Whenever a new privacy rule comes on the scene, people immediately look for a workaround. Virginia’s ban on the sale of precise geolocation data will be no exception; its narrow definition of a “sale” almost dares people to try.
“There’s a business person right now who doesn’t know my name, but we’ll be best friends by next year,” said Ashley Taylor, a partner at Troutman Pepper Locke, who leads the firm’s regulatory and investigations practice.
Taylor is referring to the cat-and-mouse game that will no doubt play out between state regulators and businesses that rely on location data as companies test how close they can get to the line without crossing it.
On July 1, through an amendment to the Virginia Consumer Data Protection Act, Virginia joined Connecticut, Maryland and Oregon to become the fourth state to ban the sale of precise geolocation data. But the law only applies when personal data is disclosed for “monetary consideration,” raising obvious questions about data that’s folded into partnerships, included in bundles or disclosed through other non-cash arrangements.
Taylor has seen companies try to get cute with definitions like that, both when he was a regulator and now in private practice.
Taylor was a deputy attorney general in Virginia in the late ’90s and early 2000s, working on the Tobacco Master Settlement Agreement – the landmark deal that reshaped how states regulate and extract penalties from the cigarette industry – and later leading some of the first big multistate data breach cases, including ChoicePoint.
Now, with his home state drawing a bright line around the sale of precise location data, Taylor expects Virginia’s law to function less like a narrow carve-out and more like a new arena for data brokers, ad tech companies and other folks looking to test the limits and find some wiggle room.
AdExchanger caught up with Taylor for a few hot takes.
On what counts as a data sale: “I think the initial position for a lot of companies will be, ‘If it’s not a money deal, it’s not a sale.’ But I’m anticipating a fight about what counts as value beyond ‘money.’ That’ll be the battleground, and the courts will be forced to interpret the meaning.”
On how Virginia is likely to enforce its new geolocation data ban (at first): “You’re going to see a lot of civil investigative demands that look more like questions. Early on, the posture will be, ‘We have a new law on the books. Show us how you’re complying.’ They’ll be in learning mode at first.”
On what companies can do to mitigate their regulatory risk in Virginia (and beyond): “I’d watch the AG’s office very closely. Read their official opinions and press releases and look at the language they use. That’s where you’ll see their priorities emerge.
“I’d also be highly sensitive to the first flurry of consumer complaints. And, if the AG reaches out to you, pay close attention to whatever they seem to be emphasizing. And remember, when you’re approached, don’t immediately misconstrue contact as an allegation. Be transparent and very responsive, because it’s an opportunity to educate before things turn adversarial.”
On why this isn’t just a Virginia thing: “Because most individual states can’t afford to be fully staffed with experts, we’ve seen certain states become centers of excellence for particular things.
“For privacy, it’s Illinois, Massachusetts, California and Indiana. When a complaint comes into a state AG’s office that doesn’t have much experience in that area, the assistant AG literally picks up the phone or sends an email to one of those states and says, ‘Here’s what I’m seeing and here’s what I’m thinking.’
“That’s the informal way regulatory posture develops across the states. It happens offline, but then it emerges in enforcement.”
On what companies should know about how regulators operate: “Regulators are animated by consumer complaints. State AGs are elected and very close to the people. You go to the state fair, you speak at the Kiwanis club, and real people walk up to you and say, ‘Here is my problem, here’s what happened to me.’ That’s how policy and priorities get formed.
“Every case I’ve worked on in 20-plus years can be sourced back to a consumer complaint, often something small that just wasn’t handled properly, and it’s what starts the ball rolling.”
Answers have been lightly edited and condensed.
🙏 Thanks for reading! And since we’re on the topic of location data and tracking, do you remember the woman in Ireland who put a GPS collar on her cat so she could see its movements throughout the neighborhood?
As always, feel free to drop me a line at allison@adexchanger.com with any comments or feedback. 📌 Oh! And don’t forget to save the date for Programmatic IO New York, taking place on September 28th and 29th at the New York Marriott Marquis. Snag your ticket, and I’ll see you there.
