03 Jul 2026 Search

I went to the SB 690 hearing at the California Assembly Privacy And Consumer Protection committee meeting this week.

  • Opponents of SB 690 say that, in its original form, the bill would have removed the right of victims to sue over heinous abuses by Big Tech.

  • Supporters of SB 690 say that without it, small businesses are at legal risk for some ordinary online marketing practices.

The hard part is that they’re both right.

Big Tech’s oligopoly on small business advertising makes the villainous and the ordinary hard to tease apart.

And that’s by design. Big Tech’s advertising systems are designed to maximize their own revenue from harmful practices at the expense of small business advertisers. Whether it’s Instagram promoting child sexual abuse material, or Facebook getting away with enabling a real estate scam, the common enabling practice is AI-powered adversarial personalization—targeting the social media scam epidemic and other problematic material to those likely to fall for it, while avoiding enforcement. (Update: India orders Meta to pull Instagram child abuse ads by Alina Maria Stan)

And Mark Zuckerberg was not born with supernatural surveillance powers. The adversarial personalization is done by AI systems trained on customer data that small businesses send to Big Tech. Small business decision-makers are no more fans of Big Tech’s crimes than anyone else. But the Meta Pixel and other enabling technologies for Big Tech value extraction are easy to set up, and come with friendly tutorials and free credits to get started. Meanwhile, legit forms of advertising are often prohibitively complex, come with hard-to-afford minimum spending levels, or both.

you gotta FIGHT for your (private) RIGHT (of action)

An amended version of SB 690 made it out of committee. The new version would preserve CIPA private right of action for wiretapping and confidential recording, but remove private right of action for pen register and trap and trace. Bethany G. Lukitsch, Paul G. Karlsgodt, Andrew C. Burnquist and Safina Motiwala summarize the new version in Click, Track, Sue: California Reconsiders CIPA’s Reach.

And preserving the private right of action for the most heinous Big Tech surveillance would be a quiet win for small business. Lawsuits and lawyer letters are noisy and obvious, but the risks to small businesses of not having CIPA protection in place are larger and longer-lasting.

  • Big Tech must keep growing at startup-like rates even in an advertising business they already dominate—so must extract a larger and larger piece of each sale. (If the claims of Big Tech fans in academia were true, the rise of smartphones would have meant a small business boom. Instead, we have, well, all this.)

  • The surveillance data collected from small businesses ends up being used to train machine learning that works against customers, and when customers lose, the small businesses they buy from lose too. Money that is lost to Big Tech-enabled fraud, or gambled away on lootboxes and sportsbook apps, or just wasted on regrettable drop-shipped crap, is money that’s not available to be spent at legit businesses.

The immediate problem for small businesses in California now is how to keep marketing working while fixing the Big Tech value extraction.

Big Tech won’t make it easy. They are doing as much as possible to snarl up the process for setting up the marketing basics with the process for feeding data into all kinds of harmful schemes.

And, I hate to say it, but privacy people aren’t making it any easier, either. The conventional privacy nerd party line is something like, Big Tech companies are surveilling users for the benefit of advertisers when that can’t even make sense in a market economy. Legit businesses and their customers are on the same side. The whole point of a working market is win-win deals. Every beneficial purchase by a consumer is also a sale by some legitimate company.

For those who provide any kind of online service to small businesses in California, it’s time to figure out the roadmap to a common sense, research-driven approach to data practices. There’s an immediate to-do item for removing the most obvious, most heinous tracking, which is easy to justify because lawyer letters.There are LinkedIn thought leaders and even lawyers who will tell you the way to do this is to stick a Europe-style consent dialog on a site, and then do adtech/martech as usual as soon as the user clicks through. This is bad advice. I am not a lawyer and can’t give legal advice, but I can call out bullshit when I see it. More: common sense one, bullshit documents zero And yes, it is possible to do this while continuing to participate in society. But the real wins will come as service providers are able to protect small businesses from Big Tech’s tendency to force everyone into economic central planning and better enable a free market approach. History shows [citation needed] that societies with an empowered jury system have rewarding entrepreneurship.

Fun California fact: Until 1907, the state of California was not allowed to use banks or paper money, so the entire state budget was stored in the form of gold and silver in the Treasurer’s office on the first floor of the Capitol building.

More: Good morning, AdExchanger