Newsom Vetoes California Privacy Bill That Upped Consumer Data Control

In a pivotal moment for data privacy and child protection, California Gov. Gavin Newsom recently made two contrasting decisions that highlight the complexities and competing interests in the realm of digital regulation.

While he vetoed a privacy bill aimed at empowering consumers, he approved legislation designed to curb social media addiction among minors. These actions reflect the current landscape of privacy rights and underscore the ongoing struggle between consumer protection and corporate interests in California’s tech-heavy economy.

Newsom vetoed a bill that sought to simplify how consumers manage their data privacy online. This legislation would have mandated that internet browsers and mobile operating systems implement an “opt-out preference signal,” enabling users to easily send legally binding requests to opt out of data sharing under the California Consumer Privacy Act (CCPA).

In his veto letter, Newsom expressed concerns about imposing such mandates on operating system developers, arguing that no major mobile platform currently supports an opt-out signal. He emphasized the importance of allowing developers to make design decisions rather than placing regulatory burdens on them.

“Last year, I signed SB 362 (Becker), which requires the California Privacy Protection Agency to establish an accessible deletion mechanism allowing consumers to request that data brokers delete all of their personal information,” Newsom wrote in the letter. “I am concerned, however, about placing a mandate on operating system (OS) developers at this time. No major mobile OS incorporates an option for an opt out signal. By contrast, most internet browsers either include such an option or, if users choose, they can download a plug-in with the same functionality. To ensure the ongoing usability of mobile devices, it’s best if design questions are first addressed by developers, rather than by regulators.”

The vetoed bill was a priority for the California Privacy Protection Agency and would have affected major tech companies like Google, Microsoft and Apple, all of which lobbied against it.

“It’s disappointing that this marks the end of the road for this landmark privacy legislation during this session,” said Matt Schwartz, policy analyst at Consumer Reports, in a statement. “Ultimately, industry worked overtime to squash this bill, as it empowered Californians to better protect their privacy, undermining the commercial surveillance business model of these tech companies. We strongly disagree with the idea expressed in the Governor’s veto statement that it should be left to operating systems to provide privacy choices for consumers. They’ve shown time and again they won’t meaningfully do so until forced.”

Meanwhile, Newsom signed a law aimed at mitigating the impact of social media on minors. This legislation prohibits social media platforms from knowingly offering addictive feeds to users under 18 without parental consent, set to take effect in 2027. It reflects a growing recognition of the negative effects of social media on young people, including increased isolation, anxiety and unhealthy consumption patterns.

Critics of the legislation argued it may unintentionally restrict adults’ access to content due to age verification issues and could compromise online privacy by necessitating greater data collection from users, the Orange County Register said in a report.

The law defines an “addictive feed” as any platform where multiple user-generated media pieces are recommended or prioritized for display based on user information or device association, with certain exceptions.

This new legislation comes on the heels of a recent New York law that allows parents to block algorithm-driven content for their kids. Utah has also passed laws last year aimed at restricting children’s access to social media.

California’s new law will take effect in a state home to many of the largest tech firms in the world. Previous attempts to implement similar regulations failed, but Gov. Newsom had already made strides in 2022 with a pioneering law that prevents online platforms from misusing personal data in ways that could endanger children. This initiative is part of a growing movement across the country focused on mitigating the effects of social media on young people’s wellbeing.

“Every parent knows the harm social media addiction can inflict on their children — isolation from human contact, stress and anxiety, and endless hours wasted late into the night,” Newsom said in a Friday (Sept. 20) statement. “With this bill, California is helping protect children and teenagers from purposely designed features that feed these destructive habits.”

Under the new law, social media platforms are prohibited from sending notifications to minors from midnight to 6 a.m. and from 8 a.m. to 3 p.m. on weekdays during the school year. All accounts for minors must be set to private by default.