California Governor Jerry Brown has signed into law A.B. 370, which modifies Section 22575 of the Business and Professions Code to require website operators to disclose in their privacy policies how the website "responds to web browser 'do not track' signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer's online activities over time and across third-party Web sites or online services." Section 2275 already required websites or online services that collect personally identifiable information through the Internet about individuals residing in California to have a conspicuously posted privacy policy. The law also already included some minimum requirements about the contents of that privacy policy. As revised, the law now also requires the website operator to disclose whether third parties collect personally identifiable information about an individual consumer's online activities over time and across different Web sites when that individual uses the operator's website or service. It also requires website operators to explain to consumers how the site responds to "do not track" or other choice mechanisms, if the site engages in the cross-site tracking contemplated in the law. Although the requirements are the first of their kind in the country, they closely mirror the self-regulatory scheme that has been in place for some time (which was designed to respond to FTC concerns). Under that scheme, websites should give consumers notice of cross-site tracking that is used to serve behavioral advertising, and give consumers a choice about such activities. It is thus not clear what effect this new law will have, other than to provide statutory requirements for what has been – until today – merely been a self-regulatory requirement.

Tip: For companies whose sites collect information from or about individuals in California, the release of this new law is a good reminder to coordinate with business teams – if they have not done so already – to determine if cross-site tracking is occurring, and to ensure that any choices operators provide are appropriately disclosed. Participation in the DAA's behavioral advertising program should be well on their way to addressing the disclosure requirements of this new law.