Targeted Advertising in the Crosshairs: New Bill Seeks to Ban Many Forms of Targeted Advertising
Background
On Tuesday, Congressional Democrats unveiled a new bill to outlaw a wide swath of targeted advertising. The Banning Surveillance Advertising Act would prohibit ad tech companies from using consumers’ personal information to target ads, with limited exceptions. It also would prohibit advertisers from using third party data, or data about a person’s membership in a protected class, to target ads. The bill would authorize the FTC, state attorneys general, and private litigants to enforce the law, and the FTC to write rules implementing it.
The effort, led by Senator Cory Booker (D-NJ) and Congresswomen Anna Eshoo (D-CA) and Jan Schakowsky (D-IL), arrives at a time of unprecedented regulatory developments impacting the ad tech industry – most notably, the enactment of new state privacy laws in California, Virginia, and Colorado with provisions regulating the industry. While these privacy laws have focused on giving consumers the opportunity to make choices about data sharing for purposes of targeted advertising, the Banning Surveillance Advertising Act would place blanket prohibitions on such advertising. As we describe here, the FTC has also announced that it is developing a rule targeting “surveillance-based business models,” though the contours of that rule are still unknown.
In a press release, Senator Booker explained his view that “surveillance advertising is a predatory and invasive practice. The hoarding of people’s personal data not only abuses privacy, but also drives the spread of misinformation, domestic extremism, racial division, and violence.” Echoing Booker, Rep. Eshoo said that the practice “fuels disinformation, discrimination, voter suppression, privacy abuses, and so many other harms.” Rep. Schakowsky, who chairs the House Energy and Commerce Consumer Protection Subcommittee, said the practice “exacerbates manipulation, discrimination, misinformation, and extremism.”
Given the dramatic changes that the bill would impose on the marketplace, it is not surprising that industry groups have already criticized it forcefully. In a press release today, IAB stated that the bill would “disenfranchise businesses that advertise on the Internet, and hundreds of millions of Americans who use it every day to find exactly what they need, quickly,” and that it could “eliminate the commercial internet almost entirely.”
Contextual Ads Would Be Permitted
In a background brief, the legislators wrote that they recognize certain benefits of advertising online, but believe that advertisers do not need to use personal data to effectively target advertising. “Advertising enables many of the ‘free’ internet products that exist today, and it enables small businesses, nonprofits, and challenger politicians to cheaply reach customer, funders, and voters,” the legislators wrote. But, according to the brief, “targeted ads only yield a 4% bump in efficacy for advertisers over contextual ads” (i.e., ads based on the content of a website the consumer is viewing, as opposed to the consumer’s personal information or browsing history). As a result, the bill would allow contextual advertising.
Some First-Party Ads Would Be Permitted
As drafted, the bill focuses primarily on banning targeted advertising based on third party data rather than first party data. For example, brands would be able to target their own customers using first party data but not third party data. Brands also would be able to provide ad tech companies with first party data for targeted advertising (including for purposes of re-targeting), as long as the advertiser certifies to compliance with the proposed law. However, the bill would strictly prohibit any targeting by advertisers that is based on an individual’s membership in a protected class.
The bill also focuses on targeting consumers based on “personal information,” defined as data linked or reasonably linkable to an individual or a connected device. This definition appears to leave room for targeted advertising based on data that has been de-identified in some form.
Here’s a summary of what would be banned and permitted under the new legislation:
Summary of Conduct that Would Be Banned
- Ad tech companies could not build segments with third party data: This means they could not provide advertisers or third parties with personal information for purposes of targeting the dissemination of ads, including: (1) lists of individuals or devices; (2) contact information; (3) unique identifiers; and other personal information, such as browsing history.
- Advertisers could not target ads based on protected classes: Protected classes would include actual or perceived race, color, ethnicity, national origin, religion, sex, sexual orientation, gender identity, gender expression, familial status, or disabilities.
- Advertisers could not target ads based on third party data: Such data would include information from data brokers.
- Advertisers could not hire an ad tech company to target ads based on third party data: This means that ad tech companies could not (a) target ads based on third party data or (b) enable an advertiser or a third party to do so.
Summary of Conduct that Would Be Permitted
- Advertisers could target ads based on first party data: The bill does not restrict this practice, as long as the ads are not targeted to protected classes.
- Advertising could be targeted to a general location: The bill specifically exempts advertising based on an individual’s general location (i.e., state or municipality but not zip code).
- Contextual advertising: Ad tech companies could still facilitate dissemination of ads based on context or search terms. However, they would not be able to use information they collect from contextual advertising to target additional ads.
- Hiring an ad tech company to target ads based on first party data: This would be permitted, but only if the ad tech company provided written attestation to the advertiser that the ads were not targeted based on protected classes or third party data.
- Targeting advertising using non-personal information: As noted above, the bill likely leaves room for ad tech providers to develop ways to target advertising without using personal information that identifies or can identify an individual or device. If enacted, the legislation could accelerate efforts by some companies to develop ad targeting without use of personal information, using privacy enhancing technologies like targeting based on cohorts or secure multiparty computation.
* * *
The prospects for Congress actually enacting this bill (or a similar one) are not at all clear at this time. However, the bill is yet another sign that digital advertising is under scrutiny, and that policymakers are pushing companies to provide greater transparency and more robust privacy protections for the collection, use, and sharing of consumers’ personal data for advertising purposes.
We will continue to track data privacy bills as they make their way through the legislative process and post updates here.
Privacy Priorities for 2022: Legal and Tech Developments to Track and Tackle Wednesday, January 26 at 4:00pm ET/ 1:00pm PT
Privacy compliance is a daunting task, particularly when the legal and tech landscape keeps shifting. Many companies are still updating their privacy compliance programs to address CCPA requirements, FTC warnings on avoiding dark patterns and unauthorized data sharing, and tech platform disclosure, consent, and data sharing changes. But in the not too distant future, new privacy laws in California, Colorado, and Virginia also will go into effect. Addressing these expanded obligations requires budget, prioritizing action items, and keeping up to date on privacy technology innovations that can help make some tasks more scalable.
This joint webinar with Kelley Drye’s Privacy Team and Ketch, a data control and programmatic privacy platform, will highlight key legal and self-regulatory developments to monitor, along with practical considerations for how to tackle these changes over the course of the year. This will be the first in a series of practical privacy webinars by Kelley Drye to help you keep up with key developments, ask questions, and suggest topics that you would like to see covered in greater depth.