Vermont Data Privacy Bill Is Vetoed

Want to receive these privacy recaps that matter to consent management, adtech and martech in your inbox? Sign up for our privacy newsletter, A Little Privacy, Please.

USA

Vermont Data Privacy Bill Is Vetoed

Vermont Governor Scott announced his veto of H 121, a bill that contained both a comprehensive data privacy law and an age-appropriate design code.

TAKEAWAY

The governor listed the bill’s private right of action and pending legal challenges to California’s age appropriate design code as reasons for the veto, which have been common obstacles for bills containing similar elements in other states.

Rhode Island’s Data Privacy Bill Steps Up for Signature

Rhode Island’s legislature passed and sent to its governor H 7787, the Data Transparency and Privacy Protection Act.

TAKEAWAY

Rhode Island’s data privacy bill is missing certain elements common to most other state comprehensive privacy laws, such as an obligation to recognize universal opt out mechanisms and a data minimization requirement, but it contains one unique element: a requirement to identify, in a controller’s customer agreement or another conspicuous location on its website or online service, all third parties to whom the controller has sold or may sell customers’ personally identifiable information (which is not defined). This differs from Oregon and Minnesota laws, which give customers the right to request a list of third parties but do not require a public posting of the list.

Get the up-to-date Sourcepoint overview of US state consent and data privacy laws.

EUROPE

noyb Claims Google’s Privacy Sandbox “Topics” API Violates GDPR

Privacy advocate noyb filed a complaint with the Austrian data protection authority, claiming that Google’s Privacy Sandbox “topics” API violates Articles 5(1)(a) (Fairness and Transparency) and 6(1)(a) Consent as a Legal Basis of GDPR compliance. In particular, the complaint alleges that Google misled users into thinking they were consenting to a privacy tool, when in fact they were opting into an ad tracking tool. 

MORE CONTEXT

According to Google’s Privacy Sandbox developers page, “the Topics API enables interest-based advertising without having to resort to tracking the sites a user visits”. It “preserves privacy while allowing a browser to share information with third parties about a user’s interests.” In the “how it works” section, it says “the browser observes and records topics that appear to be of interest to the user, based on their browsing activity” which is “recorded on the user’s device.” API callers (such as ad tech platforms) are then given “access to a user’s topics of interest, but without revealing additional information about the user’s browsing activity.”

The noyb complaint alleges that the Chrome browser “still tracks users for Google’s behavioral advertising,” but “it is just done by the browser of one company (Google) instead of countless servers-side third party tracking systems.” “Rather than making it clear that they were asking for consent to have their browser track users,” the complaint alleges, “Google sold the Sandbox API as a “privacy feature” to users….[as] a conscious choice to manipulate user understanding and ensuring a high consent rate, as users thought that their browser is now protecting them against tracking for advertisement.” Therefore, according to the complaint, “Google referring to this system as a ‘privacy’ tool is deceiving.”

Want more of the privacy highlights that matter for consent management, adtech and martech? Sign up for our privacy newsletter, A Little Privacy, Please.

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.