Interactive Advertising Bureau CEO David Cohen has drawn pushback from Capitol Hill and the advertising community for some tough talk about privacy at IAB’s annual leadership conference last week, with a couple of major ad association’s taking part of the blame for the current problems and suggesting it was time for the industry to clean up its own messes and do better going forward.

Cohen told Next TV that his goal was to unite, not divide.

According to one attendee, talk on stage at the conference included: “I’m not going to talk about privacy. Because privacy is boring, it makes our eyes glaze over.”

IAB says that, if so, Cohen did not say it. But his speech was filled with red meat on the issue, according to a copy.

"Extremists are winning the battle for hearts and minds in Washington D.C. and beyond. We cannot let that happen," he said. "These extremists are political opportunists who’ve made it their mission to cripple the advertising industry and eliminate it from the American economy and culture."

And he named some Capitol Hill names. "Washington D.C. leaders including [Sen.] Amy Klobuchar  [D-Minn.]and [Sen.] Ted Cruz [R-Tex.] will throw our industry under their campaign buses, if we let them," he said.

Cohen also took aim at one of the biggest tech platform players. "We must all be in this together. If we can’t fix the rotting at our core, we won’t survive. While there are no shortage of extremists attacking our industry from the outside, there are some attacking it from the inside out. Most notably, Apple exemplifies the cynicism and hypocrisy that underpins the prevailing extremist view."

Online privacy is a big issue in D.C. and elsewhere. The Federal Trade Commission is looking to crack down on “surveillance advertising,“ while there are several efforts in Congress to pass legislation cracking down on data collection and targeted marketing — all efforts that IAB, representing Big Tech's biggest online platforms, has strongly opposed. Cohen doubled down on that opposition in his conference keynote by calling those behind the privacy efforts, which include some powerful legislators, radicals and extremists, according to Politico Pro.

Also: Bill Allows For ‘Turning Off’ Targeted Marketing

On Tuesday (January 31), the American Association of Advertising Agencies (the 4A’s) and the Association of National Advertisers tried to distance themselves from Cohen’s remarks.

“The 4A’s and ANA reject the acerbic tone, texture and prescriptions offered by the IAB at their recent ALM conference,” the statement read. “Our industry was built on a foundation of responsible marketing. While we, as an industry, may not always get it right, we do know when we must lead to restore balance — especially when we have created the conditions for our industry to be ‘out of balance.’ ”

ANA and the 4A’s, neither of which is a big fan of government regulation of the advertising marketplace, called Cohen’s speech a “tirade against the forces that disagree with our industry” and put some of the blame for the current ad issues on their own industry.

Also: IAB Calls Privacy Legislation Biggest Threat to Addressability

“Many of the problems that the IAB cited were because of an imbalanced industry that we all created and supported with our advertising investments,” the statement said. “Did we ever utter the issues of ‘brand safety’ or ‘digital ad fraud’ 10 years ago? Of course not. But it is time for our industry to clean up its messes and present a far more responsible approach to address the issues that are prevalent in our industry.”

IAB has said it supports national privacy legislation, just not the brand currently being pushed or what it labels “ill-considered regulatory regimes.” 

Cohen said in an emailed statement addressing the pushback that he was not out to put anyone down for working towards the shared goal of privacy protection.

“Rather than be divisive, the goal of my opening keynote was to rally the industry and instill a sense of urgency so that we can work together to build a healthy and sustainable ad-supported digital industry," he said. "It was also to accurately reflect the interests of our members which now include all sides of the digital ecosystem.

"We have deep respect for Congress and appreciate all the work going towards national privacy reform,“ he said. ”However, we need to recognize that there is a perception issue that we need to overcome. The negativity around the technology sector fueled by select viewpoints has the potential to adversely impact us all. The industry must all work collaboratively to ensure we get a rational and sound national policy on data use. We look forward to working with legislators and regulators as well as the ANA, 4A’s and others over the coming months to develop solutions that work for all constituents: consumers, regulators, and industry.” ■

The Interactive Advertising Bureau’s IAB Tech Lab has unveiled the Global Privacy Platform (GPP) to standardize U.S. and global privacy preferences for digital ads and wants input on the plan.

Getting the privacy part of targeted advertising right could be crucial to the continued health of what has been a booming online ad market. Statista.com predicted that digital ad spending in the U.S. alone will top $200 billion by 2025.

The fruits of Protect Rearc and two years in the making, the GPP is a single protocol for transmitting privacy, consent and consumer-choice preferences from websites and apps to advertising tech providers. The idea is to mitigate privacy risks and square those protections with Europe’s Transparency and Consent regime and the California Privacy Rights Act (CPRA) — the U.S. has no national privacy framework, but one of the reasons for coming up with GPP is the threat of a balkanized system of differing state (and international) approaches.

“Regulations are hitting the books faster than we can build individual solutions for,” said Andrea Giannangelo, CEO of Iubenda, which provides privacy compliance services.

“Privacy regulations such as the GDPR, CCPA, CPRA, PIPEDA and numerous new local privacy laws, create immense complexity and fragmentation in the market," IAB Tech Lab senior director Jason Raqueno said. "The GPP is intended to enable participants across the advertising supply chain to navigate the complexity of numerous overlapping global privacy laws through a single platform and consent signaling protocol."

Rearc was launched in 2020 in response to the limitations of third-party cookies and other targeted ad identifiers.

Also: IAB Says National Privacy Regime Is Job One

According to IAB Tech Lab, which is the digital ad industry’s standard-setting body, the GPP “enables advertisers, publishers, and technology vendors in the digital advertising industry to adapt to regulatory demands across markets," cuts the cost of managing privacy compliance, and helps reduce risk by "a single framework to encode and transmit consumer privacy preferences, which they can leverage globally and across all platforms and channels.”

IAB Tech Lab CEO Anthony Katsur said the GPP is ready for global adoption, but IAB is first seeking comment (it will give interested parties 60 days). IAB is looking for input from “publishers, brands, media companies and legislative officials.” ■

Facebook whistleblower Frances Haugen will be among the guests in First Lady Jill Biden’s box for the State of the Union speech Tuesday night (March 1), giving credence to reports President Joe Biden plans to address Big Tech-related issues in the speech, specifically online child protection.

Also: SOTU to Include Call for Banning Certain Child-Targetted Online Ads

“Each of these individuals, with their resilience, innovation, service, and courage, were chosen by the White House because they represent policies or themes to be addressed by the president in his speech,” the White House said in releasing the list of attendees.

Haugen created quite a stir last November on Capitol Hill with testimony in which she revealed internal Facebook research showing the company knew its Instagram platform could be harmful to some teens. Facebook countered that the research also showed that most teens said it was helpful and that the information on those who said otherwise was useful feedback for potential changes to the platform to address that concern.

Legislators were unconvinced and have pushed various bills to rein in Big Tech. ■

President Joe Biden is expected Tuesday (March 1) to call for a ban on online ads targeted to children and other measures billed as meant to better protect children online.

That‘s according to the office of Sen. Ed Markey (D-Mass.), who has been pushing for those protections, and comes on the same day the House Energy & Commerce Committee is holding its third hearing on holding Big Tech accountable, which includes consideration of a bill that would generally ban certain types of targeted online advertising.

That expectation appeared to be confirmed after the White House announced that Facebook whistleblower Frances Haugen was named as a guest in the First Lady's box for the State of the Union speech in which the President is expected to make that call out.

Also: Senators Call on FTC to Protect Kids Online

The caveat is that the president’s speech was being recrafted Tuesday to center more on Russia‘s invasion of Ukraine, according to various reports. The bulk of the speech, though, is still expected to be about “bread and butter” issues, according to CNN, including broadband issues, given the administration's push for closing the digital divide and getting the internet into every home.

According to Markey‘s office, Biden’s address is expected to include a call to Congress to “strengthen privacy protections, ban targeted advertising to children, demand technology companies stop collecting personal data on our children and stop discriminatory algorithmic decision-making for young people.”

That basically tracks with Markey’s proposed update of his Children's Online Privacy Protection Act (COPPA).

Currently, COPPA, which Markey motormanned, prohibits websites from collecting personal information from anyone 12 and under without consent. The new bill, the Children and Teens' Online Privacy Protection Act, would extend that protection to teens 13-15.

It would also create the “eraser button” that Markey has been pushing for years, requiring online companies to allow users to eliminate personal information from a child or teen.

In addition to banning advertising targeted to children (as distinguished from contextual advertising in content targeted to children), the legislative update aslo creates a “digital marketing bill of rights,” which limits the collection of personal information from teens for marketing purposes. And to make sure that the limits are respected, it creates a Youth Privacy and Marketing Division at the Federal Trade Commission.

In addition, the bill would:

1.) Change COPPA’s “actual knowledge” standard to a “constructive knowledge” standard, which means websites “should reasonably know” children are on their sites and they need to get consent to collect data.

2.) Require online companies to explain what personal information is being collected, how it is being used and to disclose their collection policies.

3.) Require that internet-connected devices for kids have robust cybersecurity.

4.) Require manufacturers of connected devices targetd to kids and minors to include on their packaging disclosures of how information is collected, transmitted, retained, used and protected. ■

Advertisers, edge providers and legislators are giving the Federal Trade Commission an earful over a petition by Accountable Tech to ban so-called surveillance online advertising as anti-competitive “unfair competition.”

That includes claims by advertisers that granting the petition would imperil trillions of dollars in U.S. gross domestic product.

By “surveillance,” Accountable Tech means ads based on tracking and profiling data that allows the hyper-targeted ads that sponsors point out are part of the ad-based model of free online content.

In comments to the FTC about the petition, the Association of National Advertisers said banning data-driven targeted ads would “stifle” internet-based advertising, threatening “trillions of dollars” in economic activity. That is based on the fact that the Internet economy contributed $2.45 trillion of the U.S. $21.18 trillion GDP, said ANA.

A ban would mean “a swift decrease in the availability of accessible information for consumers, cripple the economy and disproportionately impact small and midsize businesses,” ANA told the FTC.

The Interactive Advertising Bureau (IAB) called the ban petition “baseless,” and discounted it as “a self-interested stunt manufactured by competitors” seeking to “declare the commercial internet itself an unfair business practice." Accountable Tech does not identify its backers.

IAB CEO David Cohen said data use and customized ads predate the internet, and simply banning them "would be a devastating blow to jobs, economic growth and innovation.”

Taking the other side, Democratic Rep. Anna Eshoo (D-Calif.) and Sen. Cory Booker (D-N.J.) told the FCC that they support the petition, branding such ads as “the internet’s Original Sin” and a “time bomb” along the lines of the subprime mortgage crisis. 

“The surveillance advertising business model is premised on the unseemly collection and hoarding of personal data to enable ad targeting,” they told the agency. “Companies collect huge amounts of data to maximize user engagement because it increases ad revenue. The FTC should evaluate the harms to society and individuals, as we believe they vastly outweigh the benefits.”

They were hardly alone in advocating for the FTC to step into the online advertising space.

“[S]urveillance on such a scale represents an unprecedented interference with the right to privacy that cannot be compatible with the companies’ responsibility to respect human rights,” said Amnesty International.

“[T]he benefits of surveillance advertising do not outweigh the harms, since relevant ads can be delivered to consumers in a much less privacy-intrusive manner through contextual advertising,” the Consumer Federation of America said.

“As noted in Accountable Tech’s petition, surveillance advertising causes serious harm to both the market and individuals,” Public Knowledge said. “The commission’s dual role as both a competition agency and a consumer-protection agency make it the ideal administrative body to promulgate rules to curb abusive practices by the online advertising ecosystem.”

Lawmakers Weigh In

The issue is also playing out on the legislative front.

A bill was introduced two weeks ago, the Banning Surveillance Advertising Act, that would ban the use of personal information to target most online advertising.

The bill was introduced by Eshoo and Booker along with Rep. Jan Schakowsky (D-Ill.). IAB said of the bill last week that the sponsors must not understand the degree to which the bill would “effectively eliminate internet advertising in the United States, jeopardizing an estimated 17 million jobs primarily at small- and medium-sized businesses.” ■

Rep. Anna Eshoo (D-Calif.), longtime member of the House Energy & Commerce Committee, is asking the Democrat-controlled panel to subpoena documents from Facebook.

That call comes following a hearing in the Senate Commerce Committee during which Facebook whistleblower Frances Haugen, armed with internal research, said the company puts profit over the mental health of its users, and knows it is doing so.

“Frances Haugen courageously exposed what we've long suspected: Facebook has known the harm caused by their platform and has done nothing about it,” Eshoo said. “The Energy and Commerce Committee must subpoena all documents from Facebook related to Ms. Haugen's testimony and her SEC whistleblower complaints, particularly those related to the mental health of children, COVID-19, election misinformation, algorithmic amplification and targeted advertising. Ms. Haugen’s disclosures are highly instructive to our legislative process and any frivolous lawsuits or other retaliation against her would be highly problematic.”

Senate Consumer Protection, Product Safety and Data Protection Subcommittee chairman Richard Blumenthal (D-Conn.) also said at the hearing that his committee would do all it could to prevent any retaliation against Haugen. Facebook has said she only worked for the company briefly and not on the issues — the protection of young people online — before the committee.

Facebook whistleblower Frances Haugen, whose last job at the social media company was working on the counterespionage team, may have opened up a new front in Congress’s war on the social platform.

That came during a hearing in the Senate Subcommittee on Consumer Protection, Product Safety and Data Security, where she was testifying on children's online safety and the alleged lack of it when it came to Facebook.

She was explaining that among the things she looked at was China’s tracking and surveillance using the platform and Iran’s tracking of other state actors. She said Facebook’s “consistent” understaffing of their counterespionage information operations and counterterrorism was a national security threat.

She said she was already speaking with “other parts of Congress” about it.

That got the immediate attention of Sen. Dan Sullivan (R-Alaska), a member of the Armed Services Committee, who asked whether she was saying that whether Facebook knew it or not it was being used by the country's adversaries “to push and promote their interests at the expense of America’s.”

Haugen said that Facebook was “very aware” that it was happening and the fact that Congress does not get a report from the company on how many people are working on the issue internally is "unacceptable." She told the committee she had “strong national security concerns” about how Facebook operates.

Subcommittee chairman Richard Blumenthal (D-Conn.) told Haugen, “you may have just opened an area for another hearing.” He said “we may want to discuss this issue,” at least informally and possibly for another hearing, which Sullivan definitely supported.

The Federal Trade Commission is being asked to use rulemaking authority to protect privacy, cybersecurity and civil rights.

That tall order comes from Capitol Hill, where federal privacy legislation has proved a hill too high for Democrats and Republicans to help themselves and the country surmount.

Nine Democratic senators are calling on the commission to fight back against what they said is “Big Tech’s unimpeded access and abuse of consumers’ private information, anti-competitive behavior and data breaches, as well as alarm over rising discrimination using personal data that undermine civil rights.”

They argue that privacy has become a consumer crisis and while Congress has failed to come up with a national standard via legislation, lawmakers are calling on the FTC to do what it can in parallel with that ongoing Hill effort to protect consumer privacy using every tool in the regulator’s toolkit.

Also Read: FTC Boosts Big Tech Regulatory Profile

The FTC's tools have generally been to file lawsuits or settle suits over unfair and deceptive practices, but the commissioners do have some rulemaking authority.

The senators want the FTC to launch a rulemaking looking at, among other things, “the banning of exploitative targeting of children and teens and other specific practices, implementing opt-in consent rules on the use of personal data and global opt-out standards.”

The debate over opt-in vs. opt-out data collection regimes has been arguably the biggest sticking point between Republican and Democratic approaches, as well as what qualifies as the sensitive personal information in need of the most protection. But as Big Tech has been more in the sights of lawmakers on both sides of the aisle, there could be more common ground on Capitol Hill when it comes to privacy protections.

Signing the letter were Sens. Brian Schatz (D-Hawaii), Ron Wyden (D-Ore.), Elizabeth Warren (D-Mass.), Chris Coons (D-Del.), Ben Ray Luján (D-N.M.), Amy Klobuchar (D-Minn.), Cory Booker (D-N.J.) and Ed Markey (D-Mass.).

The letter comes only days after President Joe Biden nominated privacy advocate Alvaro Bedoya to a seat on the commission. 

Bedoya was the first chief counsel to the Senate Judiciary Subcommittee on Privacy, Technology and the Law, which oversees Big Tech.

Sen. Ed Markey (D-Mass.), joined by Sen. Bill Cassidy (R-La.), has renewed his effort to extend the reach of his child online protection law to young teens.

Currently, the Children's Online Privacy Protection Act (COPPA), which Markey motormanned, prohibits websites from collecting personal information from anyone 12 and under without consent. The new bill, the Children and Teens' Online Privacy Protection Act, would extend that protection to teens 13-15.

It would also create the "eraser button" Markey has been pushing for years, which would require online companies to allow users to eliminate personal information from a child or teen.

The bill creates a "digital marketing bill of rights" as well, which limits the collection of personal information from teens for marketing purposes. And to make sure that the limits are respected, it creates a Youth Privacy and Marketing Division at the Federal Trade Commission.

Also Read: Senate Commerce Tees Up Federal Privacy Bills

But wait, there's more — a lot more — including:

1. Ban advertising targeted to kids (as distinguished from contextual advertising in content targeted to children.
2. Change COPPA's "actual knowledge" standard to a "constructive knowledge" standard, which means websites "should reasonably know" that children are on their sites and they need to get consent to collect data.
3. Requires online companies to explain what personal information is being collected, how it is being used and disclosed and their collection policies.
4. Require that internet-connected devices for kids have robust cybersecurity.
5. Require manufacturers of connected devices targetd to kids and minors to include on their packaging disclosures of how information is collected, transmitted, retained, used and protected.

Also Read: Senators Seek Major Investigation of Kids Data Collection

“The Children and Teens’ Online Privacy Protection Act rightly recognizes that the internet's prevailing business model is harmful to young people,” said Josh Golin, executive director, Campaign for Commercial-Free Children. “The bill's strict limits on how kids' data can be collected, stored, and used — and its all-out ban on targeted ads for children under 13 — would give children a chance to develop a healthy relationship with media without being ensnared by Big Tech’s surveillance and marketing apparatuses. 

"We commend Senators Markey and Cassidy for introducing this landmark legislation and urge Congress to act quickly to put children’s needs ahead of commercial interests,” Golin added.

Dave Grimaldi, former chief of staff to Federal Communications Commission member Mignon Clyburn and senior counsel to her father, House Majority Whip James Clyburn (D-S.C.), heads up advocacy before Congress and federal agencies for the Interactive Advertising Bureau, which represents some of the largest publishers and platforms in the world.

Grimaldi, executive VP of public affairs for IAB, talked with Multichannel News about the potential new challenges to online advertising from Washington and state and local governments as President Donald Trump targets social media for regulation, states look for new ways to compensate for the economic sledgehammer of a global pandemic, and the nation — including IAB’s roster — looks to protect consumer privacy. Here’s an edited transcript of that conversation. 

MCN: Remind us who your members are?

Dave Grimaldi: Mostly publishers but also platforms, including The Washington Post, The New York Times, Google, NBC and Disney.

MCN: Why are IAB and the other major ad associations concerned about a California product-liability law currently in the legislature that makes advertisers liable if a product is deemed defective? 

DG: When you talk about strict liability for advertising, you could have a gardening blog running ads on your site and if one is an ad for a can of Coke or Sprite and the can explodes, all of a sudden this gardening blog could be liable for putting that can of Coke into commerce. [The liability bill applies to businesses “facilitating the placement of products into the stream of commerce.”]

This impacts small to midsized businesses monetizing their content. It is another example of a law that neither consumers nor American businesses know is coming.

We appreciate consumer protections, but this goes too far. This liability piece is absolutely unprecedented. The economy is already getting walloped by COVID-19. 

MCN: So what can be done about it?

DG: This is my main theme and I will say it 100 times: We need a national federal [privacy] framework to put these things through regular order and due process and the debate that is necessary.

MCN: What are some other threats out there? 

DG: We are seeing other out-of-nowhere emerging threats in the form of state and local advertising taxes that are put in city budgets. COVID has decimated city and state revenues. We are going to see it over and over again because it is a low-hanging piece of fruit.

MCN: What is the status of the California Consumer Privacy Act or CCPA?

DG: The final regs were just approved a few weeks ago and enforcement just began. But this November there is going to be a substantially new ballot initiative, the CPRA [the California Privacy Rights Act], that will amend the language of CCPA and require additional rulemakings.

The CPRA ballot initiative was introduced by Alastair MacTaggart [board chair of Californians for Consumer Privacy], the same real-estate developer who came up with the CCPA. I give him credit for his tenacity and his creativity and doggedness and identifying that California’s ballot initiative rules opened the door to CCPA. And now the CPRA is going to add a new layer to CCPA and the burden will fall on consumers to understand.

MCN: Is that why IAB says there needs to be a national privacy regime?

DG: We need a law that lays down clear rules of the road, that lays out prohibited and allowed data practices, and that is the draft bill that we gave to Congress. The notice and consent regime is broken. No one understands it. It is not easy on consumers to navigate.

MCN: But as a practical matter, nothing is going to happen on privacy legislation in the near term with an election coming up, correct? 

DG: What happens on Nov. 3, especially in the Senate [which is currently in Republican hands], is going to mean a great deal for online advertising and for consumer privacy writ large. You have extremely knowledgeable Democrats who are eager for a gavel to do antitrust oversight and anything to do with data brokers regarding privacy, the use of personal information and the guardrails around all of the above. 

That is not to say that the Republicans aren’t doing this, but you have progessive Democrats who are very fired up. So, if the Senate goes Democratic, I think that online data privacy will be a top-three issue for the Senate Commerce Committee. 

If Joe Biden wins the White House, then you have Democrats in the White House and controlling the Senate and House, and you could see significant overhauls. And that is what we want.

MCN: So significant privacy legislation is good for IAB?

DG: Yes, a national privacy law that pre-empts a patchwork of state bills that consumers are going to have to navigate. When they get on the plane at LaGuardia [Airport] and they get off the plane at LAX, they are not going to have to face new user-experience windows, they are not going to have to face privacy controls that have to be changed state by state. So, yes. 

I don’t know how urgently or how fast national privacy reform will come, but it will come. 

I think there is an open question on whether if Joe Biden wins he installs a privacy czar in the White House. Does he create a CFPB [Consumer Financial Protection Bureau]-like agency to tackle consumer data? What happens with antitrust? What happens with the use of market power? All of these are good questions. We have 600 members and it affects all of them. 

MCN: What is IAB’s take on the president’s attempts to regulate online content and modify Section 230 of the Communications Decency Act?

DG: Section 230 has played a role in the Internet that everyone knows and loves and it has given rise to platforms that every American is using every day. The discussion around additional improvements that can be made is a good one. But it should be a deliberative process and not an executive order. 

Section 230 was passed by Congress. It should be amended and debated at the committee level, with witnesses and testimony, and in both Houses of Congress on the floor, with buy-in from industries. It has gotten mired in politics and a sexy election year debate and the events surrounding it aren’t without real harm and real drama based on speech, and there are opinions on both sides around how a free online town hall works. Should there be policing of it? Who should be the arbiters of what is dangerous or not? All of these platforms that are protected by Section 230 are taking this extremely seriously and wrestling with their decisions.

But if change comes, it should come through Congress and the deliberative process, not executive order. I’m a Democrat and I would say that in a Democratic administration also.

MCN: What other big issues are on the horizon?

DG: If 2020 was the year of privacy, 2021 is not only the year of privacy but of the online economy generally. There was a love affair for eight years between the Obama Administ­ration and Silicon Valley, and it all changed in 2016 with Russian interference and Cambridge Analytica and everything else. A dark cloud moved in over the use of online data and that cloud has been parked there ever since. It has gotten conflated with Section 230 and with apps knowing where you are night and day. It has turned into rampant demagoguery around an industry that is a massive piece of the national economy. 

If you know what this is, great. If you don’t, you are going to hate me because you are never not going to see it. But there is a little blue triangle in the corner of every single ad that is served on the internet; you click it and it lets you know why you were shown that ad and it shows you how to turn it off. We created that because people wanted transparency.

We are not against greater scrutiny. We expected that and we welcome that. We are calling for regulation and it’s not often that an industry does that. There is a referendum on the use of online advertising and we have been proactive. But the focus on consent is misplaced and it does not address the underlying concerns from lawmakers and consumers.

There are things like stalking and the use of geolocation and 911 data that have real-world ramifications, but those are apart from how personal ads have an impact on your life. 

If you are a soccer player and there are ads for new cleats or balls when you are reading an article, people prefer those to generic ads. The issues around how data is used is a debate that we want. 

WASHINGTON — Advertisers are pushing for a national privacy bill, but with little chance of comprehensive legislation in the near term, they are pushing back on efforts by states to push for privacy legislation. State-level laws, they argue, are a Balkanized approach that could boost the power of the Big Tech players that both states and the federal government are looking to rein in.

Dan Jaffe, group executive vice president of government relations for the Association of National Advertisers, has been a point man in this pushback, notably against the California Consumer Privacy Act (CCPA). The CCPA becomes law on Jan. 1 and compliance will cost businesses billions — that is, when they can figure out what to comply with, which Jaffe said remains a moving target.

Jaffe spoke with Multichannel News about the implications of privacy by design, if that design is a patchwork of state approaches. Here’s an edited transcript of that conversation.

MCN: What are ANA’s main problems with the California Consumer Privacy Act?
Dan Jaffe: At the most fundamental level, it is that it is a single state law. We don’t think that privacy rules work on a state-by-state basis. The business has already gone through a substantial amount of fragmentation and that is only going to increase in 2020 unless there is a federal law passed that pre-empts state laws.

MCN: You say “laws,” so clearly the problem isn’t just California.
DJ: Let me give you the quick list of what I know, and I may not be covering everything. There is CCPA, as well as a [California] data-broker registration bill that is not the same as a Vermont databroker bill. Nevada’s new law goes into effect today [Sept. 30]. Maine has an ISP law and New Jersey has a major piece of privacy legislation with private-rights-of-action provisions in it. The attorney general of Ohio is talking about holding privacy hearings. … You get the general gist.

Overlaying all of this is the [European Union’s] General Data Protection Rules [which apply to any business over a certain size doing business in the EU, just as the CCPA applies to any business over a certain size doing business in the state].

I know a number of companies who have spent multi, multimillions of dollars to become GDPR compliant and are now spending millions on becoming CCPA compliant because of the differences in definitions.

MCN: Speaking of big money, the California attorney general’s office has put out a regulatory impact statement. What trouble signs are in that report?
DJ: I have said since the outset that this was going to be a major tax on California consumers because I could see there were going to be major regulatory compliance requirements. Now the attorney general’s report is talking about as much as $55 billion dollars in costs from the CCPA, and a further $16.9 billion in costs for compliance with the attorney general’s [rules].

I don’t want to be hyperventilating here, but the report says this is going to fall particularly hard on small business. Because of the way the act is designed, a relatively large number of relatively small businesses will be covered.

Big companies are going to be able to do well in this situation because they have compliance lawyers and IT experts and advertising experts. Companies midsize and below are going to have a very much harder time — and that is if everything goes smoothly.

Now, people may say that the privacy protections people have gotten outweigh all of these costs. I don’t necessarily think that that’s true.

MCN: Obviously, you don’t want this Balkanized model, but if it develops, is the free web content model sustainable?
DJ: For some, yes. The Tyrannosaurus Rexes survive, at least in the short run. But I don’t know how Google and Amazon and all these other companies that started out in garages and dorm rooms would have done if they had faced all these restrictions.

MCN: But an already divided Congress fighting over impeachment is unlikely to come together on privacy legislation anytime soon.
DJ: To pass any major legislation when they don’t like each other and they don’t work well together is very hard. I don’t know what’s possible. I just know what’s needed. We are going to make every effort to move [federal legislation] as far and as fast as we can. There is nothing more important that we are working on than privacy and data security issues.

A very large proportion of companies will say the same thing. And the situation is only going to get more difficult because there are 22 more states that seriously considered privacy legislation in 2019.

Unlike data security, where disparate laws still deal with a limited set of issues and, if you are complying with those requirements, you are likely complying with most data-security laws, this isn’t the case with privacy. It has a large range of issues over billions and billions of transactions and an enormous number of parties from first parties to third parties to data suppliers to data trackers to publishers.

MCN: So the answer is national legislation.
DJ: Yes, and for the first time the industry is not split on that. I don’t hear anybody say, “Oh, we don’t need national legislation.”

One more thing, and this I think is a grenade that has been thrown into the process. Before the law takes effect and even before the attorney general has finished his rulemaking, Alastair Mactaggart [the California resident who pushed for the initial ballot initiative] is putting forward a new ballot initiative that will completely alter and add to the existing [CCPA]. We are in a never-ending compliance race. To use a legal term: It’s a mess, and it’s likely to get messier.

"In spite of growing bipartisan momentum in Washington and among technology companies about the need to act, the absence of a single federal privacy policy has encouraged states and international governing bodies to fill the vacuum and effectively dictate how Americans operate online." -Jonathan Spalter, USTelecom

Whether or not Congress flips blue or remains red after the election, there is a purple issue the next Congress must immediately tackle. It is bipartisan, affects America’s global leadership, and is a priority for every consumer who uses the internet: digital privacy.

In our hyper-connected digital lives, consumers across the political spectrum expect and demand strong internet privacy protections. Internet users should be certain that sharing images, exchanging messages, visiting websites, engaging in commerce and sending sensitive data are the types of acts the entire internet ecosystem is obligated to respect and protect.

We agree.

America’s innovative broadband providers are united by the principle that digital privacy is sacred and government has a role in ensuring that consumers can both confidently use the internet and maintain their privacy to the degree that they are comfortable.

In spite of growing bipartisan momentum in Washington and among technology companies about the need to act, the absence of a single federal privacy policy has encouraged states and international governing bodies to fill the vacuum and effectively dictate how Americans operate online.

Unless Congress steps up on privacy, others are going to keep stepping in with well-meaning but counterproductive privacy plans.

The new California Consumer Privacy Act (CCPA), for example, gives consumers the right to prevent their personal information from being sold to third parties. This seemingly innocuous provision does not distinguish between sensitive and non-sensitive information and could impact how consumers receive online advertising or valuable discounts associated with store rewards programs.

The European Union’s General Data Protection Regulation (GDPR) includes a similarly expansive definition of personal information and makes consent to use or share information more difficult to obtain.

These first-mover laws have made constructive contributions to the privacy conversation and deserve credit for responding to mounting consumer concerns. But at the end of the day these patchwork approaches risk creating consumer “confusion” in the name of consumer “protection” and turns the EU, or a single state, into the de facto regulator of digital privacy in the United States.

Instead, all players in our internet economy should be working together to avoid further policy fragmentation and build on the strengths of existing approaches to develop our own comprehensive, unified privacy blueprint that puts consumers first, builds digital trust and applies to all companies interacting with individuals on the internet.

Congress should lead that effort by developing a framework with privacy principles that include: effective security, ample consumer choice and flexibility, and reliable notifications when breaches occur – also applied uniformly to all companies operating on the internet. This framework should have mechanisms that are interoperable with existing multinational privacy regimes.

We know the ones and zeroes of our digital infrastructure are neither red nor blue. From our largest global enterprises to our smallest digital entities, millions of consumers are counting on Congress – regardless of who wins the midterms – to come together to develop a pro-investment and pro-innovation privacy plan that delivers peace of mind to consumers.

Our companies are committed to doing our part to shore up digital trust and give Americans the confidence that no matter what platform, device or network they choose, guardrails will be in place to protect their digital privacy and support our growing and interdependent internet ecosystem.

Jonathan Spalter is the president and CEO of USTelecom, a telecommunications industry trade association representing broadband service providers, manufacturers and suppliers in the world of internet-based communications and entertainment.

Texas Republican Rep. Ted Poe is circulating a resolution in support of internet privacy, including requiring opt-in sharing of user info.

HR 1039, the Support Privacy on the Internet Resolution, encourages edge providers and ISPs alike to include data protection in their privacy policies.

Related: GOP Sens. Press Google on G-Mail Data Sharing

A resolution has no force of law, but is meant to be a prod to action.

“In recent months, the American people have stood by as our privacy is whittled away in the digital frontier, said Poe. “With a single click, the terms and conditions that we speedily read over strip away the right to privacy; privacy that is often assumed to be protected. Americans must be given the ability to 'opt-in' rather than 'opt-out' of data sharing practices by private companies. Internet companies and data service providers should adjust their policies to reflect this renewed sense of urgency for privacy and data protections." 

The resolution comes as Congress is taking a hard look at edge provider privacy in particular, driven in part by Facebook's sharing of user data with Cambridge Analytica.

The California state legislature's planned vote Friday (Sept. 15) on a bill, AB 375,  that mirrors the online privacy framework the FCC voted to adopt under FCC Chairman Tom Wheeler, but which was rolled back by Congress earlier this year via a Congressional Review Act resolution, has drawn a crowd and united edge providers and ISPs against its current iteration.

The bill, A.B. 375, has been the focus of much attention this week, including from critics painting it as a threat to privacy, rather than a benefit, and even the former chairman weighing in to offer his support.

In a letter to the chair of the California Assembly Committee on Privacy and Consumer Protection, Assemblymember Ed Chau, dated Wednesday (Sept. 13), Wheeler said he had read the final language of the amended bill and said it would "restore the privacy protections that Congress took away."

He urged the legislature to act decisively and other states would follow its lead to help recreate on a state level what congressional Republicans invalidated on a national level.

Meanwhile, some powerful studios, ISPs and edge providers are united in opposition to the bill in its amended form.

In its own letter to Chau and other legislators, a coalition of companies including Comcast, Charter, Google, Facebook and the Motion Picture Association of America, say the bill is vague and unclear to a degree that has serious effects on consumers and businesses," including a lack of clarity on who the bill covers.

The FCC privacy framework included requiring opt in permission to share information with third parties, but it was only targeted to ISPs. Edge providers do not want that requirement applied to them.

The coalition was suggested that the need for constant permission could inure Web surfers to dangers lurking within the Web. They said the bill "would lead to recurring pop-ups to consumers that would be desensitizing and give opportunities to hackers," adding: "The bill also prevents internet providers from using information they have long relied upon to prevent cybersecurity attacks and improve their service. Thus, the bill at once increases the likelihood of cyber threats while hamstringing businesses from fighting the same threats."

Online ads have appeared on various California political Web sites making the same case about the bill exposing Web users to pop-ups and hackers and desensitizing consumers as the coalition outlined in its letters. The ads click through to protectonlinesafety.com, which is simply a banner that asks them to call their legislator and tell them to vote no on the bill.

The add appears to play off recent cybersecurity breach's and protecting children to make an emotional case against the bill (see illustration).

Chau's Web site describes the bill this way, which certainly makes it sound like the same, ISP-focused framework Wheeler backed: "[It] ensures that consumers enjoy choice, transparency and security in the treatment of their personal information when accessing the Internet through an Internet Service Provider (ISP) by requiring opt-in consent from consumers in order to use, disclose or permit access to customer personal information. It also prohibits ISPs from charging a consumer a penalty, offering a discount, or refusing to provide service, based on the consumer’s opt-in decision, and requires that ISPs implement reasonable security measures to protect customer data and to notify affected customers of a security breach."

A copy of the amended bill was not available at press time.

WASHINGTON — The Federal Communications Commission has finally issued its lengthy statement  — plus scathing comments from the five commissioners — from last month's contentious decision regarding the Telephone Consumer Protection Act (TCPA) Omnibus Declaratory Ruling and Order.

Predictably, the final details, published last Friday (July 10), triggered even more critiques of the order, along with speculation as to how the restrictions will affect marketing, promotions and other outreach initiatives by media companies.

It also quickly triggered a court challenge. ACA International, an association of credit and collection professionals, on Friday filed a suit in the U.S. Court of Appeals for the D.C. Circuit seeking judicial review of the FCC's June 18 TCPA ruling.  Other organizations are expected to seek an overturn of the FCC's ruling, according to legal observers following the case.

Although much of the concern about automated calling — including text messages and phonecalls to mobile devices — has involved the financial-services and healthcare industries, many observers voiced concern about the extent of the FCC's ruling. Online service providers, entertainment companies, sports teams and social media networks have already been hit with lawsuits by consumers who claim they improperly received robocalls or other prohibited contacts.

In its almost 200-page ruling, the FCC noted, "We have not viewed 'legitimate' businesses as somehow exempt from the statute."  The agency said its goal is to “strengthen the core protections of the TCPA.” In the report, the FCC confirmed the notions that "Internet-to-phone text messages require consumer consent" and that “text messages are ‘calls’ subject to the TCPA.”

Each of the five FCC members issued a statement about the decision. 

“There is no legal reason carriers shouldn’t offer their customers popular robocall-blocking solutions,” chairman Tom Wheeler said.

FCC commissioner Jessica Rosenworcel, a Democrat, acknowledged “we have more work to do,” while the agency’s third Democrat, Mignon Clyburn, said, “The commission is striking a difficult-but-necessary balance with this item.”

The FCC's Republican members were far more verbose and hostile. Commission member Michael O’Rielly called the decision a "farce" that "penalizes businesses and institutions acting in good faith to reach their customers using modern technologies."

Commissioner Ajit Pai, in an extraordinarily long 12-page dissent, concluded that "the order is likely to leave the American consumer, not to mention American enterprise, worse off."  Pai insisted that the FCC's action "dramatically expands the TCPA’s reach."  He said that under the plan, "each and every smartphone, tablet, VoIP phone, calling app, texting app — pretty much any calling device or software-enabled feature" could become a target for a legal complaint.

Many analysts have pointed out that TCPA restrictions have opened the door to ambulance-chasing lawyers, who sue companies for perceived violations — often unintended or unknowingly — of the consumers' do-not-call preferences. 

Some individual TCPA lawsuits settlement may soon "break the $100 million barrier, according to Bradley M. Baglien, Heather Zachary and  D. Reed Freeman Jr. (all of the law firm Wilmer Cutler Pickering Hale and Dorr) in a Bloomberg Law analysis. In their paper, posted just before the FCC released its TCPA text, the attorneys warned that businesses "need to be vigilant about TCPA compliance."

“The commission’s TCPA decision will hurt legitimate businesses, seeking to provide consumers with the calls and text alerts they have requested, said Mark Brennan, a partner at law firm Hogan Lovells focusing on TCPA compliance and FCC policy issues. That is “completely contrary to the TCPA’s statutory language and Congress’s intent,” he said. 

“The retroactive effect of the declaratory ruling will have plaintiffs’ counsel sprinting to the courthouse to file even more spurious class action lawsuits that will drive up costs and reduce services for all consumers," Brennan said.  The FCC's decision "will give rise to new confusion as legitimate businesses struggle to comply with the FCC’s opaque language," he added.

Complaints about violations of the TCPA are the FCC's most numerous complaint category, with more than 215,000 grievances filed last year, according to the agency.

Comcast said a report at DeepDotWeb claiming that some Comcast high-speed customers have been told they run the risk of service termination if they use Tor, a browser that has gained in popularity due to its focus on keeping users relatively anonymous, is false.

DeepDotWeb’s story cited anecdotal evidence using information from anonymous Comcast customers claiming that a number of service reps, including one named “Kelly,” told them that Tor “wasn’t legal,” and that continued usage could result in the disconnection.

The story “is wildly inaccurate,” a Comcast spokesman said. "We have no policy against the use of Tor," he said, noting that the anecdotal information in the story is not consistent with Comcast’s messaging from agents in its Security Assurance team.

Comcast, which said its own internal investigation could not turn evidence showing exchanges between its reps and purported customers as described in the DeepDotWeb story or find a member of its security assurance team named Kelly, also shot down assertions in the story that the operator would ask customers for information about the Web sites they had visited.

While Comcast, like all ISPs, have acceptable use policies, the company said it does not monitor specific usage or the software they have installed on their machines.

 “We respect our customers’ privacy and security and we only investigate or disclose information about a customer’s account with a valid court order,” the Comcast spokesman said.

Additionally, service termination is not currently a component of Comcast’s Copyright Alert System (a.k.a. “Six Strikes”) policy. The policy’s “mitigation” phase, which comes into play if a customer receives more than four alerts (sent via email and through in-browser messages), the customer will be faced with a persistent in-browser alert that requires the customer to call its Security Assurance team.

While the Tor browser notes that it is a “pre-configured web browser to protect your anonymity, and is self-contained,” it does note in its FAQ that “[f]ile sharing…is widely unwanted on Tor,” and that aps such as BitTorrent is not anonymous on Tor.

According to Tor’s overview, it uses a network of "virtual tunnels" that allow people and groups to increase their Internet privacy. Tor, the site adds, was “originally developed with the U.S. Navy in mind, for the primary purpose of protecting government communications,” but notes it’s used today by “a wide variety of purposes by normal people, the military, journalists, law enforcement officers, activists, and many others."

Update: Comcast also responded to the report Monday via a blog posting aimed at "setting the record straight” on the Tor topic.

“Comcast is not asking customers to stop using Tor, or any other browser for that matter. We have no policy against Tor, or any other browser or software. Customers are free to use their Xfinity Internet service to visit any website, use any app, and so forth,” Jason Livingood, Comcast’s VP, Internet & communications engineering, wrote. “Our customers can use Tor at any time, as I have myself.  I’m sure many of them using it right now.”

While the report “may have generated a lot of clicks but is totally inaccurate,” Livingood added, reiterating that Comcast doesn’t monitor its customer’s browser software, web surfing or online history, and that Comcast does not terminate customers for Copyright Alert System violations.

Update II: An official with Tor said there was not enough information to comment on the allegations pointed at Comcast in the DeepDotWeb story, but noted that Tor does have a project called the Open Observatory of Network Interference that can track whether Internet access is being restricted. "People with uncensored connections to the Internet can use Tor to share their access with human rights defenders and journalists behind national firewalls. We tend to have good relationships with Internet Service Providers in free societies for this reason," the official added.