Once again, California is a battleground for privacy advocates and Internet companies as they battle over “big data” collected from consumers.

California Assembly bill AB 1291, also known as the “Right to Know Act of 2013,” is supported by the Electronic Frontier Foundation and American Civil Liberties Union, among others. It would make that state the first in the nation to give consumers the right to demand from companies reports on what data is collected from them, how it is shared, and with whom. A similar requirement, often referred to as Habeus Data, is currently in place among member states of the European Union.

The text of the bill cites as an impetus that some Web sites install up to 100 tracking tools to collect personal information, later sharing and selling it to third-party advertising and marketing companies. Third-party data broker companies, in turn, buy, sell, and trade personal information mined from mobile phones, financial institutions, social media sites, and other online and brick and mortar companies.

The legislation would repeal and replace language in the state's current civil code so that a business that discloses such information to a third party would be required to make available to the customer, free of charge, a report of what was shared and the names and contact information of all third parties that received it.If passed, businesses with an online privacy policy must include a description of a customer's rights and outline request procedures.

A business would not be obligated to respond to a request by the same customer more than once within a 12-month period. It can also bypass the requirements if consumers are proactively notified before, or at the time, that information is shared.

Types of data that would fall under disclosure requirements: real name; alias; user name; address; telephone number; Social Security number or other government-issued identification number; age; physical characteristics, including but not limited to, height and weight; sexual information, including sexual orientation, sex, gender status, and gender identity;  race or ethnicity; religious and political affiliations; employment and education; medical and financial information;  and any text, photographs, audio or video recordings, or other material generated or provided by the customer. All of these categories also apply to children of the customer.

The new rules do not apply to the disclosure of personal information to a third party as part of a written contract authorizing it to perform services on behalf of the business, such as maintaining or servicing accounts, providing customer service, or processing orders and payments. Also exempt is the disclosure of personal information deemed “reasonably necessary” to address fraud, security, or technical issues. Companies can also bypass the requirements by anonymizing  user data before disclosing it.

Tech companies and social media services, many of whom have business models that are dependent on brokering user data, are vociferously fighting the new law. In a statement supporting the proposed law, the ACLU noted that Facebook apps used by a consumer's “friend” can easily access sensitive information about them, including religious, political, and sexual preferences. Retailers have also sparked controversies over their use of personal information.  Target garnered headlines when its data-mining detective work broke the news of a pregnant teenager to her parents via targeted coupons for prenatal items.

Tech sector companies have added incentive to derail the California law because the state tends to be a trendsetter for such issues. For example, the California Online Privacy Protection Act, a requirement that websites and apps include a privacy policy, has gained traction coast-to-coast.

Tech industry trade groups – among them TechAmerica, the Internet Alliance, and TechNet – have detailed their objections in a letter to Bonnie Lowenthal, the California assemblywoman who drafted the bill.

“[The legislation] would require any business that runs a computer server and receives this information to do expensive and unworkable things without any ability to defray the costs of this mandate,” they wrote, describing mandates as “overly broad” and “unworkable.”

 “It is a recipe for abuse and costly lawsuits that may benefit the trial bar, but harm businesses operating in California,” they wrote.