A new California law taking effect on January 1, 2014, will require any operator of a website or online service that collects personally identifiable information on state residents to include new do-not-track disclosures in its privacy policy. As businesses revise their website privacy policies to add the new disclosures, they should consider having legal counsel review their policies to ensure that they comply with applicable federal and state laws and reflect current best practices.

Signed into law by California Governor Jerry Brown on September 27, 2013, Assembly Bill No. 370 (AB 370) amends Section 22575 of the state’s Business and Professions Code. Section 22575 requires the operator of a website that collects personally identifiable information on consumers residing in California who use or visit the site to conspicuously post its privacy policy on the site. (The operator of an online service must make its privacy policy available by any reasonable accessible means.)

As amended by AB 370, Section 22575 requires such an operator to include in its privacy policy a description of how the operator responds to do-not-track settings in consumers' browsers. The law describes such settings as “signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer's online activities over time and across third-party Web sites or online services.” An operator can satisfy the new requirement “by providing a clear and conspicuous hyperlink in the operator's privacy policy to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice.”

The law also requires an operator to disclose in its privacy policy whether, when a consumer uses the operator’s website or service, other parties can collect personally identifiable information about a consumer's online activities “over time and across different Web sites.”