Endorsement: Yes on Prop. 24. It’s not perfect, but it would improve online privacy

Over the last decade, personal data has become the invisible currency that funds much of the internet. Social networks, sites and apps attract people with free content and services, then use the data they gather to make a fortune off of targeted advertisements.

Two years ago, the Legislature passed a groundbreaking law to give Californians more control over the personal information collected from them online. The idea was to let you withdraw from that hidden exchange of information, barring sites from selling your data to third parties that assemble detailed profiles of consumers’ habits and tastes.

Unfortunately, the California Consumer Privacy Act, which went into effect this year, didn’t live up to its billing. Major online companies found ways to wriggle out if its requirements, and industry lobbyists have pressured the Legislature to water it down further. In response, Alastair Mactaggart, a Bay Area real estate developer who was one of the main proponents of the act, and state Sen. Robert M. Hertzberg (D-Van Nuys) crafted an initiative aimed at shoring up the law and steered it onto the November ballot.

Proposition 24, also known as the California Privacy Rights Act, would expand Californians’ privacy rights in several areas, while also amending the current law in several ways that are hotly disputed. The measure is supported by a broad array of privacy experts, but it’s opposed by several well-respected privacy and civil liberties organizations, as well as a number of internet industry groups. Two major privacy advocates, Consumer Reports and the Electronic Frontier Foundation, have declared their neutrality, praising some aspects of the initiative and criticizing others.

We could sink deeply into the history and the behind-the-scenes drama, but in the end, the questions for voters are whether Proposition 24 would make privacy protections stronger, whether it goes far enough to make a meaningful difference, and whether it would enable the state to provide even better protections in the future. The answer to all three is yes.

Although California’s current privacy law is the strongest in the country, it has many shortcomings. Its limits apply only to the sale of data, so some sites have circumvented them by claiming they’re not selling personal information, they’re merely sharing it with partners. That’s one of several glaring loopholes that big, data-hoovering sites and platforms such as Google, Facebook and Spotify have exploited.

In addition, only the state attorney general can bring enforcement actions, and Atty. Gen. Xavier Becerra has said he can’t imagine bringing more than two of those a year. Plus, anyone found in violation has the right to correct the problem without penalty. In other words, every site and service starts with a get-out-of-jail-free card they can use repeatedly, once per different type of offense.

Meanwhile, even when the law works as intended, the result can be jarring. For many people, the internet has become a frustrating succession of “cookie walls,” as each new site they visit forces them to jump through multiple hoops in order to bar the sale of their data. And once they do, they may be denied access to the site unless they buy a subscription.

Proposition 24 would close many of the loopholes undermining the current law. Among other things, it would cover data sharing as well as sales, give Californians the explicit right to opt out of the kind of tracking that Google and other ad networks continue to do, provide new rights to correct information that’s been collected and stop the automated processing of personal data. It would define a new category of “sensitive personal information” — including race, sexual orientation, union membership and location — and let Californians limit its use online. It would establish and fund a new state agency to replace the overburdened attorney general’s office as the source and enforcer of data privacy rules. And it would bring California law much more closely into line with the European Union’s powerful privacy framework, the General Data Protection Regulation.

Critics concede these points. They argue, however, that Proposition 24 settles for too little in terms of privacy rights, would weaken privacy protection in certain areas and would prevent the Legislature from adopting more protective statutes.

These are all contentious points, mainly because current law and Proposition 24 are extremely technical in nature, as is the whole issue of online data collection. The proposition also is no model of clarity. Nevertheless, opponents do not make a compelling case.

Mactaggart and Hertzberg focused on behavioral targeting, not on the broader internet ecosystem of data collection. So, like current law, the new measure would not force sites to ask first before collecting data, nor would it bar them from giving better content or services to consumers who allow the sale of their personal information — or, alternatively, who pay a fee that reflects their data’s value to the seller. The latter, opponents say, is a pay-for-privacy approach that discriminates against people of lesser means.

Supporters of Proposition 24 note that a growing number of browsers and smartphones are set by default to tell sites not to share personal information, which amounts to an automatic opt-out. They also argue, persuasively, that the new measure wouldn’t make the current system of cookie walls and pay-for-privacy worse; instead, it improves on the current law by closing loopholes and giving sites more incentive to treat people who won’t allow data sales the same as those who will.

The biggest concern raised by opponents of Proposition 24 is that the law says it should be implemented in a way that gives attention to the impact on businesses, which they argue will prevent the Legislature from adopting new privacy protections that further limit data collection. However, they’re misreading the proposition, which allows the Legislature to change the law (by a simple majority vote) only in ways that “are consistent with and further the purpose and intent of this Act.” And the purpose and intent is clearly stated: “to further protect consumers’ rights, including the constitutional right of privacy.”

In other words, the measure would set a solid foundation for online privacy rights in California, while leaving the door open for the Legislature to add on more protections. Vote yes on Proposition 24.