Assembly Standing Committee on Privacy and Consumer Protection

Welcome. Welcome to Assembly privacy and consumer protection hearing. We are going to start the hearing so that Members join us here in the Committee room. We will be limiting testimony to two witnesses in support and two in opposition today on each Bill. Each witness will be allowed two minutes to present their testimony and we will hear from everyone in the room who wants to speak as well. We will be joined. zero, here she is. We are joined by a new Committee Member today.

Assembly Member Dixon is the newest Member of the Committee Privacy and Consumer Protection Committee. So thank you and welcome, Assemblymember Dixon. We do not have quorum yet, but we can start as a Subcommitee if you are ready. So we will take up our first Bill. We have a quorum, so we will take attendance. Look at that.

[Roll Call]

Great. Do we have a motion on the consent calendar motion? Second, let's call the roll on the consent calendar.

[Roll Call]

Great. The consent calendar has six. It's out. But we will leave the roll open for absent Members and we will take up some. Remember Wicks's bill, AB 1949 when she's ready.

Nice. Thank you, Madam Chair. My witnesses, I believe, are stuck in security on their way here, but we can start.

Okay. If you want to wait, we can. I mean, it's okay. Okay.

Okay. I need to be able to see. Okay. Good afternoon, Madam Chair, and Members. First, I want to accept the Committee's proposed amendments and thank the staff for their very hard work on the bill. Following the investigation of Attorney General Rob Bonta in 2023, it was revealed that Meta knows that its social media platforms are used by millions of children under the age of 13, including at one point around 30% of all 10 to 12 year olds, and unlawfully collecting their personal information.

As amended, AB 1949 will keep children under the age of 18. Sorry. As amended, AB 1949 will help keep children under the age of 18 and their data from being collected and exploited without explicit and affirmative consent. First, the measure will prohibit businesses from collecting, using, or disclosing the personal information of Californians under 18 without affirmative authorization. For those users that are under the age of 13, affirmative approval must come from a parent.

So under the age of 18, the child has to affirmatively consent to giving their data. Under the age of 13, a parent must do that for them. Opposition will contend that this will unconstitutionally restrict teens and adults access to lawful speech. To be clear, AB 1949 does not regulate speech, content, or access to content or speech. Again, I'm going to say that again, AB 1949 does not regulate content, speech, or access to content or speech.

The age requirement determines what privacy and data collection policies apply to this specific user. Secondly, the measure will strengthen certain CCPA existing protections against businesses selling or sharing the personal information of minors by establishing that those protections apply whether or not the business had actual knowledge that the person is under the age of 18. Opponents claim this would create a strict liability standard. To be clear, the data at issue concerns a vulnerable population that should be given elevated protection.

And I've said this before, I think as lawmakers, our number one duty is to keep our community safe, and I view our children as the most important people in our community to keep safe. And that is what this bill is about. It is important to note that businesses can apply the requirements of AB 1949 to all consumers, not only to minors, thereby eliminating any requirement to employ age assurance tools.

If not already, businesses should elevate their data collection practices and determine what is necessary to operate, rather than what is suitable for profits. I want to thank our sponsor, Attorney General Rob Bonta. And testifying with me today are Anthony Lew, Office of Legislative Affairs, and Eleanor Bloom, special assistant to Attorney General, and would respectfully ask for an aye vote when the time is right.

Thank you. Your witnesses.

Hi, good afternoon, Chair and Members. My name is Anthony Lew. I'm with the Office of Legislative Affairs and a Deputy AG for California DOJ. Here today on behalf of AG Rob Ponta. The AG is pleased to sponsor AB 1914, the California Children's Data Privacy Act. And we thank Assembly Member Wicks for leading on this important legislation to strengthen data privacy protections for children and improve child safety online.

As perfectly summarized in the Committee analysis, the CCPA secures increased privacy rights for consumers, including the right to know what personal information businesses collect and sell, and the right to stop those sales to third parties. With respect to young users, the CCPA prohibits businesses from selling the personal information of a child that they know to be under the age of 16 unless they get authorization or opt in for the sale of the child's personal information. These protections leave a couple of major gaps in the law.

They fail to cover 17 year old users. They allow businesses to continue collecting and exploiting the data of children as long as they don't sell it. And additionally, the actual knowledge standard unfortunately allows businesses to skirt the CCPA's prohibitions as they will rarely have actual knowledge of a user's age. This has allowed companies like Google and Meta and others to collect, exploit, and monetize young users data on a really large scale.

Despite businesses awareness that children use their services, businesses currently design their online services to include features that may be harmful to children, including manipulative techniques to prod them to spend hours on an online or provide personal information beyond what is expected or necessary. AB 1949 will help curtail the business practice of exploiting children's personal data for profit without permission.

The bill to would amend the CCPA to protect to prohibit the collection, use and disclosure of children's personal information without affirmative consent, and assure that these protections apply uniformly to all youth up to age 18. AB 1949 is a continuation of AG Bonta's commitment to improving child safety online via every avenue, both legal and legislative.

And with this build, the AG and Assembly Member Wicks are reaffirming the need for strong safeguards in California that protect not only the privacy rights of children, but that also address the real demonstrated harms to the physical and mental health of children associated with the use of social media. And for these reasons, we urge your support of AB 1949.

Thank you. Motion and a second. Thank you. Did you want to add anything? Are you here for questions?

I certainly can, but if everybody's going to vote right now, I don't need to weigh in.

She's an expert witness.

Okay, perfect. There is. Just because I know we've seen some Members come in who are confused. This is Privacy. Consumer Protection and Public Safety is across the hall. They have moved. If anybody is here for Public Safety. There you go. Want to make sure you're in the right room. Okay. Any additional support for this bill?

First, Kim Stone, Stone Advocacy on behalf of the Children's Advocacy Institute, in enthusiastic support.

Becca Cramer Mowder on behalf of ACLU California Action in a support if amended position, asking that it remove age verification and go back to the actual knowledge standard.

Thank you. Anyone here to testify in opposition to the bill? Come on.

Thank you, Chair, Members. Ronak Daylami with CalChamber respectfully in opposition to AB 1949. My testimony today is key to the bill in print. We are still looking over the amendments. Our member companies take seriously the privacy of their customers, especially children, and are concerned that this bill will have the opposite effect than is intended.

We believe the existing CCPA framework correctly applies the increased protections of an opt in rate to the most vulnerable consumers, minors under 16, for the riskiest type of processing activities, selling and sharing their personal information. This also has the benefit of encouraging parents to teach older teens to assert their opt out rights as they approach the age of majority. Notably, however, a business must have actual knowledge that the consumer is under 16 for the opt in right to apply.

To mandate that everyone under 18 has to opt in prior to selling or sharing their information is one thing. Removing the actual knowledge standard and expanding the right to opt in to the collection or use of the minor's data is another. Under the proposed framework, it will be impossible for a business to ensure compliance unless it engages in age verification of every consumer and obtains opt in consent in every interaction, both online and in physical stores.

This is both inconsistent with Prop 24 and practically just infeasible. Imagine a scenario where an insurance company receives an accident claim involving a 17 year old driver. Suppose a parent wants to order food delivery to their 14 year old and puts their teens name in the delivery instructions. Imagine a 12 year old walking into a store that uses video surveillance.

Because collection under the CCPA includes even passively receiving or accessing the PI of any consumer, by any means, the business will be in violation before they can actually obtain affirmative consent from the 17 year old driver, from the 14 year old who's getting the food delivered, and from the parent of the 12 year old who walks into the store.

In the scenario of the 12 year old, a business would effectively have to position someone outside the store to stop anyone who looks like they might be under 18 and either require affirmative authorization or refuse them entrance. Again, because the bill removes actual knowledge. The process mandated in each of these scenarios is wildly impractical, if not impossible, and operates to the detriment of businesses, our economy, and consumers alike. So for these reasons, we must respectfully oppose. Excuse my voice today.

Thank you. Any other witnesses? You can stay in case people have questions. Any other witnesses in opposition?

No one wants to stay up here on this panel. Samantha Corbin in respectful opposition on behalf of the Electronic Frontier Foundation, thank you.

Dylan Hoffman on behalf of Technet, align my comments with the Chamber respectively. Thanks.

Laura Curtis in respectful opposition on behalf of the American Property Casualty Insurance Association, thank you.

Ryan Allain on behalf of the California Retailers Association, respectful opposition, thank you.

Naomi Padron on behalf of the Computer and Communications Industry Association in respectful opposition.

Leah Barrows on behalf of Chamber of Progress in opposition.

Steve Carlson for the Association of National Advertisers in opposition.

Thank you all. We will bring it back to the Committee. Questions? Yeah. Mr. Lowenthal.

Thank you, Madam Chair. First of all, I wish to commend the author for bringing this forward. It is such critical legislation. I also want to commend the opposition for the very thoughtful comments. My personal belief is all of those things they brought up are important and solvable. It is important for us all to remember that we are not the end user when it comes to social media.

It's a very obvious thing to state, but in times like this, when we're getting ready to vote on an important item, we need to restate it. We are the product. We are all the product. We are being productized for the purpose of financial gain. It is totally and wholly appropriate for us to consider when our children are being productized for financial gain, what are the impacts on them.

I personally believe that there is a nexus between the collection of data and addiction and the utilization of social media, because the more time our children are spending online, the more data that can be collected. And we all know, or some of us may know, that are looking at this closely, the impact that we see on children over the last decade, in particular in girls, there is a 65% higher rate of suicide, eating disorder, anxiety, depression than there was 10 years ago. 10 years ago.

So I want to commend the author from doing this, and I also want to say, especially to all the voices of opposition for myself, and I can't speak for others, in supporting this bill, I want the tech companies to be more successful, not less.

It's about coming up with the right secret sauce, the right formula, where consumers feel protected and still have the ability to use their speech, still have the ability to use this platform, still have the ability to promote their businesses, still have the right formula for children to be able to operate in a digital world where they're still figuring out who they are in their own development. So again, I thank you very much.

Thank you. Yeah, Mr. Vice Chair.

Great, thank you. Well, I've, nobody's come to meet with me against this bill or in support of the bill. And so we've kind of been obviously thinking about the consequences either for or against. I have four kids and two of my kids who are older, not that old, probably not old enough, but we gave them some cell phones so we can check when they're at their activities and things like that, and we lock it down.

But I already see, you know, some changes in behavior and things like that. And, you know, it's concerning to me. So I think the premise here of trying to prevent kids from essentially being monetized is a good one. But, you know, philosophically, I like kind of where the bill's trying to go. And my concern, though, is, and what I really want to dive in more on is the actual knowledge standard.

Because I was listening, you know, where I get all my good information from my phone. I was listening to a podcast, the Daily, which isn't exactly, you know, Republican news, but it's a great one. And they had. I listened to New York Times, sorry, but it's very informative. And sometimes I'm angry when I'm listening to it on my run, so it helps me run faster.

But they actually had a podcast on this exact issue several months ago, and that existing federal laws and state laws that have to do with what can be used with data and apps that are targeted towards minors and things like that and how that data is used. But one of the things was, hey, well, they didn't have actual knowledge. Well, they're very clearly marketing to children. And I know there have been changes around that and some changes in federal regulations and things like that.

But on its face, I'm not opposed to apps marketing to children either. I mean, my kids use apps. They have to use apps. In fact, I have a bill that went through this Committee that says, hey, look, when a kid turns 18 and those apps that are used in school, they are allowed to delete their information from those apps because that data belongs to the kid or the parents, not whatever platform is being used, but the actual knowledge standard.

I really want to dive in more, and so I'm not quite there today. I'd love to continue to have that conversation. I believe we need to get to a point where hopefully we have a solution between the business community or the people that have these apps and the realization that just saying, oh, hey, we didn't know. I don't really think that that's acceptable. I think we know. I know my kids are using these apps.

I know that it's showing things that are targeted to my children because they've been watching these videos or whatever all the time. So. And I don't think we can really dismiss that. We just gotta admit that, hey, that's what's going on. And I don't think the platforms necessarily want that, by the way. I'm not even suggesting that that that's the case.

But I want to make sure we can protect that data of my children because I'm selfish, extremely selfish, and however, I can help facilitate that, I am supportive, but I do want to wrap my head around the actual knowledge and continue the discussions. And I welcome anybody to come into my office and meet with me about that, whether it's concerns, whether it's support. And I take this issue very seriously. So I do commend you for bringing it. You don't ever go for a small, small ticket items here. So big ideas. So thanks for bringing in. Look forward to the conversations with all the parties.

Thank you. Assembly Member Irwin.

I always appreciate all the work that you do in this area. We have heard many, many horror stories about kids and social media. I just wanted to know, COPPA, the federal law, has an age of 18, and obviously in your village, 16. So are you concerned about that inconsistency? Do you think that there's any preemption issues?

Well, I'm not an attorney, so I'd ask the attorneys about preemption, but my understanding is that it is not preempted. I think we need better standards. I mean, and I think when you look at the data, it's borne out in some of the stuff that Mr. Lowenthal said around some of these challenges, around addiction and other issues that we're seeing. We can do better, and that's what this bill is striving to do. But I would defer to the attorneys on the preemption question.

Yep. So we actually addressed the 16 and 18 difference in the language that's in front of the Committee today. So the age threshold in this bill now is 18. And Anthony perhaps can describe the procedural thing there, but it the procedural thing, but the age now threshold now, and the bill is 18. We work with COPPA all the time. COPPA is one of the claims in our lawsuit against Meta related to lying about the impact on kids mental health.

And we think COPPA is a really important, valuable federal law. We also think that California can do more and do better. And this is a bill that can build on top of the federal standards in COPPA. And we think that we have struck a good balance in this bill, particularly having resolved the difference between 16 and 18 there in the language that is in front of you today that is not preempted by comment.

Ms. Dixon.

Thank you, Chair. I too think this is necessary in some form. We know that there's a problem. Is this the solution? I'm just thinking about the workability, the feasibility. So let's just take that 18 year old. Help my brain here. Does that mean we don't, we need to know everybody's date of birth and when their birthday is and if they're 17 and they're 18 and under, they're affected. What about people over 18? Will that be captured in this as well?

Or so everybody's birthday when they turn 18, they're free to explore the Internet as they wish. But anyone under 18, so how do we manage the acquisition of that information, that personal information and the management? And you're talking about any platform that has users that live in California, because obviously there's going to be a literally a giant digital wall between the state of California and the rest of the country. How is that?

I think technology probably has a solution there, but that burden that we're going to be placing on businesses who deal with the public as well as children, I think going after those type of businesses that are monetizing social addiction needs to be dealt with. I just am concerned about the millions and billions of people that are on these platforms. How do you check for if they're the 18 and under?

Because I just think that that's going to be extremely difficult and to put laws on the state books for California and every, I just find it difficult, and I think that's where the business community may be. It's just very difficult to get their arms around. And then also, you have, aside from that, the constitutional issues that right or wrong, I mean, I'm glad we're trying to protect children. I have three grandsons that are just getting to be that age, 12, 10, and eight.

I mean, they're thankfully, their mother, my daughter limits their time and supervises it very carefully. But we know that that's not always the case, but just the access to information and determining that you must be a certain age before you can access information, as bad as that information may be, of course, and unsavory. I don't know if that counts. I'm not a lawyer, but constitutionally, I don't know how we get around to determining who could read or access information and who cannot.

So I have these two concerns. I think this is an important discussion to have going forward as we try to figure out the best practice here. I just don't know if we're here yet, but I'm a new Member of the Committee, and so what do I know?

Yeah, we're going to let them answer your question. Would you like to address it?

Yeah. So some really good questions about implementation. I think a couple threshold matters. One is that California already has state privacy laws and has led the country. Back in 2018, we passed the California Consumer Privacy Act, led the country in establishing state privacy laws, before that had privacy laws specific to different kinds of information, has specific state data security laws. That is, whether businesses like it or not, it is already a feature of the state and federal regulatory scheme around technology and data privacy and data security.

So with this bill, what we would be doing, what California would be doing is filling a gap in existing state privacy laws so that I think businesses could implement technological solutions to distinguish between users in California and users outside of California that would not enjoy the benefits and protections of California state law, just as businesses today already are doing that related to the established privacy and data security protections that are already in place.

One further follow up question then, my understanding was the 2018 or when the last bill was, and that's when everybody has to opt in or opt out, and you could actually filter through and decide how much information you want to provide or not provide. So that was, has that been on the books long enough to figure out if it's working?

In my view, yes. That we have already established comprehensive state privacy laws that we're seeing broadly implemented and complied with in the marketplace. We have taken some enforcement actions under the CCPA out of our office. California has a new privacy agency that also has enforcement authority under the CCPA.

So in my view, yes, we already have seen over the last 5, 6 years implementation of this comprehensive privacy regime and are able to be confident that businesses can operate with different rules in California than in the rest of the country.

They should come. You don't know for sure, but anyway, I appreciate your good responses. It's so a work in progress. Thank you very much.

Okay. Seeing no further. Oh, yeah, Mr. Hoover.

Can I just get a little clarification from Chamber on a follow up on that too, just to get your perspective as well?

Sure. I apologize if I restate some of what was already said. Excuse me, but yes, in 2018, we passed the law that added the original right to opt in. So we've been complying with that since then. The bill went into effect in 2020, January 2020. So that's been on the books for a while. But what this bill changes, it doesn't just say, okay, the rules that applied for 16 and under now apply to 16 and 17 as well. It removes actual knowledge.

And I understand the point about actual knowledge that was raised earlier. I will say that's one of the reasons why when we passed the law in 2018, we specifically said, and I'm quoting from the law right now, a business that will fully disregards the consumer's age shall be deemed to have actual knowledge of the consumer's age. So it's a balancing act.

I don't know how we're supposed to know if a child logs in through their parents account, if they're 18 and under or 18 and over, if they are walking into a store. I don't know how you're supposed to do that unless you literally stand outside and ask. But now you have to have an actual knowledge standard or you don't have an actual knowledge standard, so it doesn't matter. So you have to figure out what the rights are so that you can implement them correctly. And the only way you can do that is by figuring out their age. So I don't know if that answered your question.

And1 I will add that thanks to the incredible work of Committee staff, I'm hopeful that the definition that we've provided with partnership from the AG's office on use that is now in the amendments addresses some of the examples that were given today. I want to thank the AG's office for their partnership in that, because it did make sense to, to make sure that sort of tangential use was not the same as selling data. And that clarification is in these amendments.

So hopefully, when you've had a time to process it, it may address some of what you're talking about, but obviously open to hearing otherwise. Anybody else? Well, I just want to thank the author for this work. I think the actual knowledge standard, and it was interesting, as I was thinking about this and a few other bills that are borrowed for the Committee. I think we only have one Committee Member that was here during the passage of the CCPA.

Assembly Member Irwin. Many of us were not in those conversations. And so this is an interesting opportunity for us to decide what we think about what it means to protect Californians' privacy. And personally, as the mother of teenagers, I think it is critically important that we change the conversation around the attention economy and how the attention economy has monetized our children, as Assembly Member Lowenthal has said.

And you know, we've heard the hearings in Washington from the whistleblowers coming out of our social media companies talking about the, what I would call gross conversations happening in these institutions where the welfare of our children is irrelevant. And what is most important to them is the dollars that they can get off of our children and those of us that are around our teens. And these are more than statistics. We see it day in and day out.

And the actual knowledge standard for those of us that have teens. It's a joke. I mean, let's just be completely honest about it. My son didn't like some of the restrictions. He wasn't able to get to certain things, so he went and changed the age. They let him change the age. He had registered as an under 18 user, and he could change the age with no qualms. And now they didn't have knowledge that he was a minor.

That's what the actual knowledge standard has left us with in California. So as long as the law is that meaningless, it is incumbent upon us to do what we can to protect it. And I want to applaud Assembly Member Wicks and her continued fight to protect children and to make sure that we are doing what we can. Now, I have a great relationship with my son, so he told me that. So we got to have a conversation about the implications of that.

But, you know, there's a lot of people out there who wouldn't have known that. And the implications that came with that age change that are reflected in the CCPA. So I think this bill is really important. I thank you for taking the amendments today.

Think they do go a long way in narrowing the application of this bill to where it really is, the sale and monetization of our children, such that they are feeding an addiction that is harming our kids at such an alarming rate that we need to do everything we can.

And I want to applaud you again, for as I would argue, you have done in the past, Assembly Member Wicks, being compliant with Section 230, no matter what our courts want to say about you, and really finding a way to thread that needle to protect our kids and ensure that we're going after the actual business practices rather than the speech inherent in these platforms. So, with that, I will let you close.

Thank you, Madam Chair. The Washington Post, this was maybe six months ago, I was reading an article. The average 13 year old has 72 million pieces of data collected about them. 72 million pieces of data for your average 13 year old. That data is what then produces the algorithms. The algorithms then produce the advertising content and all kinds of other things. Right? So it's the commodification of our children is what we're actually really talking about right now.

The companies know how old people on their platforms are. They literally employ thousands of engineers to know the answer to that question. Their entire business model is predicated on the answer to that question of understanding who is on their platform, what they're doing, what they're consuming, what they're liking, what they're not liking. That is the business of what the companies are doing. So they know. Right. And I totally agree. Let's work through how to make this an implementable law.

I have yet to write a perfect law on the books that doesn't go through many changes on its way to the governor's desk. I will. We've already met. We will continue to meet. I want something that works. And this isn't about being punitive to the tech companies. This is about actually keeping our children safe. That is the mission. That is what we should be doing. And every parent knows this.

Every parent you talk to right now, who has teenagers, who has young people living in their household, Democrat, Republican, rich, poor, it doesn't matter. Every parent understands that. They see the vulnerabilities of the system we have failed to implement. Right? They understand it. And the parents, the kids want more protections. Talk to your kids about this. They don't like it. They do not like it. And so it's incumbent upon us to create those protections. And so it's not. The bill's not perfect right now.

We will keep working on it. I will continue to work with opposition, as I always do. But I also welcome my Republican colleagues to be a part of the table. I appreciate the inquiries, the questions, the values that you've all expressed. Every bill I've done on tech regulation has been bipartisan to date. I would love for this to also be bipartisan. I actually think this is one of the last places in America where we can actually have bipartisan conversations in a very healthy way.

So let's continue to honor that and really put forth legislation that is bipartisan, because we know other states are going looking at us and the Federal Government's looking at us. So I would love to work with you all. I know Assembly Member Dixon already left. We're excited. She's a new Member of the Committee. So, with that, I would respectfully ask for all of you to help me with this and try to be a part of the solution, including the opposition. And would respectfully ask for an aye vote.

Thank you. We have a motion and a second. Can we call the roll?

Item number two, AB 1949. The motion is do pass as amended, to the Appropriations Committee. [Roll Call]

So, the bill has five votes. We'll leave it on call for the absent Members.

Thank you, Assembly Member Wicks. Mr. Lowenthal, I think you are up with AB 3040 H, and I'll take this pause to welcome the newest Member of the Privacy team. Josh Tuziar, new Chief Consultant. It's his first hearing. I'm sure he's loving that we're calling him out, but welcome, Josh.

Thank you.

Good afternoon Madam Chair and Members. I'd like to start by asking Assembly Member Wicks to restate everything she just did. Seriously, I'd like to start by taking the amendments and the analysis and thank the staff for the very thoughtful and capable work.

AB 3048 is a very simple Bill. AB 3048 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt out rights at all businesses with which they interact online in a single step. Currently, three browser companies already offer to consumers opt out preference signals. They're a Mozilla, Firefox, DuckDuckGo, and Brave.

The other browser companies, which occupy 90% of the global desktop browser market, do not offer support for these signals, requiring consumers to take extra steps to find and download a browser plugin created by third party developers, a process that most people likely don't have the technical ability or patience to go through. Currently, nine states, including California, require businesses to honor browser privacy signals as an opt out of sale of their personal information.

Most consumers are unaware of the amount of data that is harvested and disclosed by companies without their knowledge that is used to leverage and influence their behaviors daily. If this Bill is passed, California would become the first state to require browser vendors to directly support these signals, which would have sweeping benefits. AB 3048 is sponsored by the California Privacy Protection Agency and supported by several privacy rights groups.

Chair Members of the Committee, thank you for the opportunity to speak today. My name is Maureen Mahoney.

In the end, AB 3048 will ensure that an individual's right to privacy is upheld by requiring web browsers to offer easy to find global opt out settings so that anyone easily can stop the sale of their information by all businesses if they so choose. With me today, witnesses are Maureen Mahoney with the California Privacy Protection Agency and Yan Zhu of Brave Software.

Two minutes each, when you're ready.

I'm the Deputy Director of Policy and Legislation at the California Privacy Protection Agency. We're tasked with the implementation and enforcement of the California Consumer Privacy Act, and our mission is to protect Californians privacy. And consistent with that mission, the agency is the proud sponsor of AB 3048, which would require browsers and pursuant regulation devices to offer to consumers the option to use what's known as opt out preference. So what does that mean?

So one of the most important aspects of the California Consumer Privacy Act is an existing requirement that businesses receiving opt out preference signals honor them as an opt out of sale and sharing of their personal information. So, for example, right now, if you're using a privacy focused browser like Brave, DuckDuckGo, or Firefox, you can use these opt out preference signals.

So when you're using the browser, when you go to a site like newyorktimes.com, your browser will automatically send a signal and newyorktimes.com receives it and is required under California law to honor it as an opt out of sale and sharing. So you can see how it'd be a lot easier for consumers to exercise their preferences at hundreds, if not thousands of different websites that way, rather than going to every single site one by one and filling out a form and so on and so forth.

So this is a really important provision. It's been in effect since 2020. It's already being enforced by the Attorney General. Eight other states have followed in California's footsteps in requiring businesses to honor these signals, from Connecticut and Colorado to Texas and Montana. And there is a lot of coordination between these states. So we're really encouraged by the progress that's been made. But we are concerned about consumer access to these signals. Major browsers like Google Chrome, Apple Safari, Microsoft Edge don't offer native support for such signals.

And while there are other options on the market for consumers to enable these opt out preference signals, in practice there are significant barriers for them to do so. So for these reasons, we think at best that browsers offer these signals will increase consumer access to them and overall improve their privacy. And for these reasons, we respectfully ask for your support.

Thank you so much

Chair Members of the Committee, thank you for the opportunity to speak today..

My name is Yan Zhu and I am currently the Chief Information Security Officer at Brave. I've also previously served on the US Cybersecurity and Infrastructure Agency and as a staff technologist at the Electronic Frontier Foundation. Brave is an open source web browser, and we put privacy first. Our mission is to defend users from intrusive ads, fingerprinting, and tracking when they browse the web. We support AB 3048 because we believe Californians have the right to privacy regardless of whether they use Brave or not.

But since 2020, we have implemented this opt out preference signal in the form of Global Privacy Control, or GPC. As Maureen said, when someone uses Brave, they can automatically tell websites not to sell or share their personal information. I really believe this has saved our users countless hours of contacting businesses in order to exercise this important privacy right. And as a browser vendor, it really only took us a few days of engineering work to implement and test this opt out feature.

So we believe it would be straightforward for other browsers like Google and Apple to make the GPC setting available to billions of users. I also believe it's easy for website operators to honor GPC signals because they only have to access a single HTTP header or via the JavaScript signal to see if someone's opting out. So for these reasons, we respectfully ask for your support of AB 3048. Thanks.

Thank you. Anybody else in the room in support of this Bill?

Madam Chair Member Samantha Corbin on behalf of EFF in support of the measure thank you.

Thank you. Anyone here in opposition to the Bill? Come on up. Your chair is still available, and I got you water if you need it. I'm a full service chair. Thank you.

Thank you again. Ronak Daylami with CalChamber again, we are reviewing the amendments to this Bill.

We respectfully oppose AB 3048 as the Bill prematurely makes universal opt out preference signals mandatory and create significant compliance questions for businesses operating in multiple jurisdictions. Our Member companies support user choice, which is why browsers and devices already compete on offering clear, effective user controls over data uses. Users can also choose apps or extensions to manage their privacy preferences in a centralized manner.

When passing Prop 24, voters laid the groundwork for encouraging, but not requiring, businesses to increasingly incorporate and recognize global opt out preference signals under the CCPA. Recognizing the complexity of implementing an opt out preference signal, voters also required the agency to adopt regulations that meet certain requirements. For example, they were to be free of defaults that presuppose consumer intent and not conflict with other commonly used privacy settings or tools that consumers may use.

As it stands, however, a universal opt out preference signal is not yet ripe to consider as a device or browser mandated option. While online devices and advertisers are capable of distinguishing data uses by jurisdiction, including for California users, devices and software are offered globally to billions of users and cannot be easily altered for California users alone. It's unclear to us what an opt out preference signal under this Bill looks like when different states are proposing different opt out requirements.

Are we supposed to have different controls for every jurisdiction or every mechanism? Are consumers to be allowed to reverse their decision and opt back in, both as a general matter and also for specific use cases with a specific business? Also, we're unclear how this mechanism intersects with other privacy related user settings which control similar functionality in which a user has interacted with. These can be, for example, your iOS privacy settings or ad choices.

There's a very real possibility that consumers will send conflicting signals which would create significant compliance burdens for businesses. So again, because there are challenges and complexities involved with mandating the op out preference signal that this Bill doesn't unfortunately address, we must oppose. Thank you.

Thank you, Dylan.

Thank you. Madam Chair and Members. Dylan Hoffman, on behalf of TechNet, I'm Executive Director for California, and we are respectfully opposed to AB 3048. I align my comments with the chamber.

I don't need to retread much of that ground, but do want to point out that a lot of these universal opt out mechanisms, though they've come a very long way in a very short amount of time, they do present several limitations, especially as far as when and how to honor some of those consumer choices. For example, obviously, if a consumer opts out, that signal is being sent globally to every website. But it's unclear how exactly a business or a browser should treat that.

If they go in and change a specific website, for example, or are they going to be greeted with a pop up every time that they come to these websites, asking them to opt back in, that can be very frustrating if they feel like they've gone through their settings already and tried to configure that on a site by site basis. And so that sort of interoperability still remains a challenge. And I think is kind of our main concern with sort of mandating that across the board.

And for those reasons, we respectfully oppose AB 3048. Thank you.

Thank you. Anyone else in the room in opposition? Come on up. Name, organization and position, please.

Yeah. Good afternoon. Naomi Padron on behalf of the Computer and Communications Industry Association, opposition. Thank you

Hello, Ryan Allain, on behalf of the California Retailers Association and respectful opposition. Thank you.

Steve Carlson, Association of National Advertisers, in opposition. Thank you.

Thank you. Okay. Seeing no additional folks in the room, bring it back to the Dais members

We do not yet have a motion. Motion. Second. Second, okay. Mister VIce Chair.

Thanks. You know, I was on a website the other day, and it's one of those where you're like, you're supposed to accept whatever privacy choices you make and then it keeps it forever. But every time I go to the website, it keeps asking me.

I'm convinced, by the way, that all these things that pop up, every darn website I go to probably has like a ton of global carbon emissions because of the amount of data centers that have to keep all this data of just me clicking yes a million times for the same website.

But to me, this Bill does sound like, I guess that's an example of where I think I've selected my choices and it's still not comprehending it and it could be on the end user or the website developers. But this was not some small company, this was a very large company that I just have to yes, I accept your freaking cookies. But it seems to me also that there are products out there that people have that can download to do this.

And so I think like mandating it for all the browsers. I'd be interested to know your thoughts in your closing, if you want, why we would mandate it for all if we already, as a consumer, have an option to download a browser that has that feature. Thank you.

Thank you. Anyone else? Miss Irwin.

Just out of curiosity for the Brave CISO, is the opt out signal the only thing that separates your browser from Safari and Chrome?

No. We also have some technical measures like automatically blocking what we think are trackers.

And so you're not concerned that it makes you less competitive to have every browser required?

Not at all, because we really think it's better for privacy if everyone can easily access this option without having to figure out how to download a plugin. So it's net beneficial for users.

Alright, thank you.

Thank You. Mister Hoover.

I would be happy to try and address Assembly Member Patterson's question.

Um, Mr. Lowenthal is that your preference?

That would be fine. I'll address it as well in closing. Okay, please go ahead.

Yeah, just wanted to offer a few thoughts. That is a really great point, and we appreciate that there are browsers such as Brave, DuckDuckGo and Firefox that allow consumers to send these opt out preference signals, and then consumers can also download third party browser extensions into their existing browser to send those signals.

I think the problem is that the biggest browsers that aren't offering these signals really occupy a significant amount of the market. Many of these browsers are coming pre installed in devices and they're browsers that consumers are used to using. So in my experience, there's often reluctance for consumers to try to switch to another browser, even if they're concerned about their privacy rights.

And then also with the third party browser extensions, there can be some issues there, not only in barriers to downloading them, but they can also introduce security vulnerabilities. So that's why we think it's important that browsers offer these opt out preference signals.

Thank you. We were about to go to Mister Hoover.

Yeah, that was kind of. Is this what it's like to? I don't think I've ever served on a Committee with the honorable Joe Patterson, so.

But that was kind of in the same vein as what my question was going to be.

But I think, and I'll just, since you've kind of already answered the question, I'll just, I guess, make a comment that, you know, while I appreciate the goal of the Bill, which is to expand consumer privacy, I think it's really difficult for me to understand why we as a state would take away the option for a consumer to opt in to a browser that maybe, obviously, there's already options like Brave on the market, and I think that's fantastic.

But for consumers that maybe want some of those features outside of that type of a browser, why would we put one type of browser and mandate it across the board? So, Assembly Member Lowenthal, if you want to address that, that'd be great. But I think that's where I'm at today, where I just don't see how this actually increases choices for consumers. To me, it actually does the opposite where it's taking away those choices.

Thank you. Anybody else?

Okay, well, I want to, before I allow you to close, I want to thank you for this Bill. I think that we often grant rights to Californians and don't care whether they're meaningful. And I think what you're doing here is actually making a right that is already in the hands of every single californian truly meaningful. And, you know, the Vice Chair told his story that I think every single one of us can relate to.

Of those pop ups on every website that get, you know, I think are really, I'm a privacy advocate, so I think they're valuable because they give me the option. But the idea that we can have a more global way of ensuring that we can protect our privacy, I think is a critical step in the right direction. And so I think this is a great Bill. I thank you for taking the Committee amendments.

I do think they help clarify a lot of things that make it more tighter and hopefully address some of the opposition that we've heard. And with that, I like your close.

Thank you, Madam Chair Members. I do just want to respond to a few things. First of all, I want to make sure that everybody heard very carefully about the opposition's comments, and they were very thoughtful comments, and I have tremendous respect pursuant to what I said in Assembly Member Wicks Bill.

It's my goal for tech to be more successful, not less, and to find that right secret sauce. And I didn't hear any opposition whatsoever to the concept. I heard opposition to the implementation, how clunky it would be, how we'd be outliers, how it would be difficult to implement different platforms, but no opposition to the actual concept. So what we can all agree upon is that privacy and opt in preferences are important. To your comments.you know, Mister Patterson, standardization is not a bad thing.

Standardization provides consumer protection for us in ways that are not necessarily imaginable at the moment. Can you imagine if we didn't standardize seatbelts and every car had a different type of standard, and you had to figure that out when you're getting in a car? Does that make you safer or less safe?

Can you imagine if we didn't standardize nutritional value in the food that we're consuming, and you had to figure out every different piece of food that you had, that you were buying, the different nutritional content, and whether or not it was safe to have, if you had an allergy or otherwise. Standardization in this case, protects consumers for things that we're already all agreeing upon. And I don't fear California being bold and taking the proper steps to provide consumers with complete protection if they want it.

If they want it. And my concern here is that the concerns about being clunky, is actually a cloak, that really the goal is here is to keep us from not opting out. From not opting out. With that, I respectfully ask for everybody's aye vote. Thank you.

Thank you. We have a motion in a second. Let's call the roll.

Item number five, AB 3048 by Assembly Member Lowenthal. The motion is do pass as amended to the Appropriations Committee. Bauer-Kahan? Bauer-Kahan, Aye. Patterson? Patterson, no. Bryan?

Bryan, aye. Dixon? Dixon, no. Hoover? Hoover, no. Irwin? Irwin, aye. Lowenthal? Lowenthal, aye. Ortega? Ortega, aye. Ward? Ward, aye. Wilson? Sorry. AB 3048 Wicks? Wick, aye.

No worries. That has seven votes, that's out. We'll leave the roll open for absent Members. Let's start by calling the consent calendar again, please.

The Bills on consent. Patterson? Patterson, aye. Hoover? Hoover, aye. Ortega? Ortega, aye. Ward? Ward, aye. Wilson?

So the sent calendar is open 100. We'll leave it open for the absent Member.

[Roll Call]

\We are adjourned. It.