The days of online ad industry self-regulation are well and truly over.
“It’s time to accept that we are a globally regulated industry, much like finance, energy and health care,” said IAB Tech Lab CEO Tony Katsur, speaking at a Tech Lab event about signal loss in New York City on Thursday.
In 2023 alone, seven US states passed their own comprehensive data privacy laws, and today there are 14 state privacy laws on the books in the US.
It’s time – or rather past due – to start prioritizing compliance.
State of play
Five US state privacy laws are already in effect: California, Colorado, Connecticut, Utah and Virginia. Three others will become enforceable later this year: Oregon and Texas in July and Montana in October.
Meanwhile, Delaware, Iowa, New Jersey, New Hampshire and Tennessee will hit next year, followed by Indiana in 2026.
There are also 18 states with active bills in the works, not all of which will end up getting signed into law. But you can bet your boots that some of them will, which means the US might have nearly 20 state privacy laws, all with their own nuances, in the relatively near future.
A compliance state of mind
Beyond guaranteeing job security for privacy lawyers and other privacy professionals, this veritable tsunami of data privacy laws is spurring a lot of activity within Tech Lab working groups.
Developing technical standards and frameworks for privacy compliance is a Tech Lab priority, Katsur said.
The three biggies are the Tech Lab’s Data Deletion Request Framework, the Accountability Platform and the Global Privacy Platform (GPP).
The GPP launched back in 2022. In a mixture of English and jargonese, it’s an API for transmitting choice signals across the supply chain. The mechanism is designed to serve as an easy button of sorts for compliantly passing consent in multiple countries and jurisdictions.
The platform currently supports consent strings from Europe and Canada (through their respective Transparency and Consent Frameworks) and signals from five US states (California, Colorado, Connecticut, Utah and Virginia). As part of its 2024 road map, the Tech Lab plans to add several more US states, India and Brazil.
Next up, the Tech Lab’s Accountability Platform is a standard framework for buyers, sellers and ad tech vendors to audit their partners and make sure they’re honoring consent signals throughout the ad supply chain.
The public comment period on the Accountability Platform ended on Feb. 27, and the Tech Lab expects to release the final spec in Q2.
But there is still a little time to comment on the Data Deletion Request Framework, which is a standardized protocol for managing and honoring data deletion requests.
In addition to propagating these requests through the supply chain, the framework uses JSON web tokens to make sure the data transmissions are secure and the deletion requests are authentic.
The comment period for the Delete Framework closes on April 22.
“Please provide us with feedback,” Katsur said. “It’s clear that privacy regulations are accelerating across the US at a very rapid pace – and this doesn’t even account for an active FTC, which has only magnified its focus on consumer privacy and the advertising industry.”
