Knowing is Half the Battle: Demand to Know How Your Information is Collected and Shared

When you search online, shop, or use a mobile app, do you know what personal information is being collected about you and your family? Any idea just how much sensitive information about your location, health, finances, religion, sexual orientation, buying habits, and more is ending up in the hands of data brokers, online advertisers, applications, and other third parties? And how it is being used and potentially abused? We don't know a lot about what's happening behind the scenes to our own personal information and many companies want it to stay that way.

That's why the ACLU of California is teaming up with leading domestic violence advocates, women's groups, sexual health organizations, and civil liberties and consumer privacy groups to support the California Right to Know Act - AB 1291 (Lowenthal D- Long Beach).

The Right to Know Act will work like this: you ask a company what personal information that they have about you and what companies they have shared it with, and they tell you. It's that simple. It will modernize current California privacy law so that we can monitor how our personal information is collected and shared in the modern digital age.

It's time for the Right to Know Act. 82% of California voters- across demographic, regional and political spectrums- are concerned about how their personal information is being collected by companies. 69% of Americans believe there should be a law that gives people the right to know everything a website knows about them. The White House Consumer Privacy Bill of Rights, Federal Trade Commission, and the California Attorney General all support data transparency and access for consumers. And Europeans already have the right to know what information has been collected about them.

California privacy law is falling further behind the times.

A decade ago, California passed a landmark transparency law to give us the right to know the "who, what, where, and when of how a business handles personal information" so that we could "make a rational and informed and personal choice to opt-in, opt-out or simply take their business elsewhere." But, fast forward a decade and with exponential advances in technology and dramatic changes in business practices, current law is no longer able to live up to its promise.

California transparency law hasn't been updated since 2003. A lot has changed since 2003.

Websites are now installing up to 100 tracking tools that allow third party advertising and marketing companies to collect information about your age, gender, race, income, health concerns and recent purchases. Many mobile apps are now sharing location, age, gender, phone numbers, and other personal details of both adults and children with third party companies. Many Facebook apps are able to access your sensitive information and those of your friends, including religious, political, and sexual preferences. And data brokers are engaged in the widespread buying, selling, and trading of personal information obtained from mobile phones, banks, social media sites, and stores.

The collection and disclosure of personal information in ways that Californians do not expect or realize can lead to real privacy, personal safety, and financial security harms.

Companies collecting and tracking online information and activities have exposed sensitive health and sexual orientation information. Target revealed that a woman was pregnant and Facebook outed the sexual orientation of a college student before they told their families. Americans have lost jobs and been denied mortgages when data brokers shared incorrect information and scammers use data broker lists to target vulnerable populations like seniors. Several women and children have been hurt or killed when cell providers or applications collected and shared location data with abusers.

The current law isn't working well for Californians or companies due to confusing requirements, obsolete definitions, and inefficient mechanisms. The Right to Know Act (AB 1291) fixes all this. It gives companies new flexibility and properly incentivizes privacy protective steps like anonymizing personal information that is retained or disclosed. It updates the law's definitions to make sure that Californians will know if their sensitive location information, Internet and mobile activities and sexual orientation is being collected and shared by companies. And Californians will be able to use the law not just to learn how a company is sharing personal information to use for "direct marketing"- to send junk mail, SPAM, or call us on the phone- but also to learn the many other ways that companies are now disclosing our personal information, including with advertisers, data brokers, and apps.

In the immortal words of GI Joe - "Knowing is half the battle." The Right to Know Act is not about limiting or controlling company information collection or sharing. But it is about modernizing current California transparency law to make it work effectively and efficiently for the digital age and give us all real information about how our personal information is being collected and shared so we can make informed decisions about who to trust. It's our personal information and we deserve the right to know what's happening to it.

Please help us pass this important privacy law. Demand the Right to Know so you can better protect your privacy, personal safety, and financial security. Contact your California legislator today and urge them to support AB 1291- The Right to Know Act.

For more information about the California Right to Know Act, including a fact sheet, current bill language and list of supporters, visit here.

Nicole A. Ozer is the Technology and Civil Liberties Policy Director with the ACLU of Northern California.