

Deploying an army of content reviewers is just one of the ways that Facebook Inc. has compromised the privacy of WhatsApp users. Together, the company’s actions have left WhatsApp — the largest messaging app in the world, with two billion users — far less private than its users likely understand or expect. A ProPublica investigation, drawing on data, documents and dozens of interviews with current and former employees and contractors, reveals how, since purchasing WhatsApp in 2014, Facebook has quietly undermined its sweeping security assurances in multiple ways. (Two articles this summer noted the existence of WhatsApp’s moderators but focused on their working conditions and pay rather than their effect on users’ privacy. This article is the first to reveal the details and extent of the company’s ability to scrutinize messages and user data — and to examine what the company does with that information.)

Many of the assertions by content moderators working for WhatsApp are echoed by a confidential whistleblower complaint filed last year with the U.S. Securities and Exchange Commission. The complaint, which ProPublica obtained, details WhatsApp’s extensive use of outside contractors, artificial intelligence systems and account information to examine user messages, images and videos. It alleges that the company’s claims of protecting users’ privacy are false. “We haven’t seen this complaint,” the company spokesperson said. The SEC has taken no public action on it; an agency spokesperson declined to comment.

Facebook Inc. has also downplayed how much data it collects from WhatsApp users, what it does with it and how much it shares with law enforcement authorities.^[1]

This bill amends the “right to opt-out” of the sale or sharing of personal information by clarifying that a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all of, or part of, the transferor is required to comply with a consumer’s direction to the original business pursuant to the opt-out right.

When a consumer exercises their right under the CCPA to restrict the sharing or selling of their personal information, they are seeking to protect their information and to keep it from being used in unknown ways by other entities. Therefore, the consumer likely expects that protection and limitation to continue regardless of whether the relevant business changes hands. This bill clarifies the law to ensure that consumers’ expectations are met.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

SUPPORT: (Verified 6/17/24)

Oakland Privacy

Protection of the Educational Rights of Kids – Advocacy

OPPOSITION: (Verified 6/17/24)

None received

ARGUMENTS IN SUPPORT: Oakland Privacy states:

While theoretically an opt-out request should be seamlessly transferred from the original business where it was filed to the new merged entity, that may not necessarily happen in the hubbub of a merger transaction. Even an administrative delay as existing opt-outs are transferred may result in unwanted sales or shares of data as the new entity acquires and processes the consumer/user records of the acquired entity.

This is especially the case if the merger partner is an aggressive seller or sharer of consumer information which is not unlikely in a major technology or retail merger. While this may be understandable, the direct outcome of administrative delay is that the user/consumer’s privacy rights are disregarded for some period of time and they are unable to receive the protections they are entitled to under law.

Similarly, when two businesses combine, a consumer/user may have different statuses with both of them: in one case a higher trust level with company A which resulted in not filing an opt-out request or even explicitly opting-in to some sales or transfers and in the case of company B, a much lower trust level and an opt-out request.

When company A and company B merge, these requests would have to be synthesized and that should not result in the least privacy-friendly untrusted company B voiding or disregarding an opt-out request. Market examples of this might include airline mergers that impact frequent flyer advantage plans, supermarket mergers affecting pricing discount plans, the Amazon/Roomba merger, and Facebook’s acquisition of WhatsApp.

Mergers and acquisitions can be a time of enhanced privacy risks, especially when the merging companies are large, national or even multi-national in scope. The transfer of large databases can raise security risks of a breach or a hack, and the integration of differing privacy policies can result in reduced protections for users/consumers in the merged entity. The International Association of Privacy Professionals (IAPP) outlines the demands that large mergers can place on in-house privacy counsels. By requiring a second look at existing customer opt-out requests during merger implementation, AB 1824 protect user/consumers and their privacy rights during these complex transactions.

ASSEMBLY FLOOR: 73-0, 5/2/24

AYES: Addis, Aguiar-Curry, Alanis, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Juan Carrillo, Wendy Carrillo, Cervantes, Chen, Connolly, Davies, Dixon, Essayli, Mike Fong, Vince Fong, Friedman, Gabriel, Gallagher, Garcia, Gipson, Grayson, Haney, Hart, Holden, Hoover, Irwin, Jackson, Jones-Sawyer, Kalra, Lackey, Lee, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Rendon, Reyes, Luz Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Soria, Ta, Ting, Valencia, Villapudua, Waldron, Wallis, Ward, Wicks, Wilson, Wood, Zbur

NO VOTE RECORDED: Calderon, Megan Dahle, Flora, Low, Mathis, Weber, Robert Rivas

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

6/20/24 16:49:43

**** END ****

1. Peter Elkind, Jack Gillum & Craig Silverman, How Facebook Undermines Privacy Protections for Its 2 Billion WhatsApp Users (September 7, 2021) ProPublica, https://www.propublica.org/article/how-facebook-undermines-privacy-protections-for-its-2-billion-whatsapp-users [as of June 17, 2024]. ↑

 CONSENT  

Bill No: AB 1824

Author: Valencia (D)

Amended: 3/19/24 in Assembly

Vote: 21

SENATE JUDICIARY COMMITTEE: 11-0, 6/4/24

AYES: Umberg, Wilk, Ashby, Caballero, Durazo, Laird, Niello, Roth, Stern, Wahab, Wiener

SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8

ASSEMBLY FLOOR: 73-0, 5/2/24 (Consent) - See last page for vote

SUBJECT: California Consumer Privacy Act of 2018: opt-out right: mergers

SOURCE: Author

DIGEST:

This bill requires a business that assumes control of all or some part of a transferor business that includes the transfer of a consumer’s personal information to comply with a consumer’s direction to the transferor pursuant to the California Consumer Privacy Act (CCPA).

ANALYSIS:

Existing law:

1. Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
2. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120.)
3. Provides that the obligations imposed by the CCPA shall not restrict a business’s ability to carry out certain conduct, including complying with federal, state, or local laws or to cooperate with law enforcement. This also includes cooperating with a government agency’s request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury where certain circumstances are met. (Civ. Code § 1798.145(a).)
4. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
5. Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
6. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)

This bill provides that a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all of, or part of, the transferor shall comply with a consumer’s direction to the transferor made pursuant to this subdivision. It includes a finding that this furthers the purposes of the CPRA.

Background

The California Consumer Privacy Act of 2018 (CCPA) grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale or sharing of information; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) It places attendant obligations on businesses to respect those rights. In the November 3, 2020 election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the California Privacy Protection Agency (PPA).

In response to privacy concerns related to tech-industry mergers, this bill requires a business that assumes control of all or some part of a transferor business that includes the transfer of a consumer’s personal information to comply with a consumer’s direction to the transferor pursuant to the right to opt out of the sale or sharing of personal information pursuant to the California Consumer Privacy Act (CCPA).

This bill is author-sponsored. It is supported by Oakland Privacy and Protection of the Educational Rights of Kids (PERK) Advocacy. The Committee received no timely opposition. For a more thorough assessment of this bill, please see the Senate Judiciary Committee analysis.

Comments

According to the author:

Companies increasingly want to collect raw personal data, some companies have even built entire business models around the collection and sale of consumer data. Data is desirable because it provides granular information about its users and allows companies to deploy targeted advertising, understand product desirability, and grow profits, to name a few reasons. Therefore, there is a need to ensure consumers understand how the collection of their personal information is being used. AB 1824 will protect consumers’ rights to privacy when there are mergers that take place by requiring the merging business to notify newly acquired consumers of their right to opt-out of the sale or sharing of their data.

This bill is motivated in part by privacy concerns that arose out of the acquisition of WhatsApp by Facebook (now Meta). According to a ProPublica report:

Deploying an army of content reviewers is just one of the ways that Facebook Inc. has compromised the privacy of WhatsApp users. Together, the company’s actions have left WhatsApp — the largest messaging app in the world, with two billion users — far less private than its users likely understand or expect. A ProPublica investigation, drawing on data, documents and dozens of interviews with current and former employees and contractors, reveals how, since purchasing WhatsApp in 2014, Facebook has quietly undermined its sweeping security assurances in multiple ways. (Two articles this summer noted the existence of WhatsApp’s moderators but focused on their working conditions and pay rather than their effect on users’ privacy. This article is the first to reveal the details and extent of the company’s ability to scrutinize messages and user data — and to examine what the company does with that information.)

Many of the assertions by content moderators working for WhatsApp are echoed by a confidential whistleblower complaint filed last year with the U.S. Securities and Exchange Commission. The complaint, which ProPublica obtained, details WhatsApp’s extensive use of outside contractors, artificial intelligence systems and account information to examine user messages, images and videos. It alleges that the company’s claims of protecting users’ privacy are false. “We haven’t seen this complaint,” the company spokesperson said. The SEC has taken no public action on it; an agency spokesperson declined to comment.

Facebook Inc. has also downplayed how much data it collects from WhatsApp users, what it does with it and how much it shares with law enforcement authorities.^[1]

This bill amends the “right to opt-out” of the sale or sharing of personal information by clarifying that a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all of, or part of, the transferor is required to comply with a consumer’s direction to the original business pursuant to the opt-out right.

When a consumer exercises their right under the CCPA to restrict the sharing or selling of their personal information, they are seeking to protect their information and to keep it from being used in unknown ways by other entities. Therefore, the consumer likely expects that protection and limitation to continue regardless of whether the relevant business changes hands. This bill clarifies the law to ensure that consumers’ expectations are met.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

SUPPORT: (Verified 6/17/24)

Oakland Privacy

Protection of the Educational Rights of Kids – Advocacy

OPPOSITION: (Verified 6/17/24)

None received

ARGUMENTS IN SUPPORT: Oakland Privacy states:

While theoretically an opt-out request should be seamlessly transferred from the original business where it was filed to the new merged entity, that may not necessarily happen in the hubbub of a merger transaction. Even an administrative delay as existing opt-outs are transferred may result in unwanted sales or shares of data as the new entity acquires and processes the consumer/user records of the acquired entity.

This is especially the case if the merger partner is an aggressive seller or sharer of consumer information which is not unlikely in a major technology or retail merger. While this may be understandable, the direct outcome of administrative delay is that the user/consumer’s privacy rights are disregarded for some period of time and they are unable to receive the protections they are entitled to under law.

Similarly, when two businesses combine, a consumer/user may have different statuses with both of them: in one case a higher trust level with company A which resulted in not filing an opt-out request or even explicitly opting-in to some sales or transfers and in the case of company B, a much lower trust level and an opt-out request.

When company A and company B merge, these requests would have to be synthesized and that should not result in the least privacy-friendly untrusted company B voiding or disregarding an opt-out request. Market examples of this might include airline mergers that impact frequent flyer advantage plans, supermarket mergers affecting pricing discount plans, the Amazon/Roomba merger, and Facebook’s acquisition of WhatsApp.

Mergers and acquisitions can be a time of enhanced privacy risks, especially when the merging companies are large, national or even multi-national in scope. The transfer of large databases can raise security risks of a breach or a hack, and the integration of differing privacy policies can result in reduced protections for users/consumers in the merged entity. The International Association of Privacy Professionals (IAPP) outlines the demands that large mergers can place on in-house privacy counsels. By requiring a second look at existing customer opt-out requests during merger implementation, AB 1824 protect user/consumers and their privacy rights during these complex transactions.

ASSEMBLY FLOOR: 73-0, 5/2/24

AYES: Addis, Aguiar-Curry, Alanis, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Juan Carrillo, Wendy Carrillo, Cervantes, Chen, Connolly, Davies, Dixon, Essayli, Mike Fong, Vince Fong, Friedman, Gabriel, Gallagher, Garcia, Gipson, Grayson, Haney, Hart, Holden, Hoover, Irwin, Jackson, Jones-Sawyer, Kalra, Lackey, Lee, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Rendon, Reyes, Luz Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Soria, Ta, Ting, Valencia, Villapudua, Waldron, Wallis, Ward, Wicks, Wilson, Wood, Zbur

NO VOTE RECORDED: Calderon, Megan Dahle, Flora, Low, Mathis, Weber, Robert Rivas

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

6/18/24 13:52:32

**** END ****

1. Peter Elkind, Jack Gillum & Craig Silverman, How Facebook Undermines Privacy Protections for Its 2 Billion WhatsApp Users (September 7, 2021) ProPublica, https://www.propublica.org/article/how-facebook-undermines-privacy-protections-for-its-2-billion-whatsapp-users [as of June 17, 2024]. ↑

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2023-2024 Regular Session

Bill No: AB 1824 (Author:Valencia)

Version: March 19, 2024

Hearing Date: June 4, 2024

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

California Consumer Privacy Act of 2018: opt-out right: mergers

DIGEST

This bill requires a business that assumes control of all or some part of a transferor business that includes the transfer of a consumer’s personal information to comply with a consumer’s direction to the transferor pursuant to the California Consumer Privacy Act (CCPA).

EXECUTIVE SUMMARY

The California Consumer Privacy Act of 2018 (CCPA) grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale or sharing of information; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) It places attendant obligations on businesses to respect those rights. In the November 3, 2020 election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the California Privacy Protection Agency (PPA).

In response to privacy concerns related to tech-industry mergers, this bill requires a business that assumes control of all or some part of a transferor business that includes the transfer of a consumer’s personal information to comply with a consumer’s direction to the transferor pursuant to the right to opt out of the sale or sharing of personal information pursuant to the California Consumer Privacy Act (CCPA).

This bill is author-sponsored. It is supported by Oakland Privacy and Protection of the Educational Rights of Kids (PERK) Advocacy. The Committee received no timely opposition.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
2. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120.)
3. Provides that the obligations imposed by the CCPA shall not restrict a business’s ability to carry out certain conduct, including complying with federal, state, or local laws or to cooperate with law enforcement. This also includes cooperating with a government agency’s request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury where certain circumstances are met. (Civ. Code § 1798.145(a).)
4. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
5. Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
6. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)

This bill provides that a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all of, or part of, the transferor shall comply with a consumer’s direction to the transferor made pursuant to this subdivision. It includes a finding that this furthers the purposes of the CPRA.

COMMENTS

1. California’s landmark privacy protection law

As stated, the CCPA grants consumers certain rights with regard to their personal information, as defined. With passage of the CPRA in 2020, the CCPA got an overhaul. Consumers are afforded the right to receive notice from businesses at the point of collection of personal information and the right to access that information at any time. The CCPA also grants a consumer the right to request that a business delete any personal information about the consumer the business has collected from the consumer. However, a business is not required to comply with such a request to delete if it is necessary for the business to maintain the consumer’s personal information in order to carry out certain obligations or other conduct. (Civ. Code § 1798.105(d).)

The CCPA provides adult consumers the right, at any time, “to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. This right may be referred to as the right to opt-out.” Changes made by the CPRA extend this to opting out of the “sharing” of the personal information as well. A business is thereafter prohibited from selling (or sharing) that information unless consent is subsequently provided. A business that sells or shares personal information to third parties is required to notify consumers that this information may be sold and that they have the right to opt out of such sales. (Civ. Code § 1798.120(b).) The CPRA added a new category of information, sensitive information, which includes data such as precise geolocation and genetic information. Consumers are additionally empowered to limit businesses’ use of such information.

1. Protecting the integrity of consumer opt outs

According to the author:

Companies increasingly want to collect raw personal data, some companies have even built entire business models around the collection and sale of consumer data. Data is desirable because it provides granular information about its users and allows companies to deploy targeted advertising, understand product desirability, and grow profits, to name a few reasons. Therefore, there is a need to ensure consumers understand how the collection of their personal information is being used. AB 1824 will protect consumers’ rights to privacy when there are mergers that take place by requiring the merging business to notify newly acquired consumers of their right to opt-out of the sale or sharing of their data.

This bill is motivated in part by privacy concerns that arose out of the acquisition of WhatsApp by Facebook (now Meta). According to a ProPublica report:

Deploying an army of content reviewers is just one of the ways that Facebook Inc. has compromised the privacy of WhatsApp users. Together, the company’s actions have left WhatsApp — the largest messaging app in the world, with two billion users — far less private than its users likely understand or expect. A ProPublica investigation, drawing on data, documents and dozens of interviews with current and former employees and contractors, reveals how, since purchasing WhatsApp in 2014, Facebook has quietly undermined its sweeping security assurances in multiple ways. (Two articles this summer noted the existence of WhatsApp’s moderators but focused on their working conditions and pay rather than their effect on users’ privacy. This article is the first to reveal the details and extent of the company’s ability to scrutinize messages and user data — and to examine what the company does with that information.)

Many of the assertions by content moderators working for WhatsApp are echoed by a confidential whistleblower complaint filed last year with the U.S. Securities and Exchange Commission. The complaint, which ProPublica obtained, details WhatsApp’s extensive use of outside contractors, artificial intelligence systems and account information to examine user messages, images and videos. It alleges that the company’s claims of protecting users’ privacy are false. “We haven’t seen this complaint,” the company spokesperson said. The SEC has taken no public action on it; an agency spokesperson declined to comment.

Facebook Inc. has also downplayed how much data it collects from WhatsApp users, what it does with it and how much it shares with law enforcement authorities.^[1]

This bill amends the “right to opt-out” of the sale or sharing of personal information by clarifying that a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all of, or part of, the transferor is required to comply with a consumer’s direction to the original business pursuant to the opt-out right.

When a consumer exercises their right under the CCPA to restrict the sharing or selling of their personal information, they are seeking to protect their information and to keep it from being used in unknown ways by other entities. Therefore, the consumer likely expects that protection and limitation to continue regardless of whether the relevant business changes hands. This bill clarifies the law to ensure that consumers’ expectations are met.

Writing in support, Oakland Privacy states:

While theoretically an opt-out request should be seamlessly transferred from the original business where it was filed to the new merged entity, that may not necessarily happen in the hubbub of a merger transaction. Even an administrative delay as existing opt-outs are transferred may result in unwanted sales or shares of data as the new entity acquires and processes the consumer/user records of the acquired entity.

This is especially the case if the merger partner is an aggressive seller or sharer of consumer information which is not unlikely in a major technology or retail merger. While this may be understandable, the direct outcome of administrative delay is that the user/consumer’s privacy rights are disregarded for some period of time and they are unable to receive the protections they are entitled to under law.

Similarly, when two businesses combine, a consumer/user may have different statuses with both of them: in one case a higher trust level with company A which resulted in not filing an opt-out request or even explicitly opting-in to some sales or transfers and in the case of company B, a much lower trust level and an opt-out request.

When company A and company B merge, these requests would have to be synthesized and that should not result in the least privacy-friendly untrusted company B voiding or disregarding an opt-out request. Market examples of this might include airline mergers that impact frequent flyer advantage plans, supermarket mergers affecting pricing discount plans, the Amazon/Roomba merger, and Facebook’s acquisition of WhatsApp.

Mergers and acquisitions can be a time of enhanced privacy risks, especially when the merging companies are large, national or even multi-national in scope. The transfer of large databases can raise security risks of a breach or a hack, and the integration of differing privacy policies can result in reduced protections for users/consumers in the merged entity. The International Association of Privacy Professionals (IAPP)

outlines the demands that large mergers can place on in-house privacy counsels. By requiring a second look at existing customer opt-out requests during merger implementation, AB 1824 protect user/consumers and their privacy rights during these complex transactions.

1. Furthering the purpose and intent of the CPRA

Section 25 of the CPRA requires any amendments thereto to be “consistent with and further the purpose and intent of this act as set forth in Section 3.” Section 3 declares that “it is the purpose and intent of the people of the State of California to further protect consumers’ rights, including the constitutional right of privacy.” It then lays out a series of guiding principles. These include various consumer rights such as:

• consumers should know who is collecting their personal information;
• consumers should have control over how their personal information is used; and
• consumers should benefit from businesses’ use of their personal information.

Section 3 also includes a series of responsibilities that businesses should have. These include:

• businesses should specifically and clearly inform consumers about how they use personal information; and
• businesses should only collect consumers’ personal information for specific, explicit, and legitimate disclosed purposes.

Section 3 also lays out various guiding principles about how the law should be implemented.

This bill clarifies the opt-out right to ensure consumers’ rights are being respected. This allows for a fuller realization of the benefits intended by the law. Therefore, as it explicitly states, this bill “furthers the purposes and intent of the California Privacy Rights Act of 2020.”

SUPPORT

Oakland Privacy

Protection of the Educational Rights of Kids – Advocacy

OPPOSITION

None received

RELATED LEGISLATION

Pending Legislation:

SB 1223 (Becker, 2024) includes “neural data,” as defined, within the definition of “sensitive personal information” for purposes of the CCPA. SB 1223 is currently pending referral in the Assembly.

AB 2877 (Bauer-Kahan, 2024) requires members of the PPA board to have qualifications, experience, and skills in the area of consumer rights. AB 2877 is currently pending referral in the Senate.

AB 3048 (Lowenthal, 2024) requires that internet browsers include an opt-out preference signal allowing consumers interacting with businesses online to automatically exercise their right to opt-out of the selling and sharing of their personal information. AB 3048 is currently pending referral in the Senate.

Prior Legislation:

AB 947 (Gabriel, Ch. 551, Stats. 2023) included personal information that reveals a consumer’s citizenship or immigration status in the definition of “sensitive personal information” for purposes of the CCPA.

AB 1194 (Wendy Carrillo, Ch. 567. Stats. 2023) provided stronger privacy protections pursuant to the CCPA where the consumer information contains information related to accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including abortion services.

AB 1546 (Gabriel, 2023) would have extended the statute of limitations for actions brought by the Attorney General to enforce the CCPA to five years after the accrual of the cause of action. AB 1546 was held in the Senate Appropriations Committee.

AB 254 (Bauer-Kahan, Ch. 254, Stats. 2023) includes “reproductive or sexual health application information” in the definition of “medical information” and the businesses that offer reproductive or sexual health digital services to consumers in the definition of a provider of health care for purposes of the Confidentiality of Medical Information Act (CMIA).

AB 2089 (Bauer-Kahan, Ch. 690, Stats. 2022) includes mental health application information in the definition of “medical information” and the businesses that offer mental health digital services to consumers in the definition of a provider of health care for purposes of the CMIA.

AB 694 (Assembly Committee on Privacy and Consumer Protection, Ch. 525, Stats. 2021) made nonsubstantive and conforming changes to the CCPA to clean up the language amended in by the CPRA.

AB 375 (Chau, Ch. 55, Stats. 2018) established the CCPA.

PRIOR VOTES:

Assembly Floor (Ayes 73, Noes 0)

Assembly Appropriations Committee (Ayes 14, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 11, Noes 0)

**************

1. Peter Elkind, Jack Gillum & Craig Silverman, How Facebook Undermines Privacy Protections for Its 2 Billion WhatsApp Users (September 7, 2021) ProPublica, https://www.propublica.org/article/how-facebook-undermines-privacy-protections-for-its-2-billion-whatsapp-users [as of May 23, 2024]. ↑

Date of Hearing: April 24, 2024

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

ABPCA Bill Id:AB 1824

Author:(Valencia) – As Amended Ver:March 19, 2024

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill requires a business that obtains a consumer’s personal information through a merger or the acquisition of another business to comply with the privacy preferences the consumer asserted before the merger or acquisition.

FISCAL EFFECT:

Minor and absorbable cost to the California Privacy Protection Agency to enforce violations of the requirement added by this bill.

COMMENTS:

1. Purpose. According to the author:

Companies increasingly want to collect raw personal data, some companies have even built entire business models around the collection and sale of consumer data. Data is desirable because it provides granular information about its users and allows companies to deploy targeted advertising, understand product desirability, and grow profits, to name a few reasons. Therefore, there is a need to ensure consumers understand how the collection of their personal information is being used. The CCPA is silent on consumers’ rights when there is a merger or acquisition that takes place, leaving consumers’ personal data vulnerable to businesses who they may be unfamiliar with or may not want to share their data and personal information with.

1. Background. The California Consumer Privacy Act (CCPA) gives a California consumer the right to know what personal information about them is collected and sold, to request the specific pieces of personal information about them held by a business, and to opt out of the sale of their personal information. Although the CCPA clearly provides the right to opt out of the sale of a consumer’s personal information and requires a business to comply with a consumer’s choice to opt out, the law does not specify how a business must treat personal information it obtains from another business through a merger or acquisition, where a consumer has not articulated their privacy preferences directly to the business that acquires their data. This bill clarifies in such circumstance, the acquiring business must honor the opt-out preferences the consumer articulated to the business that originally held their data.
2. Related Legislation. AB 1949 (Wicks) prohibits a business from collecting the personal information of a consumer under 18 years of age unless the consumer, or the consumer’s parent or guardian if the consumer is under 13, affirmatively authorizes collection. AB 1949 is pending hearing in this committee.

AB 3048 (Lowenthal) prohibits a business from developing or maintaining an internet browser that does not include a setting that enables the consumer to send an opt-out preference signal. AB 3048 is pending hearing in this committee.

Analysis Prepared by: Annika Carlson / APPR. / (916) 319-2081

Date of Hearing: April 2, 2024

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

ABPCA Bill Id:AB 1824 (

Author:Valencia) – As Amended Ver:March 19, 2024

PROPOSED CONSENT

SUBJECT: California Consumer Privacy Act of 2018: opt-out right: mergers

SYNOPSIS

The California Consumer Privacy Act (CCPA) grants residents of the state the right to direct a business to not sell or share their personal information at any time. However, businesses often change through mergers, bankruptcy, or acquisition. In the event of one of those changes, a business may be absorbed into another business entirely or it may start operating under a merged or combined entity. Though, theoretically, the opt-out preferences of the customers of a company being acquired should transfer to the new business, that may not always be the case.

The CCPA ensures that at any time consumers can direct a business to not sell or share their personal information. However, the CCPA is silent on consumers’ rights when there is a merger or acquisition that takes place, potentially leaving consumers’ personal data vulnerable to businesses who they may be unfamiliar with or may not want to share their data and personal information with. The purpose of this bill is to remove any ambiguity about what happens to consumers’ opt-out preferences when businesses combine.

This bill is author sponsored and supported by Oakland Privacy.

SUMMARY: Requires, under the California Consumer Privacy Act, that businesses acquiring the personal data of consumers through the acquisition of another business, honor the previous decisions of consumers who have not given permission for the business to sell or share their personal information. Specifically, this bill, states that a business that receives personal information of a consumer due to a merger, acquisition, bankruptcy, or other transaction must comply with a consumer’s direction to the original business in terms of the handling of their personal information.

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights. Among these the fundamental right to privacy. (Cal. Const. art. I, § 1.)
2. States that the “right to privacy is a personal and fundamental right protected by Section 1 of Article I of the Constitution of California and by the United States Constitution and that all individuals have a right of privacy in information pertaining to them.” Further states these findings of the Legislature:
   1. The right to privacy is being threatened by the indiscriminate collection, maintenance, and dissemination of personal information and the lack of effective laws and legal remedies.
   2. The increasing use of computers and other sophisticated information technology has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information.
   3. In order to protect the privacy of individuals, it is necessary that the maintenance and dissemination of personal information be subject to strict limits. (Civ. Code § 1798.1.)
3. Establishes the CCPA. (Civ. Code §§ 1798.100-1798.199.100.)
4. Provides a consumer, subject to certain exemptions and qualifications, various rights, including the following:
   1. The right to know the business or commercial purpose for collecting, selling, or sharing personal information and the categories of persons to whom the business discloses personal information. (Civ. Code § 1798.110.)
   2. The right to request that a business disclose the specific pieces of information the business has collected about the consumer, and the categories of third parties to whom the personal information was disclosed. (Civ. Code § 1798.110.)
   3. The right to request deletion of personal information that a business has collected from the consumer. (Civ. Code § 1798.105.)
   4. The right to opt-out of the sale of the consumer’s personal information if the consumer is over 16 years of age. (Sale of the personal information of a consumer below the age of 16 is barred unless the minor opts in to its sale.) (Civ. Code § 1798.120.)
   5. The right to direct a business that collects sensitive personal information about the consumer to limit its use of that information to specified necessary uses. (Civ. Code § 1798.121.)
5. Defines the following terms under the CCPA:
   1. “Business” means a for-profit entity that collects consumers’ personal information, does business in California, and meets one or more of the following criteria:
      1. It had gross annual revenue of over $25 million in the previous calendar year.
      2. It buys, receives, or sells the personal information of 100,000 or more California residents, households, or devices annually.
      3. It derives 50% or more of its annual revenue from selling California residents’ personal information. (Civ. Code § 1798.140(d).)
   2. “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes such information as:
      1. Name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver’s license number, passport number, or other identifier.
      2. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
      3. Biometric information.
      4. Internet activity information, including browsing history and search history.
      5. Geolocation data.
      6. Professional or employment-related information. (Civ. Code § 1798.140(v).)
6. Establishes the California Privacy Protection Agency (Privacy Agency), vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The Privacy Agency is governed by a five-member board, with the chairperson and one member appointed by the Governor, and the three remaining members are appointed by the Attorney General, the Senate Rules Committee, and the Speaker of the Assembly. (Civ. Code § 1798.199.10.)

FISCAL EFFECT: As currently in print, this bill is keyed fiscal.

COMMENTS:

1) Purpose of this bill. The CCPA grants residents of the state the right to direct a business not to sell or share their personal information at any time (Civ. Code § 1798.120). However, businesses often change through mergers, bankruptcy, or acquisition. In the event of one of those changes, a business may be absorbed into another business entirely or it may start operating under a merged or combined entity. Theoretically, the opt-out preferences of the customers of a company being acquired should transfer to the new business; however, that may not always be the case.

While the CCPA ensures that at any time consumers can direct a business to not sell or share their data. However, the CCPA is silent on consumers’ rights when there is a merger or acquisition that takes place, potentially leaving consumers’ personal data vulnerable to disclosure. The purpose of this bill is to remove any ambiguity about what happens to consumers’ opt-out preferences when businesses combine, by requiring the business that acquires personal consumer information from the original business to honor the preferences of those consumers.

2) Author’s statement. According to the author:

Companies increasingly want to collect raw personal data, some companies have even built entire business models around the collection and sale of consumer data. Data is desirable because it provides granular information about its users and allows companies to deploy targeted advertising, understand product desirability, and grow profits, to name a few reasons. Therefore, there is a need to ensure consumers understand how the collection of their personal information is being used. The CCPA is silent on consumers’ rights when there is a merger or acquisition that takes place, leaving consumers’ personal data vulnerable to businesses who they may be unfamiliar with or may not want to share their data and personal information with.

3) The California Consumer Privacy Act and the California Privacy Rights Act (CPRA). In 2018, the Legislature enacted the CCPA (AB 375 (Chau, Chap. 55, Stats. 2018)), which gives consumers certain rights regarding their personal information, such as the right to: (1) know what personal information about them is collected and sold; (2) request the categories and specific pieces of personal information the business collects about them; and (3) opt out of the sale of their personal information, or opt in, in the case of minors under 16 years of age.

Subsequently, in 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. With the passage of the CCPA and the CPRA, California now has the most comprehensive laws in the country when it comes to protecting consumers’ rights to privacy.

In addition, Proposition 24 created the California Privacy Protection Agency (Privacy Agency) in California, vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA and the CPRA. The Agency’s responsibilities include updating existing regulations, and adopting new regulations.

To protect Californians from any future legislative efforts to weaken statutory protections in the CPRA, Proposition 24 provided that the CPRA’s contents may be amended by a majority vote of the Legislature only if the amendments are consistent with and further the purpose and intent of the CPRA, which is to further protect consumers’ rights, including the constitutional right of privacy.^[1]

4) Analysis. Consumers likely already assume that once they opt-out of having their personal information shared that they would not need to monitor the business’ use of that information going forward. Requiring consumers to monitor any mergers or acquisitions and exercise their rights all over again every time there is a change in ownership puts an enormous burden on consumers that is contrary to the goals of the CPRA. This bill appears to be a reasonable approach to rectifying an ambiguity in the CCPA as it relates to businesses merging or being acquired by clearly stating that the business acquiring personal consumer information honor the existing preferences expressed by those consumers to the original company. This clarification is consistent both with the requirement that any legislation appending the CCPA further the goals of the CPRA and with the goals of this Committee.

5) Related legislation. Over the last 5 years, numerous bills have attempted to modify the CCPA and many have been successful in furthering its goals. In this hearing alone, three bills, including this one, propose modifications to the CCPA. Specifically:

AB 1949 (Wicks) proposes amending the CCPA to prohibit a business from collecting the personal information of a consumer under 18 years of age unless the consumer, or the consumer’s parent or guardian if under 13, affirmatively authorizes the collection.

AB 3048 (Lowenthal) proposes prohibiting a business from developing or maintaining an internet browser through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business.

ARGUMENTS IN SUPPORT:

In support of the bill, Oakland Privacy states:

Mergers and acquisitions can be a time of enhanced privacy risks, especially when the merging companies are large, national or even multi-national in scope. The transfer of large databases can raise security risks of a breach or a hack, and the integration of differing privacy policies can result in reduced protections for users/consumers in the merged entity. The International Association of Privacy Professionals (IAPP) outlines the demands that large mergers can place on in-house privacy counsels. By requiring a second look at existing customer opt-out requests during merger implementation, AB 1824 protect user/consumers and their privacy rights during these complex transactions.

REGISTERED SUPPORT / OPPOSITION:

Support

Oakland Privacy

Opposition

None

Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200

1. Ballot Pamphlet. Primary Elec. (Nov. 3, 2020) text of Prop. 24, p. 74 ↑