What Advertisers Need to Know About the Federal Privacy Law

U.S. lawmakers and stakeholders are discussing the finer details of a proposed federal privacy law showing there is momentum on a long-promised effort to give people more control over their personal information. “Nearly every week, there's a new story about location data being packaged and sold,” said Caitriona Fitzgerald, deputy director, Electronic Privacy Information Center during Tuesday's review of the bill by the House Committee on Energy & Commerce. For decades, tech companies have tracked people online and sold their data to marketers, sometimes without their consent. While companies have continued to innovate, Congress has struggled to keep pace. While there’s scope for discussion on what the bill should contain, specific provisions, like hiring privacy officers and giving people the right to file class-action lawsuits, are going to leave the tech industry with considerable increases in compliance costs. The bill called the American Data Privacy and Protection Act (ADPPA), is slated to go into effect 180 days or six months after passing. There is less likelihood for the bill to pass before November's midterm elections, however, Congress is currently collecting feedback on this bill. GroupM Forecasts Ad Spend Growth, Though Less Than Last Year’s, Despite Economic Conditions Here are some of the key details in the bill for marketers to be aware of: People can file a private right of action The ADPPA gives Americans the right over their privacy, including the right to sue tech companies that violate it. This comes as a blow to the tech industry that has long fought such provisions in state-wide privacy laws. However, this doesn’t go into effect until four years after the law is passed. There’s a good chance that “lobbyists are going to try and water down parts,” said Stephanie Liu, privacy and marketing analyst at Forrester. Nonetheless, the ad industry can expect an increase in the cost of compliance with this rule. “This Act will have a burdensome effect on small businesses, given the costs that will be required for compliance, especially with the private right of action,” said Sundeep Kapur, senior associate at Orrick, Herrington & Sutcliffe’s DATA Practice. People can opt-out of targeted ads The bill gives people the right to control their data and opt-out of targeted advertising, preventing their data from being sold without their permission. But this comes with a caveat for the ad industry, especially for companies that operate on the open web through real-time bidding transactions, where the bill will govern the sending of bid requests to demand-side platforms to secure the bid. Sensitive data, including information identifying a person’s online activities over time or across third-party websites, will also require opt-in consent. However, whether advertisers need opt-in consent to create segments for targeted ads is something the bill does not specify. This gives the Federal Trade Commission (FTC) scope to take broad interpretations, which could end up in more lawsuits. Data, such as geolocation, is also subject to opt-in consent. Given how opt-in consent needs to be distinguishable from other notices, there’s a concern of “serious consent pop-up fatigue,” said Kapur. Companies to adopt privacy by design framework Under the ADPPA, businesses are mandated to implement a privacy by design framework that entails “reasonable” practices and procedures for collecting, processing and transferring data, something that lacks in the statewide privacy laws. What these “reasonable” practices look like will be assigned by the FTC who will issue guidance on policies, practices and procedures within one year of enactment of the law. But some data practices can prove to be more cumbersome than others. For instance, per the bill, every time a publisher, advertiser or an ad-tech intermediary sends data to a third party, they are tasked with naming all of these entities. For example, a publisher who uses an ad tech intermediary to monetize its inventory may need to name all the third-party recipients who have a pixel within a particular impression. “This [can get] really difficult for many technical reasons,” said Kapur. Firms need to designate data privacy officers The ADPPA includes corporate accountability mechanisms, which are not found in state laws, such as the requirement to designate privacy and data security officers, which agencies are starting to lean into, as well as executive certifications of compliance. This requires the CEO of a large data holder, with annual revenue of $250 million or more and processing data of more than 5 million people or devices, to make an annual certification to the FTC that they have reasonable internal controls to comply with the bill. They need to show they have the reporting structures in place to make sure those certifying officers are involved in, and responsible for, the decisions related to their company’s compliance with the bill. Walled gardens enjoy more power Small businesses and nonprofits are not exempted from this bill. But businesses that do not have more than $41 million in annual revenue can enjoy certain exemptions, like having to export data in a machine-readable format or designating privacy officers. Moreover, the targeted advertising section of the bill favors walled gardens, including social media networks and ecommerce companies such as Amazon, notes Kapur. For example, if a person visits Amazon and searches for a pair of sneakers, Amazon can retarget the person for those sneakers. “The law expressly makes it clear that this type of advertising is allowed,” Kapur told Adweek, giving them the continued power to dominate the ad market. This article has been updated to reflect that, under the bill, a publisher may need to name all the third-party recipients who have a pixel within a particular impression.

Data

What Advertisers Need to Know About the Federal Privacy Law

The bill gives explicit power to people to sue tech companies, among other rules

Trishla Ostwal

About

Subscriptions

Events

Publications

WORK SMARTER - LEARN, GROW AND BE INSPIRED.

Subscribe today!

Trishla Ostwal