dszd0g

If you read the text of SB690, it isn't just excluding IP addresses and session cookies which would be a valid change in the law in my opinion. https://legiscan.com/CA/text/SB690/id/3186917

Instead, it is allowing wiretapping for a "commercial business purpose", basically anything a company can do to make money like sell your private data to a data broker or the government.

Proponents argue that CIPA is not necessary because we have the California Consumer Privacy Act (CCPA) protecting us, but the CCPA is only opt out and you can't opt out of every company or surveillance you don't know about. The current CIPA is opt in where you have to consent to your communications being wiretapped, so SB690 would change the status quo from requiring companies to get your consent to record your communications to you having to opt out of every possible company.

https://www.eff.org/deeplinks/2025/06/californias-corporate-...

If you read Section 1798.140 of the Civil Code: “Commercial purposes” means to advance a person's commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction."

https://codes.findlaw.com/ca/civil-code/civ-sect-1798-140/

Basically SB690 means that a business can spy on us including our most private data and use it for anything that makes them money like selling it to data brokers or to the government.

I don't want them to go through my data for advertising purposes or to sell my personal data to advertisers (often called "partners" in privacy policies). I also don't want them to sell my personal information to foreign governments (like Facebook selling personal information on US tech users to Chinese tech companies).

I am fine with a privacy policy that has a section for using my data to provide the service (Service Providers section) and to share my data with companies that they use to provide services (as long as those companies must adhere to the same restrictions). As per your example of Twilio, that is fine as long as their contract with Twilio ("trusted business partners are subject to confidentiality agreements") states that Twilio won't sell my phone number to advertisers.