Section 230-related draft legislation from Senate Judiciary Committee Chairman Lindsey Graham, R-S.C., and Sen. Richard Blumenthal, D-Conn., (see 1912190079) threatens free expression and privacy, the Center for Democracy & Technology wrote Friday. It could prevent platforms from providing end-to-end encryption, and would “give the Attorney General significant and unaccountable power to regulate speech, control online services, and undermine our privacy and security,” CDT said. Section 230 of the Communications Decency Act shields platforms from liability for user content.

Attorney General Xavier Becerra (D) released revised draft rules to implement the California Consumer Privacy Act, based on suggestions in about 200 received comments. The AG office wants comments on revisions by Feb. 24, it said in a Friday notice. The AG expects to start enforcing the law July 1, though some are seeking delay (see 2001290040). The AG added guidance on what is personal information, saying it “depends on whether the business maintains information in a manner that ‘identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household.’ For example, if a business collects the IP addresses of visitors to its website but does not link the IP address to any particular consumer or household, and could not reasonably link the IP address with a particular consumer or household, then the IP address would not be ‘personal information.’” Service providers “shall not retain, use, or disclose personal information obtained in the course of providing services except” to perform services specified in the written contract with the business providing it, to retain and employ a subcontractor, for internal use to build or improve services and to detect data security incidents or combat fraudulent or illegal activity, the revised draft says. Another addition says a business may not require a consumer to pay a fee to verify requests for or to delete information. “For example, a business may not require a consumer to provide a notarized affidavit to verify their identity unless the business compensates the consumer for the cost of notarization.” A business may deny a request for specific personal information if it can’t verify the identity of the requestor, said another addition. “If the business has no reasonable method by which it can verify any consumer, the business shall explain why it has no reasonable verification method in its privacy policy.” Notices should be “reasonably” accessible to people with disabilities, said another clarification. The AG also adjusted definitions of some terms including household and added examples illustrating certain rules. "If there are no further changes, the Attorney General will finalize the text of the regulations and other documents in the rulemaking file," a Becerra spokesperson emailed. "The Office of Administrative Law will have 30 business days to review the regulations, and if OAL approves, the rules will go into effect."

Mobile as a share of total holiday e-commerce set a high at nearly 32 percent in 2019, Comscore reported Thursday. Mobile spending grew 23 percent from the 2018 holiday season. Overall holiday digital commerce was $133.7 billion, up 16 percent vs. 19 percent growth in the year-ago period. Beginning Nov. 1, 87 percent of days leading up to Christmas were “billion-dollar” spending days, said analyst Ian Essling. In-store pickup gained traction, with half of consumers surveyed preseason saying they were somewhat likely to use it.

Consumers “just don’t need traditional TV,” blogged Google TV Tuesday, announcing Google Fiber is no longer offering a linear TV product to new customers. Google is offering fuboTV through its internet service, giving subscribers a choice of two streaming services, including YouTube TV, announced in December. Google will continue to provide traditional TV service to existing customers in the 18 markets where it operates, it said. Pushing next-generation internet TV, Google said: “You no longer need pricey bundles that force you into paying for channels you’ll never watch.” Google Fiber will help all customers “explore other options” to get programming “the way TV is watched now.” Its internet service promises up to 1 Gbps for up to 20 devices. Some customers were cautious and skeptical about the change. Jeff Gordanier asked if he would be able to go back to Fiber TV service after a couple of months if he found he didn’t like streaming. The company replied that option won’t be available “at this time.” Robby Barnes suggested it would be a good time to start offering “higher resolution options” with YouTube TV. @Neurisko asked why he can't stream DVR'd programs to other devices in the house “besides my TV" which he called "a no-brainer.” Google Fiber said it would "submit feedback on your behalf with this feature suggestion."

Department of Homeland Security directives “strengthened federal cybersecurity, but improvements are needed,” GAO said Tuesday. One benefit was a 2015 critical vulnerability mitigation directive, which required agencies to address vulnerabilities discovered by DHS cyber scans within 30 days, GAO said. This resulted in 87 percent federal compliance by 2017. GAO recommended DHS coordinate with the National Institute of Standards and Technology and the General Services Administration on the directive development process. DHS agreed (see page 73) with GAO’s recommendations, saying its efforts have primarily been led by the agency’s Cybersecurity and Infrastructure Security Agency. During GAO’s review, DHS was in the process of updating its cybersecurity directives. DHS plans to complete revision of its directive development process by Sept. 30.

The Disney Plus streaming service, launched in November, had 26.5 million paid subscribers at the Dec. 29 close of fiscal Q1 and added 2.1 million more through Monday, said Disney CEO Bob Iger on a Tuesday earnings call. Disney intends to announce paid subs “as of the end of the quarter we’re reporting on,” he said. “Conversions from free to pay and churn rates were better than we expected,” said Iger. He said Disney won't disclose "specifics" on those metrics. The “next big priority” is launching Disney Plus internationally, he said. The service will debut March 24 in eight Western European markets, including the U.K., France, Germany, Spain and Italy, he said. Belgium, the Nordics and Portugal “will follow this summer,” he said. Disney Plus will launch March 29 in India through Disney’s existing Hotstar service, said Iger. “We see this as a great opportunity to use the proven platform of Hotstar to launch the new Disney Plus service in one of the most populous countries and one of the fast-growing economies.”

Noncommercial stakeholders are "waiting for a consultation regarding the sale of .ORG" (see 2001310015), wrote Milton Mueller, a founder of the Georgia Institute of Technology's Internet Governance Project. The professor said his Saturday post notified ICANN and its board of the pending request: "Such a consultation is not a courtesy to be offered at ICANN’s discretion, but is a requirement based on ICANN’s own Registry Agreement (RA) contract and its Registry Transition Process (RTP) policies." On Dec. 9, the Non-Commercial Stakeholders Group asked ICANN to consult "impacted registrants and the global non-commercial Internet community" on the Internet Society selling the Public Interest Registry to Ethos Capital. ICANN Chair Maarten Botterman's Jan. 7 response assured the stakeholders group that “ICANN org team and the Board are working together to evaluate the proposed acquisition to ensure that the registry remains secure, reliable, and stable.” Botterman didn't address the request for consultation, Mueller recalled. Mueller, at Georgia Tech's public policy school, has blogged (see 2001150013) that the sale need not be alarming; he didn't comment Monday. ICANN declined to comment.

ICANN seeks to extend to April 20 from Feb. 17 review of the Public Interest Registry's sale by the Internet Society to Ethos Capital, after the California Attorney General's Office sought the delay and asked for more information. ICANN previously extended by a month review of the deal said to be worth $1 billion-plus (see 2001210034). The AG office asked questions to "analyze the impact to the nonprofit community, including to ICANN," which as a California nonprofit is regulated by that office. ICANN asked PIR for the additional time "to conclude both the CA-AGO and ICANN reviews," the domain names overseer announced Thursday. "ICANN will continue to conduct thorough due diligence in its consideration of the proposed change of control and related conversion of PIR from a nonprofit to a for-profit. PIR is currently a Pennsylvania nonprofit corporation. As part of the proposed sale, PIR proposed to the Pennsylvania Attorney General that it be turned into a for-profit entity." A PIR spokesperson emailed that it got the letter, is reviewing it "and will work with ICANN to address the questions." Other parties to the deal involving .org domain name registrar PIR didn't comment Friday, and ICANN didn't answer questions.

Governments should quicken their pace to increase tech regulation, Microsoft President Brad Smith said during an interview with C-SPAN's The Communicators, to have been televised this weekend. A strong federal privacy law is vital, but a global solution is best, he said, noting Microsoft is “pretty enthusiastic” about EU’s general data protection regulation. “Digital technology has gone longer with less regulation than almost any technology since the middle of the 1800s,” he said. “The market, consumers and even the industry itself would be better served for the long term with a different balance.” He noted the importance of data centers and Ireland, which he said is to data what Switzerland is to money. Ireland is a safe place with mild temperatures for data centers and a network of laws for protecting privacy and moving data, he said, noting about 35 percent of European data is stored in Ireland. Microsoft has more than 100 data centers in 20 countries, he said. It’s becoming the largest consumer of electricity in the world, the executive said. The weaponization of data starts with hacking by political states waging disinformation campaigns, Smith said, noting Microsoft spends $1 billion yearly on security.

Apple emphasized privacy Thursday in the U.S. launch of redesigned Maps. The app is “deeply integrated” into apps customers use daily, said the company, and with the iPhone, iPad, Mac and Apple Watch. No sign-in is required and it’s not connected to an Apple ID, said the company. Personalized features, such as suggesting departure time to make the next appointment, use on-device intelligence, it said. Data collected are associated with random identifiers that continually reset. Through “fuzzing,” Maps obscures a user’s location on Apple servers. Flight and transit details are among many features.