What State-by-State Data Privacy Laws Mean for the Future of Programmatic

Major players need to support legislation on a federal level

illustration of a map of the United States with locks and arrows
California is just one of a number of U.S. states considering legislation. Getty Images
Headshot of Brittany Hodak

With Europe’s GDPR implemented and California’s CCPA waiting in the wings, third-party data is starting to look like fossil fuel: widely seen as dirty, but also widely used and lobbied for—for now.

California may be the U.S. market’s big kahuna, but it’s just one of multiple U.S. states considering legislation that would pressure ad exchanges and publishers to use consumer-provided data for programmatic advertising. Unlike GDPR, CCPA doesn’t require programmatic players to have a “legal basis” for processing consumer data. But it will make selling third-party data more difficult, and legislative history shows it’s likely just the start.

As California goes…

CCPA may not be an emissions law, but the origin of and conversation around it parallel one passed by California in 1961. Before the United States passed the Clean Air Act in 1963, California had already implemented a rule requiring new vehicles be equipped with tailpipe emissions controls.

It was a small step intended to solve a state-specific problem when the Los Angeles basin was bathed in exhaust smog. But once the largest state passed such a law, other states started to consider legislation tailored to their own needs. In part due to industry worries about compliance with patchwork laws, the federal government was forced to step in.

If programmatic stakeholders continue to take a hard line, they won’t like the result.

That same dynamic is driving the data privacy conversation. Although advertisers and exchanges that benefit from the status quo have been some of CCPA’s loudest opponents, those that see the damaging effects of dirty data feel differently.

Poor data stewardship is hardly limited to California, but it’s a thorny issue for Silicon Valley’s home state. Just as legislation banning cars in Los Angeles would’ve jeopardized the city’s boom, CCPA could have destroyed the state’s tech sector, had it outright banned the collection of consumer data.

In both cases, California took a “light touch” approach. Also, in both cases, it set in motion a push for national standards. This time, industry stakeholders should help shape them.

…The nation follows 

Nationwide legislation might sound like the last thing programmatic partners would want, but government and industry groups both see it in the cards. And if they’re right, advertisers and publishers have a chance to make programmatic advertising more effective for everyone.

The Government Accountability Office, a key U.S. government watchdog, came out in February for federal data privacy legislation. In April, the Association of National Advertisers echoed the GAO’s call for nationwide standards.

If programmatic stakeholders fight national legislation, distinct (or even conflicting) state laws will make it more difficult for them to do business across the country. If they step in, they’re likely to win a middle-ground approach that protects business interests while promoting better user experiences.

What might that middle ground look like? Take enforcement provisions. New York’s data fiduciary proposal would allow citizens to sue companies directly when they believe those companies haven’t managed their data according to the consumer’s best interest. But even antitrust scholars, who typically take the consumer’s side, say the proposal goes too far.

Not only would such provisions minimize the burden on the court system, but they’d likely be enough to bring about the change advertisers themselves want to see. GDPR’s user consent provisions alone have led some programmatic stakeholders, including major ones like Adobe and Roku, to adopt a first-party approach. Although regulators and business leaders have dragged their feet, 92% of marketers realized back in 2017 that first-party data would be key to their companies’ growth.

The way to get there—at least with the economy intact—isn’t through draconian, state-by-state laws like New York’s. It’s through compromise proposals, such as the CCPA’s mandate that companies add a “Do not sell my personal information” link to their site.

Compromise is key

Largely because a federal compromise couldn’t be reached, California maintains stricter auto emissions standards to this day than other states. As a result, manufacturers have to fit every car sold in California with specialized hardware and software. Because single-state customizations are expensive, many automakers now sell California-approved cars nationwide.

If programmatic stakeholders continue to take a hard line, they won’t like the result. Either patchwork laws lead to inconsistent user experiences and steep compliance costs or the strictest state laws become de facto federal standards.

If they join in, they put the industry on a path toward ads supported by user data. Ads that are relevant to their users deliver a better user experience, which in turn improves advertisers’ return on investment. Greater ROI means more business for programmatic exchanges. More ad dollars spent with programmatic exchanges means more revenue for niche publishers.

Today, marketers, publishers and ad-tech leaders have a choice to make: Do they keep burning third-party data until the bitter end, or do they push for a framework that—despite its temporary pain—will ultimately benefit everyone?

@BrittanyHodak Brittany Hodak is co-founder of The Superfan Company.