The state of California is currently considering a bill (SB761
) that, if passed in its current form, would require websites to ask visitors for permission before tracking them via cookies. While there are already apps and add-ons that allow web surfers to manually control what cookies they accept or refuse, the new bill would require companies to explicitly ask visitors if they wanted to be tracked. Google and Facebook have jointly sent a letter to the government claiming that passage of the bill would have disastrous consequences.
The relevant text is as follows:
[The bill] would require a... person or entity doing business in the state of California that collects, uses, or stores online data containing covered information from a consumer in this state to provide a consumer in California with a method to opt out of that collection, use, and storage of such information.
The bill would, to the extant consistent with federal law, prohibit a covered entity from selling, sharing, or transferring a consumer's covered information. (emphasis original)
Information covered by the bill would include the date and time of access, the location of the consumer (including the IP address) and any other personally identifiable information. This last covers a broad range of things, including everything from social security numbers to email or personal addresses.
Worst. Idea. Ever.
To say that Google and Facebook think this is a bad idea is a colossal understatement.
In just six pages, the two companies jointly argue against the bill on the following grounds:
It would sabotage the "rich content and free services" provided by the Internet.
Customers would be more vulnerable to security threats.
It's unnecessary, since all leading browsers contain privacy settings and/or incognito browsing
Online commerce would be rendered "unworkable" due to the "unprecedented and arduous regulatory burden."
It's unworkable and unenforceable, period. Can't be done. Nope.
Even if it was possible, it'd have "sweeping, negative implications for security... including health care, financial services, retail fraud, and online safety."
Such a measure would be unconstitutional, as it would "regulate business far beyond California's borders."
Add-ons and extensions are fine. Government protection is the devil.
The joint statement from the two companies eschews coherent discussion in favor of throwing every possible objection at the state government to see if anything sticks. This is a long-established tactic of the legal profession, particularly when appealing the decision of a lower court. While SB 761 would create certain burdens, it's clearly written as applying only to residents of California. The law doesn't make cookies illegal, it simply requires that citizens be presented with an option to choose. Furthermore, the bill allows the Attorney General to modify the scope or application of the definition of "sensitive information" and to consider the context in which the information is used, the ease with which it can be used to identify a person, and the potential adverse impact.
We're willing to bet Google and Facebook are far more concerned about their advertising revenue than anything else. Being forced to offer consumers a choice regarding such tracking risks sabotaging targeted advertising. For all their frantic posturing, none of the concerns ring so true as to present a clear and present danger to California's web denizens or its online industry.