For many years, the US advertising industry has been watching to see if a Federal piece of privacy legislation will be enacted.
Finally, that step appears to be closer with the first draft of the American Privacy Rights Act being release for discussion. The draft proposal would limit the data that companies can collect, retain, and use. The proposed American Privacy Rights Act, or APRA, would also enable Americans to opt out of targeted advertising and view, correct, export, or delete their data and stop its sale or transfer. It would create a national registry of the data brokers that buy and sell personal information, and would require those companies to let people opt out of having their data collected and sold.
Some analysts and commentators have noted that the proposal has many elements of GDPR legislation that was enacted in Europe in 2018. APRA would overrule state legislation in the US, except for civil rights and consumer protection state laws. Legislators have worked on the bill since 2019, and it represents a fresh opportunity to enact a federal privacy law, since a preceding proposal, the American Data Privacy Act, fizzled out in 2022. A major sticking point to that bill, the private right to action, met still opposition from lawmakers, who objected to the potential for individuals to sue corporations for violations.
This time around, there appears to be more momentum around this proposal, given both sides of the House have worked on it, and amid an atmosphere of deeper concerns about the digital power of Big Tech.
Taking on the Big Tech giants
The statement from the chairs of the House Committee’s presenting the bills noted that the bill establishes a “Foundational Uniform National Data Privacy Rights for Americans”, and prevents large technology platforms from misusing their personal data. “This landmark legislation gives Americans the right to control where their information goes and who can sell it. It reins-in Big Tech by prohibiting them from tracking, predicting, and manipulating people’s behaviors for profit without their knowledge and consent,” the chairs noted in their April 7 announcement.
The bill’s major objectives are outlined here:
1. It would establish national consumer data privacy rights and set standards for data security. The bill also would require covered entities to be transparent about how they use consumer data and give consumers the right to access, correct, delete, and export their data, as well as opt out of targeted advertising and data transfers.
2. The measure would set standards for data minimization that would allow companies to collect and use data only for necessary and limited purposes and prohibit the transfer of sensitive covered data to third parties without the consumer’s affirmative express consent.
3. The Act would prohibit the use of covered data to discriminate against consumers and provide consumers with the right to opt of the use of algorithms for consequential decisions.
In terms of advertising to consumers and opt-in/opt-out rights, under the provisions of the bill, a consumer will have the right to opt out of the transfer of non-sensitive covered data, and the right to opt out of the use of their personal information for targeted advertising. As global legal firm Akin notes, the proposed bill “established several user rights, including rights to access, correction, deletion, and portability, as well as the right to opt out of targeted advertising and data transfers.” Further, the bill would prohibit the transfer of sensitive covered data to third parties without the consumer’s affirmative express consent.
Covered data means data that is created by the derivation of information, data, assumptions, correlations, inferences, predictions, or conclusions from facts, evidence, or another source of information or data about an individual or and individual’s device. This provision could hamper the efforts of players in the advertising data supply chain in terms of their ability to inject certain datasets into a targeting pool. No doubt chief privacy officers at agencies and large brands are doing deep investigations into the proposal.
Should the bill pass, the Federal Trade Commission is directed to establish – in the first year of the bill’s enactment – a new bureau comparable to the Bureaus of Consumer Protection and Competition to carry out its authority under the Act.
Will the digital advertising industry have to change?
So should the digital advertising industry be concerned about APRA, and will it upend their business model?
Here is how industry publication Digiday summed up the proposal: “It would shake things up in advertising by forcing companies to scale down the amount of data they collect on people while also empowering them to manage, correct, and even export their own data. That control would also give them the power to say “no” to targeted ads and the transfer of their own data. Plus, they’d have the option to opt out of algorithms influencing major life decisions for them, like where they live or who they’re able to work for.”
The publication added: “And of course, there’s a big focus on beefing up security measure to keep everyone’s info safe and sound. Oh and don’t forget about dark patterns; companies would be barred from using these tactics to sway users away from exercising their newfound rights on privacy settings.”
Another industry publication, The Drum, noted that if enacted, the legislation would have significant impacts on the digital advertising ecosystem. “Beyond enabling users to opt out of targeted advertising, APRA also requires affirmative, express consent to transfer personal data to third parties,” the publication said. However, experts quoted in The Drum article noted that the adtech industry could pursue legal work-arounds, especially as they relate to the definition of a data broker, and the ability to use de-identified data.
Furthermore, under the clauses spelled out in the APRA proposal, the term ‘‘targeted advertising’’ is defined as displaying or presenting to an individual or device identified by a unique persistent identifier, an online advertisement that is selected based on known or predicted preferences or interests associated with the individual or device identified by a unique identifier.
It does not include advertising or marketing content to an individual in response to the individual’s specific request for information or feedback; or first-party advertising based on an individual’s visit to or use of a website, or an online service that offers a product or service that is related to the subject of the advertisement; or contextual advertising when an advertisement is displayed online based on the content of the webpage or online service on which the advertisement appears.
This could be interpreted as being positive for the digital advertising industry, as there will be plenty of avenues remaining to execute consent-based campaigns across the web and apps. There is no firm date for the proposal to be presented as a bill, as it will be passed around other lawmakers for feedback.
Whatever the fate of APRA, the momentum is leaning towards firmer privacy rules, encompassing web browsing data and ad targeting, data broking and protection, and consumer rights.
