Marketing Brew informs marketing pros of the latest on brand strategy, social media, and ad tech via our weekday newsletter, virtual events, marketing conferences, and digital guides.

Marketing Brew

Ryan Barwick

marketingbrew.com

a phone saying "Click here" with a gavel over it

Why the IAB’s CEO is “in a bazooka fight” with privacy activists, regulators, and Apple

“The use of hyperbole and the use of exaggeration is at my discretion,” he told us.

Where privacy regulation stands ahead of 2023

 California, Virginia, Connecticut, Colorado, and Utah are all getting new privacy laws next year.

How CMOs are thinking about new privacy restrictions

“If you’re the CMO, you have to have a very good, functioning knowledge of privacy laws and what’s happening,” a marketing exec told us. 

Digital security padlock in a digital space

Data privacy

Data brokers are going to California with an aching in their hearts.

The state, the first to adopt a comprehensive consumer privacy law that is often considered a harbinger of privacy legislation to come, is considering 

 that could further regulate the data broker industry.

The bill, called the Delete Act, is headed to a full vote later this month.

While California’s existing privacy laws allow citizens to ask brokers to delete their data, the Delete Act would streamline the process, creating what’s described in the bill as an “accessible deletion mechanism” that would essentially require all data brokers to “empty trash” on an individual, if they ask. In other words, it would give residents a one-stop shop for these requests, as opposed to asking each data broker individually.

 of data brokers, which lists at least 500. Additionally, after a data broker processes a consumer’s deletion request, the bill would require it to delete “all personal information of the consumer” at least once every 45 days. If passed, it would go into effect in 2026.

Earlier this year, Planned Parenthood and the Electronic Frontier Foundation voiced support for the bill, with the latter describing the current process for requesting data deletion as something that “can become time-consuming and tedious.”

“We really need to be thinking about the risks to all of us of having this information floating out there and thinking of ways to get people control back over that information,” California State Senator Josh Becker, author of the Delete Act, told 

Unsurprisingly, some in the ad-tech industry don’t seem to be in love with the bill. The Consumer Data Industry Association, a trade association that doesn’t appear to publicly list its members, created a website that encourages Californians to oppose the bill. “SB 362 would cause tremendous damage across California’s data-driven economy by using a blunt-force approach on this complicated and vital system,” the website reads.

 that IPG was “pulling out all the stops” to prevent the bill from passing, according to internal emails between agency execs that were obtained by the outlet. IPG owns the data broker Acxiom.

pieces of paper going into a yellow trash can

California bill would crack down on data brokers

The Delete Act, which is up for a vote later this month, would make it easier for residents to request that data brokers delete their personal info.

Jasmine Sheena

When Caden investor Jerry Yang co-founded Yahoo in 1994, he and other early internet pioneers probably couldn’t have predicted that roughly 30 years later, their innovations would be at the center of political and ethical questions related to user data privacy, according to tech entrepreneur John Roa.

In those early days, people weren’t as aware of the data extraction that was happening, he explained. “We thought we were just connecting with our college buddies on Facebook,” Roa, who 

 to Salesforce in 2015, said. “But in reality, we were just siphoning data to the powers-that-be and creating trillion-dollar companies that never really explained to us they were doing that.”

In 2021, Yang approached Roa to invest in Caden, an app that lets users consent to sharing their data with companies like Amazon or Uber for advertising purposes. In exchange, users receive a slice of revenue. The app, which recently soft-launched, markets itself as a sort of solution to mounting data privacy concerns in recent years that have seen a number of tech juggernauts, such as 

Caden acts as a go-between for users and the advertisers seeking their data, letting people link their personal data from different companies, like Amazon, Netflix, and Uber, with the app’s “vault.”

According to Roa, Caden’s first tier anonymizes and aggregates users’ data after they consent to sharing it. That data is then sold to financial institutions and similar orgs that might want to use it to analyze things like consumer behavior trends, for instance, he said. Currently, users can expect to make approximately $15 a month “if they connect to all of the available sources” in the current tier of data personalization available, Roa said.

Its other tiers, which aren’t available yet, are more advertising-focused. Its second tier will let users consent to sharing data that advertisers can use for targeting purposes, though Roa said it wouldn’t be personally identifiable. Brands could use this data to target ads to specific demographics, like “people who take more than 50 Ubers a year, or people who have watched this film,” he explained.

“We will never share identity, but it allows advertisers to reach a customer in really clever ways that will actually provide better advertisements for people that still protect their privacy,” he said.

A third tier, which he expects to not roll out until next year or 2025, would let brands directly target individuals based on personal data they’ve shared; Roa used the example of Netflix recommending a documentary on the Tour de France to someone that it can see has “gotten into cycling recently” based on information that person has shared with the streamer.

After the soft launch of the app, there are currently 3,000​​–4,000 users on Caden, Roa estimated, and it acquired over 100 million data points in under two weeks. So far, Caden has raised 

 in seed funding, from investors including Yang’s AME Cloud Ventures. The company is “in discussions on our next round of venture capital, which will be Series A,”  Roa said.

 on data privacy, Roa said that he sees Caden’s “more consent-focused” model as a potential way forward.

“What’s funny or sad, depending on your perspective about privacy and privacy legislation, especially in this country, is it’s one of the few bipartisan issues we have,” he said. “Our government can’t agree on what color the sky is. But for some reason, both sides of the aisle love data privacy, and it’s really because one side hates Big Tech and one side hates regulation.”

Correction, 5/10/23: This story has been updated to more accurately reflect Yang's involvement with Caden.

Caden recently soft-launched 

Turns out you can make money off your late-night, drunken Uber rides home. 

Caden, the app that pays users money to share their data, recently soft-launched 

A federal judge has, for now, dismissed the Federal Trade Commission’s lawsuit against the data broker Kochava, which accused it of selling location data that could be used to “track mobile device users to and from sensitive locations,” like healthcare clinics and domestic-violence shelters.

 about marketplaces that collect and sell location data in light of the Supreme Court’s 

 that the accusations were baseless, but that  it was planning on removing sensitive locations from its data marketplace nonetheless. The company 

 that the removal went into effect in September.

Now, a federal judge has ruled that the commission’s complaint fell short of the legal bar set forth in the FTC Act that requires the possibility of “substantial injury” to consumers. “The FTC has not adequately alleged a likelihood of substantial consumer injury,” the court found.

Specifically, the ruling argued that location data, on its face, doesn’t necessarily reveal personal information. In other words, someone visiting a dentist doesn’t necessarily have cavities. Inferences, or guesses, would have to be made to reach that conclusion. The judge also argued that sensitive location data could be collected through other means, like by observing someone.

“The FTC does not actually claim that Kochava is disclosing private information, but rather that it is selling data from which private information might be inferred,” the court’s decision read. “Although this distinction does not eliminate all the privacy concerns voiced by the FTC in this lawsuit, it does lessen the severity of the alleged privacy injury.”

However, the court is giving the FTC another swing, allowing the commission 30 days to file an amended complaint.

“We remain confident in the legal arguments and rationale for dismissal of the FTC’s case and we are hopeful that challenging the FTC will bring necessary regulatory clarity that will ultimately benefit consumers and advertisers as a whole,” Kochava CEO Charles Manning said in an email via spokesperson Leslie Amadio.

The FTC didn’t immediately get back to Marketing Brew; we’ll update the story if and when it does.

a phone on a map of the US on a red background

Court dismisses FTC’s suit against Kochava…for now

 But it’s giving the agency another chance to make its argument against the data broker. 

If you missed last week’s newsletter, Washington State passed a law that will curb the 

 of healthcare data. Most of the My Health, My Data act will go into effect in 2024 and could have “profound” impacts on digital advertising, a privacy lawyer told us.

 with Washington State Rep. Vandana Slatter, who introduced the bill.

The bill’s passage could inspire other states to follow suit. Nevada’s senate 

 a similar bill last week that would require businesses to acquire consumers’ consent before collecting and sharing their health data.

In that other Washington, the House Energy and Commerce Committee held 

 on “addressing America’s data privacy shortfalls” as Congress mulls various 

“Consumers are, increasingly, every day, concerned about their inability to protect their private information,” Illinois Rep. Jan Schakowsky said during the hearing.

 the Kids PRIVACY Act, a bill that seeks to add more protections to kids online, last week.

Montana’s TikTok ban has hit a speedbump, 

 reported. Governor Greg Gianforte is requesting the bill be amended to include other social media companies that “provide certain data to foreign adversaries.”

Privacy news this week

A House subcommittee held a hearing about a federal privacy bill.

Vandana Slatter represents Washington State’s 48th legislative district and introduced what could be one of the most consequential privacy bills in the country: The My Health, My Data Act, which was signed into law by Governor Jay Inslee on Thursday. Prior to working in politics, she worked as a clinical scientist at companies including Amgen and UCB and as a hospital pharmacist.

Marketing Brew spoke with Rep. Slatter about the bill on Wednesday before it was signed into law.

This interview has been lightly edited and condensed for clarity.

Washington State has tried to pass a broader privacy law for the past few years and has failed. Why did this pass?

I can’t speak to everybody’s vote on this issue…But, for three years, we’ve worked on privacy policy, and broad, comprehensive privacy legislation has not passed. It was not clear that this bill would actually make it across the finish line. Actually, originally, I was not sure if a privacy bill should be in the works after last year’s privacy bill did not make it through the process.

with the restriction of access to reproductive healthcare in other states, with the privacy landscape changing with that decision, it became evident that women’s health data needed to be protected. People’s health data who were accessing reproductive care, gender-affirming care—and were seeking it in Washington State—needed to be protected. Otherwise, they would be targeted by people. There was a gap in that protection on websites, apps, and searches. I think that that helped to address the urgency of this issue.

 (Editor’s note: Private right of action enables private parties like consumers to sue in order to enforce their rights under the law.)

I’m a healthcare professional, and if I release your personal, deeply sensitive healthcare data, my license is at risk. That same protection of your data does not exist on websites, apps, or searches. A private right of action, or the ability for a consumer to find relief or remedy for somebody releasing that very deeply personal information, I don’t think is a question in certain spaces. But certainly, in the comprehensive data privacy world, that is something that the [tech] industry was really worried about.

A lawyer I interviewed described the law’s consent requirements as being “on steroids” because it goes as far as asking for written consent to collect data. And would need an additional layer of consent if the company wanted to sell that data. Is that accurate?

If you go to the doctor’s office right now or you get a procedure, generally speaking, you would fill out a consent form so that your doctor could actually share that information with an insurance company, with other physicians…That same level of protection, that same consent, is not provided to you online. Right now, companies can collect, share, and sell that data without your even knowing about it or consenting to it. This bill is basically providing that protection to you; it doesn’t mean that data cannot be collected or shared, but it needs to be transparent that that’s what they’re doing and that they get your consent.

With respect to selling, in the original bill, it was prohibited. But HIPAA does actually allow for selling with valid authorization, so the legal team said to me that we would need to allow it with valid authorization in the bill in order to prevent any kind of constitutional challenge.

 that a customer was pregnant in part because of her online behavior. Are those kinds of assumptions covered under this bill?

Yes, this is not something that’s completely new to data 

Do you have an estimation of compliance costs for tech companies, advertisers, and data brokers?

I don’t have an understanding of the compliance costs. What I can tell you is that we have talked with experts and technologists as to whether or not this would be difficult to implement and where the difficulties would be.

This has been six months of countless meetings and countless changes—hundreds of hours with the tech industry, businesses, diagnostic companies, biopharmaceutical companies, data broker representatives. Any type of industry that reached out to us, we met with them. We spent hours working on the language in order to address their concerns while still protecting sensitive data and trying to stay true to the intent of the bill. We wanted to double check what companies were telling us by reaching out to experts and technologists—those who are privacy watchers—but also those who work in companies right now.

A conversation with Washington State Rep. Vandana Slatter 

She introduced the state’s sweeping health data bill, which was signed into law on Thursday. 

Indiana could become the seventh state to pass privacy legislation.

The state’s Consumer Data Protection Act is sitting on the governor’s desk and, if it passes, would 

 in Iowa, Virginia, and Utah. It would go into effect at the start of 2026 and allow residents to prohibit the sale of their personal info and opt out of targeted advertising.

Elsewhere, privacy lawyers have landed in Nashville, looking for a deal on cowboy boots they’ll never wear again. Last week, the Tennessee state senate passed a privacy bill called the Information Protection Act.

In broad strokes, the law raises protections for consumers and would give Tennessee residents the ability to opt out of targeted advertising reliant on personal data, so long as it hasn’t been either aggregated or “de-identified” (as is also the case with Indiana’s bill).

US Reps. Anna Eshoo (D-CA) and Zoe Lofgren (D-CA) 

 the Online Privacy Act last week, which would establish an “independent agency” called the Digital Privacy Agency responsible for enforcing privacy compliance. The bill seeks to create a “federal floor” for privacy across the country, allowing individual states to step in and increase protections.

Rep. Kathy Castor (D-FL) recently said she’d 

 the Protecting the Information of our Vulnerable Children and Youth Act, which also goes by the “Kids PRIVCY Act.” It follows other federal efforts to rein in the collection of 

Privacy news from the week

Indiana could be the next state to pass a consumer privacy law. 

Europe’s most consequential consumer privacy law is old enough to read.

Passed in 2016, the European Union’s General Data Protection Regulation (GDPR) was shortly followed by the California Consumer Privacy Act (CCPA), America’s first state-level consumer privacy law, which passed in 2018.

Though privacy legislation may feel like an inevitable rising tide of anxiety and even confusion, at least among advertisers, UC Berkeley’s Center for Long-Term Cybersecurity has released a 

 of reports and studies that have probed into the two laws.

While the research doesn’t give a true nickels-and-cents account of the legislation’s economic impact on digital advertising, it does provide detailed anecdotes about the impacts of these laws, which the white paper calls “ultimately ‘first drafts’ in privacy protection,” on companies.

Through pulling together highlights from various findings, the white paper illustrates how companies have approached these laws and the sorts of challenges that have cropped up along the way.

 how publicly traded tech firms “interpret and translate” privacy legislation “as different types of business risks” to shareholders through 10-Ks, annual SEC filings about a company’s financial performance. While Apple and Amazon’s filings only “generally mention privacy laws” between 2015 and 2020, filings from Google, Microsoft, and Meta have explicitly mentioned GDPR and CCPA at different points within that time frame, with Meta going as far as to say that both laws impacted its revenue.

A separate study examined how a group of Serbian startups have navigated these laws, finding that 10 out of 19 respondents had “someone in their firm responsible for GDPR compliance.” These startups took compliance seriously due to fears related to costs, not from fines but from potentially losing investor interest, the researchers found.

A survey of tech workers identified tension with lawyers when it came to matters of compliance. For instance, an engineer at a large tech company said that their team was hesitant to consult lawyers on an issue regarding compliance because “it usually ended up being more work.”. Several said lawyers were “unavailable, either by design or because of lack of capacity.”

This tension can also be illustrated by everyone’s favorite online hurdle: The cookie banner, which many sites now have in order to comply with GDPR and CCPA. In practice, consumers “see so many different variations on different websites, because you have different lawyers talking to different engineers with different interests,” Saba Chinian, a third-year law student at UC Berkeley School of Law, who wrote the white paper, explained. Chinian previously worked at the Department of Justice and Google.

 that broad and vague language within privacy legislation can lead to unintended and potentially harmful consequences for “disfavored or marginalized groups.” For example, their research  described a Turkish restauranter and employee operating a snack stand in Vienna installed cameras to capture police harassment, only to be convicted of violating GDPR rules.

These anecdotes “make you wonder [if] this really in tandem with what the goal here is,”

Another pain point, according to the research? Confusing definitions. A survey of security, law, and privacy experts unanimously found that imprecise definitions complicated their internal compliance practices.

Take a term like “legitimate interest,” which companies can cite as a legal reason for data collection under GDPR even though it isn’t defined within the law, Chinian points out in the white paper. Under GDPR, legitimate interest is described as when the “interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller.” Great.

Using a web crawler, researchers combed 10,000 websites looking for companies that used the term “legitimate interest” in their consent notices, finding that hundreds did. Some companies didn’t let users opt out of legitimate interest data collection, while those that did “often complicated” the process.

“Because of the vague and broad allowances of ‘legitimate interest’ under the GDPR, firms can continue to unintentionally or intentionally deceive users and misuse their data without consequence,” Chinian wrote in the white paper.

Though the report is mostly a collection and analysis of recently published work, it provides some next steps to practitioners, like suggestions of how to frame compliance. “Companies can more effectively motivate GDPR and CCPA compliance by reframing compliance as risk prevention, rather than just focusing on abstract user-centric privacy concerns,” Chinian wrote.

And for regulators, the report suggests that it might be easier to “encourage quick compliance” if future privacy laws are modeled on the laws that already exist, even if they are just the “first drafts.”