United States: Ad Industry Gears Up For Data Privacy Ragnarök

Privacy for America adds industry voices to brewing debate

Winter Is Coming

The California Consumer Privacy Act (CCPA) of 2018 continues to create waves in the data privacy debate and threatens to disrupt the complicated third-party digital marketing ecosystem. State governments and federal legislatures and regulators, alongside business and advertising associations, are heading toward a showdown over how data privacy and ownership are governed in the future.

It's like the final season of Game of Thrones: Who's gonna side with whom?

The nationwide debate was stirred up by the efforts of foreign governments, and other states were making noise too. But California, the 800-pound-gorilla of the U.S. economy, set the tone with one of the toughest, most expansive privacy rights regimes, which then-Governor Jerry Brown signed into law as the CCPA last July. So it was understandable that the federal government, via the Federal Trade Commission (FTC), decided to chime in – as a possible veiled warning about which power was going to have the final say on the issue. The problem? The CCPA was a rushed legislative compromise between proponents of an ill-conceived ballot initiative and industry; it avoided some of the worst elements of the initiative (e.g., a broad private right of action), but was not carefully crafted to balance legitimate and socially useful data collection and use – such as for the digital advertising that supports free content for consumers – and consumers' interest in protecting misuse of their personal information. As a result, how CCPA consumer rights will be administered among publishers, advertisers and the many intermediaries between them remains to be seen.

The Whole Mishpocha

And now ad industry organizations are putting forward a solution. Meet Privacy for America (PFA), an advocacy coalition whose leading lights include the American Association of Advertising Agencies, the Association of National Advertisers (ANA), the Interactive Advertising Bureau (IAB) and the Network Advertising Initiative (NAI). Jessica Rich, former director of the FTC's Bureau of Consumer Protection, is a noted grand eminence.

PFA's mission: to outline a "bold new paradigm for a national law that would make personal data less vulnerable to breach or misuse and set forth clear, enforceable and nationwide consumer privacy protections for the first time," while avoiding upsetting the digital advertising apple cart that supplies the revenues to support free-to-consumer content.

Specific advocacy issues include restrictions on using personal data to deny employment or healthcare, ending indiscriminate sharing of data with unaccountable third parties, banning the use of "certain types of data" (i.e., sensitive, but not all, data) in advertising, and building strong security protections. The group also calls for the birth of a new FTC Data Protection Bureau "to enhance the FTC's longstanding expertise in overseeing privacy matters."

The Takeaway

But are there any real specifics we can take away from the coalition's kickoff announcement?

The answer is no – there's very little concrete information about how PFA recommends addressing these issues. But if you look closely, there are a few clues.

First, this quote from Bob Liodice, CEO of ANA: "Americans must not be forced to choose between protecting their privacy and enjoying the many benefits they have all come to expect from the advertising-supported Internet, mobile and other media." It seems likely that the organization will advocate something less than consumer opt-outs of the commercial sharing of their nonsensitive data – an approach favored by some privacy activists.

And there's mention of a poll PFA commissioned, which claims that "63 percent of registered voters believed letting the federal government pass a national data privacy law would be the most effective approach to protect consumer data, compared to only 17 percent of registered voters who believed letting individual states pass their own data privacy laws would be most effective."

Once again, it would seem, state legislatures are being put on notice. However, it will be interesting to see whether any additional amendments are made to the CCPA to account for these national coalition movements and desire to maintain some industry control over use of nonsensitive consumer data. And the California attorney general could essentially maintain the status quo of the current Digital Advertising Alliance (DAA) and NAI self-regulatory opt-out programs for interest-based advertising if his office follows the regulatory recommendations made by the NAI, DAA and IAB. As the CCPA continues to evolve through amendments and is further analyzed once the California AG provides regulations at the end of the summer of 2019, industry groups across the country and state legislatures will need to stay apprised of the shifts in this consumer data privacy law and the potential repercussions nationally, especially as they relate to digital advertising.

In the meantime, for tips on how to start to prepare for CCPA and the next generation of U.S. privacy laws that it is inspiring, see our U.S. Privacy Compliance Resource Center and our CCPA FAQs.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.