Ad Industry's Efforts to Influence Congress on Data Privacy Laws Met With Deep Skepticism

Private data and its relationship to the ad revenue that drives some of the world's largest businesses are among the day's most contentious topics. In the midst of controversies surrounding the collection, leveraging and sale of consumer data to advertisers by Facebook, Google and other platforms, can the ad industry itself be trusted to help Congress devise legal solutions for American consumers? For many observers and analysts, the answer is no. [kickout id="1"] On April 8, trade groups including The Association of National Advertisers (ANA), American Association of Advertising Agencies (4A’s), National Advertising Initiative (NAI) and the Interactive Advertising Bureau (IAB) announced a new coalition called Privacy for America. They have already begun lobbying lawmakers as Congress considers whether to write federal data legislation that would supersede the GDPR-style California Consumer Privacy Act, which will become law in 2020. "We realized that a 50-state policy patchwork was going to cause major disruption in the online experiences of everyone in this country," said Dave Grimaldi, evp of public policy at IAB, whose group sat in on meetings of the California State House as it debated the CCPA. "There is absolutely bipartisan support for a national standard federal bill," he added, with Democrats concerned about the sort of "eligibility gaming" that led the U.S. Department of Housing and Urban Development (HUD) to charge Facebook with discrimination last month. Meanwhile, Republicans are focused on the effects GDPR and CCPA could have on "the mom and pop company that survives because of online advertising." Grimaldi also argued that the California bill does not represent the true will of the public, describing it as a "privately-written initiative." California State Assemblyman Ed Chau and Senator Robert Hertzberg, both Democrats who represent Los Angeles County, were the main authors of CCPA. A law that could "affect the entire country" should have more input from academia and industries including, but not limited to, advertising, Grimaldi said. Accordingly, the members of Privacy for America have been working on straw legislation for several months. Facebook CEO Mark Zuckerberg wrote that "the internet needs new rules" in a recent Washington Post op-ed, and the groups behind this effort similarly say they are ready to participate in the process of drawing up those rules. CEO of 4A's, Marla Kaplowitz, argued that self-regulation has largely been effective in determining responsible advertising practices in relation to data usage but that government regulation would now ensure the proper oversight and accountability. Key suggestions in the group's mission statement include creating a new FTC division to oversee data privacy and strengthen its regulatory powers, prohibiting discriminatory practices like those Facebook stands accused of, restricting certain unspecified types of data from being used to target ads and requiring laws to protect against data breaches. Missing from the proposal is a consumer opt-in/opt-out requirement, a key element of both GDPR and CCPA that would either call for consumer consent before data collection begins or allow all parties to turn that option off before using a given site or platform. CCPA specifically allows consumers to opt out of the sale of their personal data but not its distribution, and in February, State Assemblywoman Buffy Wicks, D-Calif., introduced a new amendment to the bill called Privacy for All, which would do exactly that. "This is a maturation story. This is a story of an industry maturing to a point where it becomes too complex for the simple solutions that worked in the beginning," said Dick O'Brien, evp, government relations at 4A's. “We need the government to work with us to put together the rules that will result in the responsible use of data.” Those outside the ad industry, however, are less receptive. A lingering issue of trust "Unfortunately, the bodies that have come together to form Privacy for America are the very institutions who have failed to listen to consumer voices in the past and instead came up with self-regulatory schemes that have no teeth," said Forrester vp, principal analyst Fatemeh Khatibloo. "Remember, the ad-tech coalition decided not to honor the Do Not Track browser headers, which, had they come up with a standard ... eight years ago, would have left the whole industry in a much better position today." Some had even harsher words for the initiative. [kickout id="2"] Jeff Chester, executive director at consumer protection agency Center for Digital Democracy, called it "a desperate maneuver to defend the ad lobby’s Big Data surveillance practices, using a former FTC official and consumer advocate in an attempt to gain some legitimacy." The official in question is Jessica Rich, former director of the FTC's Consumer Protection Bureau. Khatibloo said she "has a lot of credibility in the privacy industry" but remains skeptical that the new organization can develop "a proposal that truly balances consumer rights and business opportunities." Chester added, "Just like with Facebook, it’s way too late for IAB and others to finally get privacy 'religion' and promise they will do better. Everything IAB and its members do every day flies in the face of their claims [that] they now want to protect consumer data." According to Grimaldi, the group does want to give consumers more power over the ads they're served and let them "have control over the data that is collected" while minimizing "turnstile jumping," a practice whereby consumers can opt out but still access content without paying the effective price of admission. If that were to become more common, he said, an untold number of businesses would be unable to afford their own expenses and therefore "go dark." Putting this another way, he said recent surveys show that Americans value the online experience that they get for free each year thanks to advertising at approximately $2,000. "Those who would pay? Less than 15%," he added. With "fear and creepiness around data at an all-time high," Grimaldi said, the ad industry needs to better explain why such services are necessary while also establishing new rules of the road. He acknowledges that the act of helping Congress write those rules will take some time, stating, "Now the hard work begins." What will the new rules look like? "They are trying to dilute the California law and being rather matter-of-fact about it," said one industry observer and privacy advocate who spoke to Adweek on condition of anonymity. While agreeing that a 50-state patchwork approach would not work, this individual disputed the idea that publishers and content producers would be unable to maintain their businesses without that critical data flow from consumers as "false." To that point, the California Assembly Privacy and Consumer Protection Committee recently removed a key provision from the Privacy for All amendment that would have allowed private individuals to sue for any violation of the CCPA. [kickout id="3"] This person said Privacy for America incorrectly conflates advertising and the revenue it creates, which is extremely important, with "behaviorally targeted ads that track you across the web." Facebook, he added, makes the same all-or-nothing argument. Another source who oversees data privacy issues for a major ad agency told Adweek that the issue "probably should have been addressed much earlier, but that has always been one of the arguments for self-regulation: that it allows for flexibility faster than the law." "The new paradigm talks a lot about responsible data use and stronger enforcement, and this is a start," the second anonymous source added. "Responsible data use can be very subjective, however, as we have seen." This individual also said industry concerns that a transparent opt-in or opt-out approach would lead to a sharp decrease in the amount of data advertisers can collect is "an irrational anxiety." GDPR has not led to "a decimation of databases or data sets," the person added. "Online advertising is not out of business." "If a user does not want you to have their data, they may not be a good prospect or receptive to your advertising messaging," the second source said. And many consumers would be less resistant if the ad industry could do a better job explaining why that data is so important, illustrating the choices its audience still has and offering a clearer delineation between what is and isn't socially acceptable in matters of privacy protection. However, some optimism remains. “Advertisers recognize that the status quo of data use in advertising is not working properly," said Johnny Ryan, chief policy and industry relations officer at privacy browser company Brave Software. "They are deeply unhappy with the fee opacity and arbitrage, ad-tech tax, fraud and inefficiency in the digital advertising market industry. I hope that the ANA seizes on higher privacy standards as an opportunity to clean up the market.” At the same time, Ryan's company recently joined more than 20 other privacy-oriented brands in signing a letter of support for the proposed amendment to CCPA. Notably absent from the list were any of the companies at the center of the privacy debate. Chester remained dismissive, calling the entire lobbying project "a PR effort that will not derail the historic push for strong privacy legislation being supported by consumer, civil rights and other groups." "Here's what's missing," said Khatibloo. "Acknowledging that privacy is a fundamental right and that consumers should have the right to know what has been collected, the right to opt-out of some data collection (even if it means less personalization and relevance—some people really prefer that) and the right to data deletion." Two things are clear: Americans are concerned (and, arguably, under-informed) about matters of privacy protection and they do not trust the ad industry to serve as its own gatekeeper. Spokespeople for Facebook, Google and Amazon, all of which are represented by the groups in Privacy for America, did not respond to requests for comment on this story. A Twitter representative declined to comment. The ANA declined to comment and the NAI could not be reached for comment.