California's "Do Not Track" Disclosure Bill, AB 370, is Not Law Yet

Over the last week or so, we have seen numerous media articles and even law firm client alerts reporting that California requires new online disclosures regarding "do not track."  However, California's AB 370 is not law yet - the bill was sent to Governor Brown on September 3, 2o13, a week ago, but, as of this posting on September 10, 2013, has not yet been signed by Governor Brown. If AB 370 is signed into law, it would amend existing California Business & Professions Code section 22575 (CalOPPA) to add the following to the things that must be included in an organization's online privacy policy:

[(b) The privacy policy required by subdivision (a) shall do all of the following: . . .]

(5) Disclose how the operator responds to Web browser “do not track” signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer’s online activities over time and across third-party Web sites or online services, if the operator engages in that collection.

(6) Disclose whether other parties may collect personally identifiable information about an individual consumer’s online activities over time and across different Web sites when a consumer uses the operator’s Web site or service.

The bill provides that "[a]n operator may satisfy the requirement of paragraph (5) by providing a clear and conspicuous hyperlink in the operator’s privacy policy to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice."

If AB 370 becomes law, it will have impact beyond California - CalOPPA purports to apply to any website that collects information from California residents.

We will of course keep you posted.