California Assemblyman Isadore Hall introduced Assembly Bill 257 which addresses mobile privacy. The bill would codify many of the best practices proposed by the California Attorney General in her report titled “Privacy on the Go: Recommendations for the Mobile Ecosystem,” such as requiring mobile apps to have a privacy policy; allowing consumers to access their own personally identifiable information (PII) that the app collects and retains; provide a supplemental privacy policy with enhanced measures if an app collects PII that is not essential to the app’s basic function; providing a special notice if the app accesses text messages, call logs, the camera, dialer or microphone, or collects location, financial, or medical information or passwords. The bill also would require advertising networks that deliver ads through a mobile application to obtain prior express consent before displaying an ad and before accessing PII; use application-specific or temporary device identifiers rather than unchangeable device-specific identifiers; and transmit user data securely, using encryption for permanent unique device identifiers and personal information.

A few weeks after the California Attorney General published her best practices for mobile privacy, members of the advertising industry sent her a letter expressing their concerns, calling her recommendations “unworkable.” Since that time, the FTC released its own mobile privacy guidelines titled “Mobile Privacy Disclosures: Building Trust Through Transparency” (which we summarized in an alert). The FTC also issued guidance for mobile security: http://business.ftc.gov/documents/bus83-mobile-app-developers-start-security.

California Assemblyman Ed Chau introduced Assembly Bill 242 which would amend California’s Online Privacy Protection Act by requiring that privacy policies be no more than 100 words long, be written in clear and concise language that an eighth grader could read, and indicate whether PII may be sold or shared with others, and how and with whom the information may be shared.