On Tuesday, Congressional Democrats unveiled a new bill to outlaw a wide swath of targeted advertising. The Banning Surveillance Advertising Act would prohibit ad tech companies from using consumers’ personal information to target ads, with limited exceptions. It also would prohibit advertisers from using third party data, or data about a person’s membership in a protected class, to target ads. The bill would authorize the FTC, state attorneys general, and private litigants to enforce the law, and the FTC to write rules implementing it.
The effort, led by Senator Cory Booker (D-NJ) and Congresswomen Anna Eshoo (D-CA) and Jan Schakowsky (D-IL), arrives at a time of unprecedented regulatory developments impacting the ad tech industry – most notably, the enactment of new state privacy laws in California, Virginia, and Colorado with provisions regulating the industry. While these privacy laws have focused on giving consumers the opportunity to make choices about data sharing for purposes of targeted advertising, the Banning Surveillance Advertising Act would place blanket prohibitions on such advertising. As we describe here, the FTC has also announced that it is developing a rule targeting “surveillance-based business models,” though the contours of that rule are still unknown.
In a press release, Senator Booker explained his view that “surveillance advertising is a predatory and invasive practice. The hoarding of people’s personal data not only abuses privacy, but also drives the spread of misinformation, domestic extremism, racial division, and violence.” Echoing Booker, Rep. Eshoo said that the practice “fuels disinformation, discrimination, voter suppression, privacy abuses, and so many other harms.” Rep. Schakowsky, who chairs the House Energy and Commerce Consumer Protection Subcommittee, said the practice “exacerbates manipulation, discrimination, misinformation, and extremism.”
Given the dramatic changes that the bill would impose on the marketplace, it is not surprising that industry groups have already criticized it forcefully. In a press release today, IAB stated that the bill would “disenfranchise businesses that advertise on the Internet, and hundreds of millions of Americans who use it every day to find exactly what they need, quickly,” and that it could “eliminate the commercial internet almost entirely.”
Contextual Ads Would Be Permitted
In a background brief, the legislators wrote that they recognize certain benefits of advertising online, but believe that advertisers do not need to use personal data to effectively target advertising. “Advertising enables many of the ‘free’ internet products that exist today, and it enables small businesses, nonprofits, and challenger politicians to cheaply reach customer, funders, and voters,” the legislators wrote. But, according to the brief, “targeted ads for advertisers over contextual ads” (i.e., ads based on the content of a website the consumer is viewing, as opposed to the consumer’s personal information or browsing history). As a result, the bill would allow contextual advertising.
Some First-Party Ads Would Be Permitted
As drafted, the bill focuses primarily on banning targeted advertising based on third party data rather than first party data. For example, brands would be able to target their own customers using first party data but not third party data. Brands also would be able to provide ad tech companies with first party data for targeted advertising (including for purposes of re-targeting), as long as the advertiser certifies to compliance with the proposed law. However, the bill would strictly prohibit any targeting by advertisers that is based on an individual’s membership in a protected class.
The bill also focuses on targeting consumers based on “personal information,” defined as data linked or reasonably linkable to an individual or a connected device. This definition appears to leave room for targeted advertising based on data that has been de-identified in some form.
Here’s a summary of what would be banned and permitted under the new legislation:
Summary of Conduct that Would Be Banned
- Ad tech companies could not build segments with third party data: This means they could not provide advertisers or third parties with personal information for purposes of targeting the dissemination of ads, including: (1) lists of individuals or devices; (2) contact information; (3) unique identifiers; and other personal information, such as browsing history.
- Advertisers could not target ads based on protected classes: Protected classes would include actual or perceived race, color, ethnicity, national origin, religion, sex, sexual orientation, gender identity, gender expression, familial status, or disabilities.
- Advertisers could not target ads based on third party data: Such data would include information from data brokers.
- Advertisers could not hire an ad tech company to target ads based on third party data: This means that ad tech companies could not (a) target ads based on third party data or (b) enable an advertiser or a third party to do.
Summary of Conduct that Would Be Permitted
- Advertisers could target ads based on first party data: The bill does not restrict this practice, as long as the ads are not targeted to protected classes.
- Advertising could be targeted to a general location: The bill specifically exempts advertising based on an individual’s general location (i.e., state or municipality but not zip code).
- Contextual advertising: Ad tech companies could still facilitate dissemination of ads based on context or search terms. However, they would not be able to use information they collect from contextual advertising to target additional.
- Hiring an ad tech company to target ads based on first party data: This would be permitted, but only if the ad tech company provided written attestation to the advertiser that the ads were not targeted based on protected classes or third party data.
- Targeting advertising using non-personal information: As noted above, the bill likely leaves room for ad tech providers to develop ways to target advertising without using personal information that identifies or can identify an individual or device. If enacted, the legislation could accelerate efforts by some companies to develop ad targeting without use of, using privacy enhancing technologies like targeting based on cohorts or secure multiparty computation.
* * *
The prospects for Congress actually enacting this bill (or a similar one) are not at all clear at this time. However, the bill is yet another sign that digital advertising is under scrutiny, and that policymakers are pushing companies to provide greater transparency and more robust privacy protections for the collection, use, and sharing of consumers’ personal data for advertising purposes.
We will continue to track data privacy bills as they make their way through the legislative process and post updates here.