The junior Senator from Missouri, Joshua Hawley (R), has introduced s 1578, which would require the Federal Trade Commission (FTC) to create and make available a “do not track” (DNT) signal that consumers can associate with their devices and require that online services look for the signal and, when indicated, not collect, use or share data beyond what is necessary to operate the service, and specifically not for Interest-based Advertising (IBA), and, further, require third-party operators, including advertisers and adtech companies, not collect any data other than for the purpose of analyzing how or whether the user engaged with the operator’s program, and then only in a de-identified manner and without creating or contributing to a user profile. The proposed law would prohibit publishers from denying service to users that enable a DNT signal or provide them with a different level of service. That would ban charging a subscription fee for IBA-free access to make up for lost ad revenue (IBA commands higher prices than contextual or run of site ads), something that the California Consumer Privacy Protection Act (CCPA) does not prohibit. The FTC, and state AGs, would be able to enforce the law and it gives the FTC authority to seek civil penalties of $50 per affected user for negligent violations and $1000 per user, and a minimum fine of $100,000, for reckless or willful violations. There is no private right of action proposed and the bill does not preempt CCPA or other state law. This may be an attempt to influence the federal privacy legislation being drafted by Congressional leadership in both chambers. A coalition of advertising industry associations (https://www.privacyforamerica.com/about/) is working with the applicable committees in the House and Senate to develop a paradigm that is based on preventing harm and prohibiting certain data practices that are overly intrusive or have a potential to cause harm to consumers, and would specifically not limit transfers of data for advertising purposes, including tracking and targeting, so long as sensitive data is not used and the use does not include making determinations on eligibility (e.g., credit, housing, employment). Regardless of what may come out of the nation’s capital, the more immediate issue for advertisers and publishers is preparing to implement to do not sell right under the CCPA, effective January 1, 2020, and being able to provide the required notices and honor the access, copy and deletion of information rights. We have previously published more detailed information on what is required under that law available on our U.S. Consumer Privacy Resource Center. And, as we have reported, other states are considering CCPA-like legislation. NV, IL and NJ seem the most likely to pass CCPA-inspired legislation this year. The proposals in WA and TX died. Still under consideration are bills in AZ, HI, MD, MA (has a private right of action), MS, NM, NY, ND, OR, RI, and VA. We will continue to update you on legislative challenges to digital advertising.
Read more on BakerHostetler’s Data Privacy Monitor >>