As privacy regulations and enforcement grow more complex, companies must keep up with key developments and continue partnering with privacy experts to understand their practical impact.
One notable development that flew under the radar in recent months is the Supreme Court’s decision to overturn the long-standing doctrine of Chevron deference, established by the Supreme Court’s 1984 decision in Chevron v. Natural Resources Defense Council.
This principle held that judges should defer to federal agencies’ reasonable interpretations of ambiguous statutes. In other words, when Congress passes a law with unclear provisions, Chevron deference says that it’s up to the federal agency tasked with enforcing the law to fill in any gaps in interpretation.
Between 1984 and 2024, Chevron was cited in over 19,000 cases, becoming a linchpin in administrative law. Yet it was also hotly debated: Supporters said it gave agencies the flexibility to quickly tackle emerging problems with their unique expertise; detractors, meanwhile, saw it as a key contributor to executive overreach and agency politicization. Last July, the detractors won a major victory when, in Loper Bright Enterprises v. Raimondo, the Supreme Court overturned Chevron, paving the way for a significant overhaul of administrative power.
The impact on digital advertising
There are a few key ways that the Supreme Court’s decision to overturn Chevron could alter the digital ads industry. First, it could push privacy regulation further to the states, leading to increased fragmentation and complexity.
It could also impact the Federal Trade Commission’s (FTC) ability to enforce violations of its privacy regulations. And, finally, it could complicate the passing and enforcing of a federal privacy law. To understand these impacts, consider how the FTC enforces privacy today.
In the absence of a comprehensive federal privacy law in the US, the FTC gets its authority from several statutes, including the Children’s Online Privacy Protection Act, or COPPA, which restricts the online collection and use of data from children under 13; the Health Breach Notification Rule, or HBNR, which governs the unauthorized disclosure of health information by certain entities; and Section 5 of the Federal Trade Commission Act, which prohibits “unfair or deceptive acts or practices.”
In recent years, the FTC has interpreted these legacy laws – each enacted well before modern digital privacy concerns took shape – to cover new, often complex areas of privacy. In doing so, it has taken a particular interest in ad tech. In just the past year, the FTC has:
- Finalized a plan to expand the scope of COPPA
- Signaled upcoming challenges to contextual advertising practices
- Stated that web browsing history, television viewing history and location information should be considered sensitive data
- Expanded its definition of health data and the scope of HBNR to cover a wide range of health services and information providers
- Decried social media and video streaming platforms for engaging in “vast surveillance” of consumers
- Emphasized that hashing data does not anonymize it
- Argued that ad tech’s self-regulatory organizations risk falling into “irrelevance” if they do not evolve to meet regulatory expectations
- Expressed that even long-standing uses of artificial intelligence can fall within the FTC’s enforcement authority, and will be scrutinized
Many of these moves have sparked debate. Even within the FTC, senior leaders have voiced concerns that the agency may be stretching its interpretive authority.
Take incoming FTC chair Andrew Ferguson. Although he has been vocal about what he views as the FTC’s recent overreach, he has consistently voted in favor of privacy-related enforcement during his time on the commission. So don’t expect enforcement to slow down too much.
Still, now that Chevron is overturned, it will be easier for companies to challenge FTC regulations in court, arguing that they exceed the FTC’s mandate. Previously, the FTC only had to show a court that its interpretation of the law was reasonable. Now it will have to show that its interpretation is correct. That’s a much heavier burden, especially in courts that will be proliferating with Republican judges.
Chevron’s demise also makes passing a federal privacy law more difficult. To ensure they don’t become stuck in litigation limbo driven by ambiguity – often the friend of legislative compromise – lawmakers will need to draft any new law with painstaking precision to avoid years of court battles over the FTC’s interpretation of their words.
That’s no easy feat in our polarized environment, making it likely that privacy regulation and enforcement will continue to fall to the states.
Where do we go from here?
Even in the wake of these changes, as the perennial target of regulators, ad tech is slated to remain squarely in their crosshairs in the coming years. And between existing federal law and the 19 (and counting) unique state privacy laws on the books, those regulators will have a lot of arrows in their quivers.
All of this increases complexity, risk and signal loss across our ecosystem. But it also unlocks a unique opportunity to innovate, ushering in a new standard of digital privacy in ad tech. Now more than ever, it’s crucial to work with partners who stay ahead of the curve, embedding data ethics into their ethos to create solutions with lasting value in a privacy-centric world.
“Data-Driven Thinking” is written by members of the media community and contains fresh ideas on the digital revolution in media.
Follow OpenX and AdExchanger on LinkedIn.
For more articles featuring Julie Rooney, click here.
