Marketing Brew informs marketing pros of the latest on brand strategy, social media, and ad tech via our weekday newsletter, virtual events, marketing conferences, and digital guides.

Marketing Brew

Ryan Barwick

marketingbrew.com

a phone saying "Click here" with a gavel over it

Why the IAB’s CEO is “in a bazooka fight” with privacy activists, regulators, and Apple

“The use of hyperbole and the use of exaggeration is at my discretion,” he told us.

Where privacy regulation stands ahead of 2023

 California, Virginia, Connecticut, Colorado, and Utah are all getting new privacy laws next year.

How CMOs are thinking about new privacy restrictions

“If you’re the CMO, you have to have a very good, functioning knowledge of privacy laws and what’s happening,” a marketing exec told us. 

Digital security padlock in a digital space

Data privacy

Jasmine Sheena

A new ad tax is scheduled to go into effect in Washington State on Oct. 1. Some experts are sounding the alarm about the scope of the law, as well as how it will be implemented.

The legislation, which was signed into law in May, will impose a tax on “all digital and nondigital services related to the creation, preparation, production, or dissemination of advertisements,” according to the text of the legislation. That will include everything from graphic design to search engine marketing, online campaign planning, and site traffic analysis. There are some notable exceptions: billboard advertising, as well as newspapers, publishing, and radio and TV broadcasts, won’t be subject to the tax.

The law reclassifies digital ads (which were previously categorized as a digital automated service) as retail transactions, meaning that digital ads will be subject to the state’s retail sales tax.

The state’s Department of Revenue has been working to 

 the details regarding how the tax will be instituted, but many of those details remain unclear.

Of the bill’s seven sponsors, state senators Emily Alvarado, Claire Wilson, Jamie Pedersen, and Javier Valdez redirected queries to a staffer for the prime sponsor, Sen. Noel Frame, who did not return Marketing Brew’s requests for comment. Senators Frame, Yasmin Trudeau, and T’wina Nobles did not respond to our requests for comment.

With just five weeks left until the law goes into effect, legal, privacy, and marketing experts are voicing their concerns.

“Whether you’re a mom-and-pop business who has an IT consultant who comes in and helps rewire something, or you’re [the] big Amazons and Microsofts, they’re going to be paying tax on these services,” Elizabeth Gray, state and local tax senior manager at the Washington-based law firm Eide Bailly LLP, told Marketing Brew.

One question heading into October is how the tax will impact small businesses compared to larger ones like Amazon and Microsoft, both of which are headquartered in the state. Debbie Reynolds, founder, CEO, and chief data privacy officer at Debbie Reynolds Consulting, which has clients with business interests in Washington, said it’s possible that big businesses may have an easier time complying. Small businesses, on the other hand,may not have the same kind of infrastructure or resources to understand the tax’s impact on them and how to navigate it, she noted.

Some experts believe the tax may encourage some businesses to explore moving their operations elsewhere. “I do believe there will be businesses that will move out of Washington because of this, sadly,” Michelle Strom, principal, president, media at Washington-based Strom & Nelsen Strategic Marketing, Inc., told Marketing Brew.

Amazon declined to provide a comment. Microsoft declined to comment.

Washington’s impending tax is somewhat similar to a digital advertising tax that passed in 2021 in Maryland, which taxes digital ad businesses that accrue at least $100 million in global annual gross revenue. The law, which marked the first of its kind in the country, is tied up in the courts after multiple businesses sued, claiming that it violates the federal Internet Tax Freedom Act (ITFA), which restricts states from taxing e-commerce businesses if similar services aren’t also charged.

 similar digital taxes, including California, Louisiana, Nebraska, New York, Rhode Island, and Virginia.

Some experts say there could be an argument that Washington’s law violates the ITFA.

“A lot of states will watch to see how this plays out and see if this is even possible,” Reynolds said. “The internet doesn’t have borders like states have physically.”

There are plenty of other questions. In a document 

 in July by the state’s Department of Revenue summarizing public sessions held to discuss the law, some advertisers express concern about the difficulty of determining, say, audience geography or how the tax stands to affect existing contracts with clients.

Collecting data on digital ads for tax implementation purposes could also potentially run afoul of other laws already on the books, Reynold said, pointing to Washington’s 

, which restricts some location-tracking that could relate to healthcare data. The potential privacy implications of data collection could introduce one more thing businesses will have to navigate, which Reynolds said could potentially impose a larger burden on small businesses.

“It’s a tight-wire act at this point,” she said.

Looking ahead, Strom said she expects businesses to begin to build the tax into their marketing budgets, which could ultimately mean they have less to spend on advertising itself.

“When a business decides to cut their marketing, it hurts them because they have less exposure,” she said. “It impacts the businesses and brands themselves, and it impacts the agencies, and also it impacts media outlets, because there will be less media purchase because of this tax.”

multiple white piggy banks in front of a green background

Breaking down Washington’s upcoming digital ads tax

Legal and privacy experts say there are questions about how the law will be implemented and how it may intersect with existing data-privacy legislation.

Washington’s digital ads tax goes into effect on Oct. 1. What could go wrong?

Data brokers are going to California with an aching in their hearts.

The state, the first to adopt a comprehensive consumer privacy law that is often considered a harbinger of privacy legislation to come, is considering 

 that could further regulate the data broker industry.

The bill, called the Delete Act, is headed to a full vote later this month.

While California’s existing privacy laws allow citizens to ask brokers to delete their data, the Delete Act would streamline the process, creating what’s described in the bill as an “accessible deletion mechanism” that would essentially require all data brokers to “empty trash” on an individual, if they ask. In other words, it would give residents a one-stop shop for these requests, as opposed to asking each data broker individually.

 of data brokers, which lists at least 500. Additionally, after a data broker processes a consumer’s deletion request, the bill would require it to delete “all personal information of the consumer” at least once every 45 days. If passed, it would go into effect in 2026.

Earlier this year, Planned Parenthood and the Electronic Frontier Foundation voiced support for the bill, with the latter describing the current process for requesting data deletion as something that “can become time-consuming and tedious.”

“We really need to be thinking about the risks to all of us of having this information floating out there and thinking of ways to get people control back over that information,” California State Senator Josh Becker, author of the Delete Act, told 

Unsurprisingly, some in the ad-tech industry don’t seem to be in love with the bill. The Consumer Data Industry Association, a trade association that doesn’t appear to publicly list its members, created a website that encourages Californians to oppose the bill. “SB 362 would cause tremendous damage across California’s data-driven economy by using a blunt-force approach on this complicated and vital system,” the website reads.

 that IPG was “pulling out all the stops” to prevent the bill from passing, according to internal emails between agency execs that were obtained by the outlet. IPG owns the data broker Acxiom.

pieces of paper going into a yellow trash can

California bill would crack down on data brokers

The Delete Act, which is up for a vote later this month, would make it easier for residents to request that data brokers delete their personal info.

When Caden investor Jerry Yang co-founded Yahoo in 1994, he and other early internet pioneers probably couldn’t have predicted that roughly 30 years later, their innovations would be at the center of political and ethical questions related to user data privacy, according to tech entrepreneur John Roa.

In those early days, people weren’t as aware of the data extraction that was happening, he explained. “We thought we were just connecting with our college buddies on Facebook,” Roa, who 

 to Salesforce in 2015, said. “But in reality, we were just siphoning data to the powers-that-be and creating trillion-dollar companies that never really explained to us they were doing that.”

In 2021, Yang approached Roa to invest in Caden, an app that lets users consent to sharing their data with companies like Amazon or Uber for advertising purposes. In exchange, users receive a slice of revenue. The app, which recently soft-launched, markets itself as a sort of solution to mounting data privacy concerns in recent years that have seen a number of tech juggernauts, such as 

Caden acts as a go-between for users and the advertisers seeking their data, letting people link their personal data from different companies, like Amazon, Netflix, and Uber, with the app’s “vault.”

According to Roa, Caden’s first tier anonymizes and aggregates users’ data after they consent to sharing it. That data is then sold to financial institutions and similar orgs that might want to use it to analyze things like consumer behavior trends, for instance, he said. Currently, users can expect to make approximately $15 a month “if they connect to all of the available sources” in the current tier of data personalization available, Roa said.

Its other tiers, which aren’t available yet, are more advertising-focused. Its second tier will let users consent to sharing data that advertisers can use for targeting purposes, though Roa said it wouldn’t be personally identifiable. Brands could use this data to target ads to specific demographics, like “people who take more than 50 Ubers a year, or people who have watched this film,” he explained.

“We will never share identity, but it allows advertisers to reach a customer in really clever ways that will actually provide better advertisements for people that still protect their privacy,” he said.

A third tier, which he expects to not roll out until next year or 2025, would let brands directly target individuals based on personal data they’ve shared; Roa used the example of Netflix recommending a documentary on the Tour de France to someone that it can see has “gotten into cycling recently” based on information that person has shared with the streamer.

After the soft launch of the app, there are currently 3,000​​–4,000 users on Caden, Roa estimated, and it acquired over 100 million data points in under two weeks. So far, Caden has raised 

 in seed funding, from investors including Yang’s AME Cloud Ventures. The company is “in discussions on our next round of venture capital, which will be Series A,”  Roa said.

 on data privacy, Roa said that he sees Caden’s “more consent-focused” model as a potential way forward.

“What’s funny or sad, depending on your perspective about privacy and privacy legislation, especially in this country, is it’s one of the few bipartisan issues we have,” he said. “Our government can’t agree on what color the sky is. But for some reason, both sides of the aisle love data privacy, and it’s really because one side hates Big Tech and one side hates regulation.”

Correction, 5/10/23: This story has been updated to more accurately reflect Yang's involvement with Caden.

Caden recently soft-launched 

Turns out you can make money off your late-night, drunken Uber rides home. 

Caden, the app that pays users money to share their data, recently soft-launched 

A federal judge has, for now, dismissed the Federal Trade Commission’s lawsuit against the data broker Kochava, which accused it of selling location data that could be used to “track mobile device users to and from sensitive locations,” like healthcare clinics and domestic-violence shelters.

 about marketplaces that collect and sell location data in light of the Supreme Court’s 

 that the accusations were baseless, but that  it was planning on removing sensitive locations from its data marketplace nonetheless. The company 

 that the removal went into effect in September.

Now, a federal judge has ruled that the commission’s complaint fell short of the legal bar set forth in the FTC Act that requires the possibility of “substantial injury” to consumers. “The FTC has not adequately alleged a likelihood of substantial consumer injury,” the court found.

Specifically, the ruling argued that location data, on its face, doesn’t necessarily reveal personal information. In other words, someone visiting a dentist doesn’t necessarily have cavities. Inferences, or guesses, would have to be made to reach that conclusion. The judge also argued that sensitive location data could be collected through other means, like by observing someone.

“The FTC does not actually claim that Kochava is disclosing private information, but rather that it is selling data from which private information might be inferred,” the court’s decision read. “Although this distinction does not eliminate all the privacy concerns voiced by the FTC in this lawsuit, it does lessen the severity of the alleged privacy injury.”

However, the court is giving the FTC another swing, allowing the commission 30 days to file an amended complaint.

“We remain confident in the legal arguments and rationale for dismissal of the FTC’s case and we are hopeful that challenging the FTC will bring necessary regulatory clarity that will ultimately benefit consumers and advertisers as a whole,” Kochava CEO Charles Manning said in an email via spokesperson Leslie Amadio.

The FTC didn’t immediately get back to Marketing Brew; we’ll update the story if and when it does.

a phone on a map of the US on a red background

Court dismisses FTC’s suit against Kochava…for now

 But it’s giving the agency another chance to make its argument against the data broker. 

If you missed last week’s newsletter, Washington State passed a law that will curb the 

 of healthcare data. Most of the My Health, My Data act will go into effect in 2024 and could have “profound” impacts on digital advertising, a privacy lawyer told us.

 with Washington State Rep. Vandana Slatter, who introduced the bill.

The bill’s passage could inspire other states to follow suit. Nevada’s senate 

 a similar bill last week that would require businesses to acquire consumers’ consent before collecting and sharing their health data.

In that other Washington, the House Energy and Commerce Committee held 

 on “addressing America’s data privacy shortfalls” as Congress mulls various 

“Consumers are, increasingly, every day, concerned about their inability to protect their private information,” Illinois Rep. Jan Schakowsky said during the hearing.

 the Kids PRIVACY Act, a bill that seeks to add more protections to kids online, last week.

Montana’s TikTok ban has hit a speedbump, 

 reported. Governor Greg Gianforte is requesting the bill be amended to include other social media companies that “provide certain data to foreign adversaries.”

Privacy news this week

A House subcommittee held a hearing about a federal privacy bill.

Vandana Slatter represents Washington State’s 48th legislative district and introduced what could be one of the most consequential privacy bills in the country: The My Health, My Data Act, which was signed into law by Governor Jay Inslee on Thursday. Prior to working in politics, she worked as a clinical scientist at companies including Amgen and UCB and as a hospital pharmacist.

Marketing Brew spoke with Rep. Slatter about the bill on Wednesday before it was signed into law.

This interview has been lightly edited and condensed for clarity.

Washington State has tried to pass a broader privacy law for the past few years and has failed. Why did this pass?

I can’t speak to everybody’s vote on this issue…But, for three years, we’ve worked on privacy policy, and broad, comprehensive privacy legislation has not passed. It was not clear that this bill would actually make it across the finish line. Actually, originally, I was not sure if a privacy bill should be in the works after last year’s privacy bill did not make it through the process.

with the restriction of access to reproductive healthcare in other states, with the privacy landscape changing with that decision, it became evident that women’s health data needed to be protected. People’s health data who were accessing reproductive care, gender-affirming care—and were seeking it in Washington State—needed to be protected. Otherwise, they would be targeted by people. There was a gap in that protection on websites, apps, and searches. I think that that helped to address the urgency of this issue.

 (Editor’s note: Private right of action enables private parties like consumers to sue in order to enforce their rights under the law.)

I’m a healthcare professional, and if I release your personal, deeply sensitive healthcare data, my license is at risk. That same protection of your data does not exist on websites, apps, or searches. A private right of action, or the ability for a consumer to find relief or remedy for somebody releasing that very deeply personal information, I don’t think is a question in certain spaces. But certainly, in the comprehensive data privacy world, that is something that the [tech] industry was really worried about.

A lawyer I interviewed described the law’s consent requirements as being “on steroids” because it goes as far as asking for written consent to collect data. And would need an additional layer of consent if the company wanted to sell that data. Is that accurate?

If you go to the doctor’s office right now or you get a procedure, generally speaking, you would fill out a consent form so that your doctor could actually share that information with an insurance company, with other physicians…That same level of protection, that same consent, is not provided to you online. Right now, companies can collect, share, and sell that data without your even knowing about it or consenting to it. This bill is basically providing that protection to you; it doesn’t mean that data cannot be collected or shared, but it needs to be transparent that that’s what they’re doing and that they get your consent.

With respect to selling, in the original bill, it was prohibited. But HIPAA does actually allow for selling with valid authorization, so the legal team said to me that we would need to allow it with valid authorization in the bill in order to prevent any kind of constitutional challenge.

 that a customer was pregnant in part because of her online behavior. Are those kinds of assumptions covered under this bill?

Yes, this is not something that’s completely new to data 

Do you have an estimation of compliance costs for tech companies, advertisers, and data brokers?

I don’t have an understanding of the compliance costs. What I can tell you is that we have talked with experts and technologists as to whether or not this would be difficult to implement and where the difficulties would be.

This has been six months of countless meetings and countless changes—hundreds of hours with the tech industry, businesses, diagnostic companies, biopharmaceutical companies, data broker representatives. Any type of industry that reached out to us, we met with them. We spent hours working on the language in order to address their concerns while still protecting sensitive data and trying to stay true to the intent of the bill. We wanted to double check what companies were telling us by reaching out to experts and technologists—those who are privacy watchers—but also those who work in companies right now.

A conversation with Washington State Rep. Vandana Slatter 

She introduced the state’s sweeping health data bill, which was signed into law on Thursday. 

Indiana could become the seventh state to pass privacy legislation.

The state’s Consumer Data Protection Act is sitting on the governor’s desk and, if it passes, would 

 in Iowa, Virginia, and Utah. It would go into effect at the start of 2026 and allow residents to prohibit the sale of their personal info and opt out of targeted advertising.

Elsewhere, privacy lawyers have landed in Nashville, looking for a deal on cowboy boots they’ll never wear again. Last week, the Tennessee state senate passed a privacy bill called the Information Protection Act.

In broad strokes, the law raises protections for consumers and would give Tennessee residents the ability to opt out of targeted advertising reliant on personal data, so long as it hasn’t been either aggregated or “de-identified” (as is also the case with Indiana’s bill).

US Reps. Anna Eshoo (D-CA) and Zoe Lofgren (D-CA) 

 the Online Privacy Act last week, which would establish an “independent agency” called the Digital Privacy Agency responsible for enforcing privacy compliance. The bill seeks to create a “federal floor” for privacy across the country, allowing individual states to step in and increase protections.

Rep. Kathy Castor (D-FL) recently said she’d 

 the Protecting the Information of our Vulnerable Children and Youth Act, which also goes by the “Kids PRIVCY Act.” It follows other federal efforts to rein in the collection of 