Advertisers don’t like Hawaii’s sweeping new privacy bill

A new internet-privacy bill under consideration in Hawaii would give the state’s residents digital protections potentially beyond those offered by the landmark law that recently went into effect in California.

The legislation, which has already been read multiple times in a Hawaii House of Representatives committee, would mirror the California Consumer Privacy Act in requiring businesses to tell Hawaiians what data they are collecting and giving people the right not to be subjected to that data-gathering. But it goes a step further in outlawing the sale of geolocation data and browsing histories without users’ explicit consent.

The bill, which was introduced by Honolulu Democrat Chris Lee, enjoys the support of Hawaii Chief Information Officer Douglas Murdock, who submitted written testimony on its behalf on Tuesday, as well as the state’s Department of Commerce and Consumer Affairs, which would be responsible for enforcing the measure. In his testimony, Stephen Levins, head of the department’s Office of Consumer Protection, said Hawaii expanding its definition of “personal data” would help protect residents from data breaches, which he said have become much more sophisticated since the state adopted its breach notification law in 2006.

But the bill has also drawn stiff opposition from the tech and advertising industries, particularly in response to the prohibition on the selling of geolocation data without consent. A coalition of five trade groups sent legislators a letter claiming that provision would “undermine the ad-supported internet.”

“Requiring opt-in consent for the sale of geolocation information and internet browser information would fundamentally change Hawaiians’ ability to access products and services they enjoy and expect through the Internet,” read the letter, which was signed by the American Association of Advertising Agencies, American Advertising Federation, Association of National Advertisers, Interactive Advertising Bureau and Network Advertising Initiative.

The California law uses an “opt-out” approach, which is often manifested in a pop-up box that appears on websites telling users their browsing data may be collected and resold unless they specifically decline.

The advertising groups, though, claim that under the Hawaii bill’s opt-in method, consumers would be “inundated with requests for their consent to transfer internet browser information, thereby overwhelming them with a variety of notices and requests and causing significant consumer frustration.”

But Murdock’s testimony, while brief, explicitly endorsed the ban on selling geolocation and browsing data without explicit consent. A section that would’ve required companies that collect Hawaii residents’ information to register as “data brokers” — similar to a Vermont law that went into effect last year — was removed from the bill over opposition from industry groups and Levins, who said such a registry would be unnecessary.

The Hawaii privacy bill would also prohibit deepfake videos — recordings that use AI to inject a person’s likeness into scenes where they were not actually present — in which individuals are “depicted in the nude … or engaged in sexual conduct.” That provision also earned the bill the support of the Screen Actors Guild.

The legislation also continues the trend of states enacting their own individual privacy bills in the absence of any federal policy. In addition to Hawaii, Washington state is also in the process of deliberating a sweeping privacy measure.