March 31, 2023

Volume XIII, Number 90


March 30, 2023

Subscribe to Latest Legal News and Analysis

March 29, 2023

Subscribe to Latest Legal News and Analysis

March 28, 2023

Subscribe to Latest Legal News and Analysis

California’s “Your Data, Your Way” Initiative

California keeps making privacy headlines for its trailblazing California Consumer Privacy Act(“CCPA”), set to take effect January 1, 2020, but there is another set of privacy bills making its way through the California state legislature, that, if passed, will provide consumers with further privacy protections.

The “Your Data Your Way” initiative, comprised of four legislative bills and a non-binding resolution, is a privacy plan introduced by several Republican Assembly members in January on National Privacy Day, that has passed California’s Committee on Privacy and Consumer Protection (“the Committee”), and is now headed to the Assembly for a potential vote, followed by the Senate. Each bill has already been revised to some extent during the Committee process, and will likely experience further revisions along the way.

Below are some highlights from the four “Your Data, Your Way” initiative bills:

  • AB 1035 An amendment to California’s data breach notification bill, sponsored by Assemblyman Chad Mayes, would require covered businesses to notify affected individuals of a data breach within 45 days of discovery of the breach. The bill originally included a 72-hour data breach notification requirement, similar to the GDPR, but this was revised during the Committee process.
  • AB 1395 Virtual assistants, such as Alexa, have raised concerns about unintended recording of conversations and utterances by users. Sponsored by Assemblyman Jordan Cunningham, this bill would limit data collection conducted by tech companies via these devices. Specifically, the bill includes a prohibition on data storage and marketing of recorded voice commands without prior consumer consent.
  • AB 288 Another bill sponsored by Assemblyman Cunningham on social media privacy, would allow “social networking service” users that close their account the option to have their personally identifiable information (PII) permanently removed from the company’s database and would prohibit the company from selling this PII to, or exchanging the PII with a third-party, subject to a few exceptions.
  • AB 1138 Assemblyman James Gallagher’s bill, AB 1138 would require social media websites and apps to obtain parental consent before creating the account of a child under the age of 13. This builds on California’s Parent’s Accountability and Child Protection Act (AB 2511), which becomes effective on January 1, 2020. AB 2511 requires a person or business conducting business in California and that seeks to sell certain products or services to take reasonable steps, as specified, to ensure that the purchaser is of legal age at the time of purchase or delivery, including, but not limited to, verifying the age of the purchaser.

In addition, as part of the “Your Data, Your Way” initiative, a non-binding resolution entitled “21st Century Monopolies” was introduced, calling on the Federal Trade Commission (FTC) and Congress to update the federal anti-trust laws in order to more effectively protect consumers.

As recently touched on by Charlie Warzel in an opinion piece entitled, “We are Drowning in Data” in the newly established New York Times Privacy Project, we still cannot fathom the extent to which technology will cause an expansion in the already exorbitant amount of ways our personal data is collected. Innovation continues to outpace technology, but California is certainly trying to keep up!

Jackson Lewis P.C. © 2023National Law Review, Volume IX, Number 133

About this Author


Joseph J. Lazzarotti is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. He founded and currently co-leads the firm's Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals. Trained as an employee benefits lawyer, focused on compliance, Joe also is a member of the firm’s Employee Benefits practice group.

In short, his practice focuses on the matrix of laws governing the privacy, security, and...

973- 538-6890

Maya Atrakchi is the Knowledge Management (“KM”) Attorney for Jackson Lewis P.C.’s Privacy, e-Communication and Data Security and International Employment Issues Practice Groups, and is based in the New York City, New York, office of Jackson Lewis P.C.