Over the next few months (and years), we’ll likely see the introduction of new state laws protecting consumer privacy.
These laws are designed to enhance the disclosure of privacy policies, establish opt-in and/or opt-out mechanisms, create avenues for consumers to update or delete their data and put other requirements in place.
In the absence of a federal privacy law, advertisers can expect to see a steady stream of announcements like the one below. Just fill in the blanks.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Last week, Governor [INSERT] signed a new comprehensive consumer privacy law in [INSERT STATE]. This now brings the number of states that have enacted comprehensive consumer privacy laws to [X]. During a press conference announcing the enactment of this law, Governor [INSERT] said: “We want to show America that [INSERT STATE] is just as concerned with consumer privacy as California.”
This new law applies to companies with revenues in excess of [X] or who process more than [X] consumer records in the state. Among the many new requirements that this law will impose, businesses will now be obligated to: (1) provide enhanced consumer disclosures through privacy policies, (2) offer consumers the right to access their personal information, delete their personal information or correct their personal information that is being held by the business, (3) offer consumers the right to opt out of the sale of their personal information or the use of such information for targeted advertising, (4) obtain opt-in consent to process sensitive personal information, (5) conduct and document privacy-impact assessments, (6) enter into data protection agreements with their processors and (7) flow down deletion requests to their processors and subprocessors.
When Governor [INSERT] was asked during the press conference if the Governor hoped for a new federal privacy law that could replace this morass of state legislation, the Governor said: “I spoke with Senator [INSERT] and Representative [INSERT] yesterday, and they both acknowledged that the chances of a comprehensive consumer privacy law being passed in Congress any time soon is remote. These days, they seem to be more focused on AI issues than privacy.”
The new law takes effect on January 1, [INSERT], but the state is not obligated to issue regulations to help clarify compliance obligations until [INSERT]. Businesses will have a short window to revise their processes to comply with this new law.
Note to reader: The above may be repurposed as each new state privacy law is enacted.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
The preceding passage is a parody – not output from a generative AI that forgot to fill in the details.
But, in reality, the challenges for participants in the ad tech ecosystem are real, significant and growing.
As we sit here today, 12 states have enacted comprehensive consumer privacy laws, and there are numerous disconnects between them. While companies would love to follow the strictest standard and apply that to all users, there is no one strictest standard.
It’s a common misconception that California’s law is the most rigid, but that’s not always the case. For example, California takes an opt-out approach to the processing of sensitive personal information, whereas other states take the much stricter opt-in approach.
Other discrepancies include different definitions of what data is considered sensitive, different contracting and assessment requirements with customers and business partners, cure periods in some states versus none in others, different definitions of seemingly intuitive terms such as “consent”, “child” and “dark patterns,” and even inconsistencies in how precise location data needs to be.
Looking ahead
As for what the future holds, we anticipate more states passing comprehensive consumer privacy laws.
Therefore, a company’s compliance program needs to be deliberate, company-specific and regularly revisited since each law brings new challenges and inconsistencies to manage.
As Governor [INSERT] said so eloquently, “The good citizens of [INSERT STATE] should not have to worry about their privacy. Instead, they should be outside enjoying the wonderful [INSERT] that our state is famous for.”
“Data-Driven Thinking” is written by members of the media community and contains fresh ideas on the digital revolution in media.
Follow Gary Kibel, Davis+Gilbert LLP and AdExchanger on LinkedIn.
For more articles featuring Gary Kibel, click here.
