What will people be talking about and adjusting to throughout the year? 

The new year is ushering in fresh opportunities and carryover challenges in the media landscape. Many are continued trends from the past couple of years around data privacy and measurement. Others are newer trends as viewership changes continue to shift and more emphasis is put on profitability for media companies. Here are some expectations we see on the near horizon: 

Measurement and Data Privacy Shifts: As rules and regulations around consumer data privacy continue to grow, advertisers will continue to explore alternatives to cookie-based and multi-touch attribution (MTA) solutions for targeting, measurement and attribution, including data clean rooms, media mix modeling and geographic-based media experimentation. Additional alternatives will include survey and zero-party data (data a user shares intentionally with a company). 

Media mix modeling is the highest in demand right now in terms of emerging alternatives followed by experimentation. Clean rooms and zero-party data are supplemental at this point. 

The media industry, unfortunately, remains no closer to establishing standards of measurement and attribution. As far as digital tracking, targeting and measurement, everyone is still very cookie-dependent and will remain so until forced to do something else. These solutions will be additive to the measurement and data-tracking arsenal. As long as cookies are viable, cookies will remain the preferred tracking, measurement and targeting option.

Media Consumption Continues to Shift to Influencer-Based Content: Media consumption continues to shift to growth and value in the creator economy. YouTube, TikTok, and Meta have given independent creators a platform to develop large and loyal audiences that brands can connect with. TikTok, especially, will grow exponentially compared to the other “legacy” digital platforms, according to findings in the EMarketer Influencer Marketing 2022 report.

Media Consolidation Among Streaming Platforms: Some companies lack the scale to compete in streaming (AMC, Paramount, etc.,) as the new streaming bundles from the likes of The Walt Disney Co. and Warner Bros. Discovery begin to look a lot more like siloed cable-TV bundles. But pressure is on the big players as well with an increased focus on profitability. A swift change in leadership atop Disney at the end of last year put share price in the spotlight as well as weaknesses in Disney’s various businesses — such as streaming platform Disney Plus likely not becoming profitable until 2024.  Given the challenges in continued growth and pressure on profitability, streamers will look for ways to cut costs or find new areas for growth, which could include further consolidation (buying other streaming services) and bundling.

Sports Rights Deals: A lot will happen in terms of sports rights deals in 2023 as more value is put on individual league deals, exclusive deals like “NFL Sunday Ticket” and the future of the regional sports networks given their current ties to limited cable TV bundles. Players like Apple, Google and Amazon have the ability to use their cash to make large jumps in the streaming space very quickly by purchasing streaming sports rights deals, as Google just did with NFL Sunday Ticket for YouTube. There is also talk of the sports leagues themselves (Major League Baseball and the National Hockey League in particular) buying back some of the sports rights deals to distribute through their own streaming services. 

Audience Measurement with Alternative Currencies: Now approaching the one-year mark in which many agencies and advertisers began dipping a toe in the water of alternative currencies to Nielsen (iSpot TV, VideoAmp, and Comscore primarily), it remains to be seen how advertisers will react to the multiple tools available for measurement of cross-screen TV and video campaigns. The most likely scenario is that each network group will begin to provide preferred deals to advertisers, as we have already seen with NBCUniversal and Warner Bros. Discovery,  while Nielsen continues to remain the most preferred currency across partners.

Social Trends with a Focus on AI and Privacy: Twitter continues to shed advertisers and users as it struggles with brand safety, content moderation, and executive departures following Elon Musk’s acquisition of the platform. TikTok continues to increase its share of video time spent, providing consumers with an effective quick hit of entertainment dopamine. Meanwhile, a bill to ban the platform is gaining steam in Congress. 

Will TikTok eat our brains in 2023? Is the metaverse a bucket of hogwash? Those questions will fade into the background as more people adopt the next generation of social media with ChatGPT and the real question will become, what do the new advancements in AI mean for how machines will play a role in our daily lives? ▪️

The Interactive Advertising Bureau, the association representing online advertisers, has updated and expanded its privacy framework to help members navigate what it calls a patchwork of new state privacy laws related to consent for use of online data for targeted marketing and other purposes. It is seeking public comment on that framework.

The Multi-State Privacy Agreement (MSPA) update, which is currently in draft form, stems from the Limited Service Provider Agreement that covered compliance with the California Consumer Privacy Act (CCPA) and now covers the Colorado Privacy Act (CoPA), Connecticut Data Privacy Act (CDPA), Utah Consumer Privacy Act (UCPA), and Virginia’s Consumer Data Protection Act (VCDPA).

In combination with IAB Tech Lab's Global Privacy Platform (GPP), online advertisers hope to be able to navigate the different consent and privacy regimes. IAB is urging the online advertising industry to adopt the GPP as the go-to privacy management regime.

Also: President Biden Signs New Global Privacy Safe Harbor Order

The IAB said the GPP is meant to enable all parts of the digital ad chain to comply with regional privacy regulations and describes it as a "transport layer that communicates user consent and preference signaling throughout the digital supply chain."

Getting the privacy part of targeted advertising right could be crucial to the continued health of what has been a booming online ad market. Statista.com predicts digital ad spending in the U.S. alone will top $200 billion by 2025.

"We have found a way to solve for key advertising use cases that puts consumers first, hews closely to the letter of the law, and, like the IAB Limited Service Provider Agreement, will be leveraged by small and large participants alike to meet their obligations," IAB/IAB Tech Lab executive VP Michael Hahn said.

While legislators on both sides of the aisle recognize the need for comprehensive privacy protection legislation to replace what will otherwise likely be an even more extensive patchwork of state privacy laws and different data use consent regimes, such legislation has yet to materialize due to differences over what types of data need special protections and how to do that.

IAB is giving commenters until October 27 to weigh in on its proposed framework. ■

The Federal Trade Commission has issued a staff report showing the increasing use of “dark patterns” to manipulate consumers into buying products or giving up their information, and thus their privacy, online.

The report, titled “Bringing Dark Patterns to Light,” was released at the FTC's September public meeting  — where it was approved by the commissioners 5-0 — and stems from a workshop in April 2021.

The report cited the case of smart-TV maker Vizio, which struck a multimillion-dollar agreement to settle FTC allegations that it had enabled a default setting that allowed the company to collect and share TV-viewing activity with third parties, but did so without sufficient notice to consumers, including by giving the setting the vague, pro-consumer sounding name of “Smart Interactivity.”

“While dark patterns may manipulate consumers in stealth, these practices are squarely on the FTC’s radar,” the report concluded. That includes where those practices violated the CAN-SPAM Act and Children’s Online Privacy Protection Act (COPPA).

The Network Advertising Initiative is OK with the FTC’s “goals” of cracking down on efforts “designed to trick and trap consumers, including disguised ads, difficult-to-cancel subscriptions, buried terms, and tricks to obtain data.” But it suggested the answer is self-regulation.

The NAI pointed out it has been recommending for months that its member companies follow its NAI Best Practices for User Choice and Transparency. ▪️

A comprehensive data privacy bill that would, among many other things, allow web users to opt out of targeted advertising — and ban ads aimed at children entirely — is heading to a markup July 20 in the House Energy & Commerce Committee.

The bipartisan American Data Privacy and Protection Act (H.R. 8152) is a comprehensive national privacy regime that would require companies to collect only the data necessary to provide their products or services, bill proponent Common Cause said, and would allow consumers to correct or delete their data. There are also prohibitions on discriminatory data practices/algorithms/ad delivery.

Also: Twitter to Pay $150 Million to Settle Privacy Complaint

The bill would require that consumers get a clear and conspicuous opportunity to opt out of targeted advertising. If a consumer is under 17, and an advertiser knows that, they cannot be targeted with advertising at all. 

The bill also creates a Youth Privacy and Marketing Division within the Federal Trade Commission, charged with protecting the privacy of children and minors and tasked with looking out for marketing directed at them. The division must report to Congress annually on how successful it has been in its mission and on any emerging concerns about protecting the privacy of children and minors.

The measure has supporters on both sides of the aisle and in both houses of Congress. That’s saying something in these politically divided times, particularly on an issue as complicated as data privacy protections.

Also: Bill Would Break Up Big Tech Ad Giants

“We are glad to see that the American Data Privacy and Protection Act is going to a full committee markup, and that Republican and Democratic leadership on the House Energy & Commerce Committee has come together on a comprehensive privacy proposal to protect our data online," Common Cause media and democracy program director Yosef Getachew said.

Watchdog group Common Cause is particularly heartened by the inclusion of civil-rights protections, given that privacy and data abuses have hit minority communities particularly hard, the organization said. ▪️

A pair of House Republicans say they have launched an investigation into over-the-top video clip streaming site TikTok’s alleged sharing of American users’ data with China-based employees.

House Energy and Commerce Committee Republican ranking member Cathy McMorris Rodgers (R-Wash.) and Oversight and Reform Committee Ranking Member James Comer (R-Ky.) have written to the company to request “all documents and communications outlining the relationship between TikTok and ByteDance, as well as any of their data sharing, access, and storage practices.”

Congress has been recently buzzing about TikTok following a Buzzfeed News article citing recordings from TikTok employees indicating that Chinese employees have access to user data, something TikTok has denied.

Also: FCC's Carr Tells App Stores TikTok Has to Go

“In 2017, the CCP passed the National Intelligence Law of the People’s Republic of China. This law requires individuals, organizations, and institutions to assist CCP Public Security and State Security officials in carrying out and executing ‘intelligence’ work,” the legislators said in announcing their letter. “It is unclear if this applies to only Chinese companies or encompasses those with any operating footprint in China, like ByteDance — TikTok’s parent company.”

Rodgers and Comer are not the only ones pressing TikTok over the BuzzFeed story.

Last week, Sens. Mark Warner (D-Va.) and Marco Rubio (R-Fla.) teamed up to urge the Federal Trade Commission to investigate TikTok based on the story.

Warner and Rubio are the chair and vice chair, respectively, of the Senate Intelligence Committee. ■

Legislators from both sides of the aisle -- Sens. Mark Warner (D-Va.) and Marco Rubio (R-Fla.) -- have teamed up to urge the Federal Trade Commission to investigate over-the-top video clip streaming site TikTok based on reports that suggest the Chinese-based company is not insulated from the Chinese government's demands for data on U.S. users.

Warner and Rubio are the chair and vice chair, respectively, of the Senate Intelligence Committee.

In a letter to FTC Chair Lina Khan, the senators cited a BuzzFeed story about leaked internal TikTok meeting data showing U.S. user data had been accessed from China.

Also: FCC's Carr Tells App Stores TikTok Has to Go

They said they wanted her to immediately launch a Sec. 5 investigation, which is an inquiry into potential false and deceptive conduct. That includes that the site offered employees in China "unfettered access to user information, including birthdates, phone numbers, and device identification information."

They told Khan that TikTok had appeared to misrepresent its relationship to its ByteDance parent and subsidiaries, one of which, ByteDance Technology, is partially owned by the Chinese Communist Party, and that updates to TikTok's privacy policy that indicate that the site may be collecting biometric data "heighten their concern." ■

Witness John Miller, senior VP of policy and general counsel for the Information Technology Industry Council (ITI), told Congress Tuesday (June 14) that it was on the right track, sort of, with the bipartisan federal privacy bill's definition of "targeted advertising" but it would "prevent the ad-supported internet business model from continuing."

ITI members include Amazon, Apple, Google, Meta (formerly Facebook), and Twitter, to name only a few.

The American Data Privacy and Protection Act would allow users to opt out of that "targeted advertising" when surfing the web, whose free content has been supported by such ads.

Miller said everyone agrees privacy legislation is needed -- one reason is so that states do not come up with their own patchwork of privacy laws, a model Miller called "unsustainable."

Also: IAB Tech Lab Launches GPP Global Ad Privacy Permissions Standard

But Miller did point to state laws in Virginia, Colorado and Utah for their definitions of targeted advertising, saying the draft would be better if it more closely followed those states, which he said "struck the right balance to enable internet companies to reasonably advertise to their users on their sites while protecting their privacy interests.”

While Miller said the draft bill deserves thoughtful consideration and is "the most credible bipartisan and bicameral effort yet to advance comprehensive federal privacy legislation in the United States," ITI has a lot of issues with it.

In addition to the definition of targeted advertising, ITI said the definition of "sensitive covered data" is overly broad. The definition of what qualifies as sensitive info deserving of special protection has been one of the major sticking points of past attempts to achieve bipartisan consensus on a way forward.

ITI also said the bill does not distinguish sufficiently between the different entities that use data or their obligations regarding its privacy.

Edge providers also have an issue with the bill's private right of action, which allows users to sue for violations of data privacy. ITI said that given the "already strong" enforcement by the Federal Trade Commission and Justice Department provisions in the draft, "it is reasonable to ask whether including a Private Right of Action is necessary to ensure robust enforcement."

While the private right of action has been narrowed, ITI said it is still too broad and will likely lead to a "wave of litigation."

Committee Chairman Frank Pallone (D-N.J.) suggested in his opening statement that Big Tech was essentially the problem that needed fixing.

"Comprehensive, national privacy legislation is necessary to limit the excesses of Big Tech and ensure Americans can safely navigate the digital world," Pallone said. "There is simply no real “choice” when consumers must trade their personal data to use essential services. People cannot navigate the modern world without their smartphone or email address. And with the minimal protections that apply today, most Americans have little reason to think their data won’t be used in unanticipated ways."

Since 2019, ITI has been arguing it is part of the solution, offering up what it says is a legislative roadmap for a federal privacy law. ■

The Interactive Advertising Bureau’s IAB Tech Lab has unveiled the Global Privacy Platform (GPP) to standardize U.S. and global privacy preferences for digital ads and wants input on the plan.

Getting the privacy part of targeted advertising right could be crucial to the continued health of what has been a booming online ad market. Statista.com predicted that digital ad spending in the U.S. alone will top $200 billion by 2025.

The fruits of Protect Rearc and two years in the making, the GPP is a single protocol for transmitting privacy, consent and consumer-choice preferences from websites and apps to advertising tech providers. The idea is to mitigate privacy risks and square those protections with Europe’s Transparency and Consent regime and the California Privacy Rights Act (CPRA) — the U.S. has no national privacy framework, but one of the reasons for coming up with GPP is the threat of a balkanized system of differing state (and international) approaches.

“Regulations are hitting the books faster than we can build individual solutions for,” said Andrea Giannangelo, CEO of Iubenda, which provides privacy compliance services.

“Privacy regulations such as the GDPR, CCPA, CPRA, PIPEDA and numerous new local privacy laws, create immense complexity and fragmentation in the market," IAB Tech Lab senior director Jason Raqueno said. "The GPP is intended to enable participants across the advertising supply chain to navigate the complexity of numerous overlapping global privacy laws through a single platform and consent signaling protocol."

Rearc was launched in 2020 in response to the limitations of third-party cookies and other targeted ad identifiers.

Also: IAB Says National Privacy Regime Is Job One

According to IAB Tech Lab, which is the digital ad industry’s standard-setting body, the GPP “enables advertisers, publishers, and technology vendors in the digital advertising industry to adapt to regulatory demands across markets," cuts the cost of managing privacy compliance, and helps reduce risk by "a single framework to encode and transmit consumer privacy preferences, which they can leverage globally and across all platforms and channels.”

IAB Tech Lab CEO Anthony Katsur said the GPP is ready for global adoption, but IAB is first seeking comment (it will give interested parties 60 days). IAB is looking for input from “publishers, brands, media companies and legislative officials.” ■

Twitter has agreed to pay a $150 million civil penalty to settle allegations it violated the law and a 2011 Federal Trade Commission administrative order by "misrepresenting" how it was using Twitter users' nonpublic data, which included targeting ads to those users.

The FTC and Justice filed the complaint and settlement Wednesday (May 25) in the U.S. District Court for the Northern District of California.

In addition to the money, Twitter agreed to a robust compliance regime to make sure it took the requisite steps to protect user data, according to Justice. 

The complaint alleged that from 2013 to 2019 Twitter said it was collecting user phone numbers and e-mail addresses for security purposes but did not mention it would also use the info to help companies target ads to them.

Also: Twitter Proposes Guidelines for Regulation

The complaint also alleged Twitter falsely claimed it was in compliance with the European Union-U.S. and Swiss-U.S. Privacy Shield Frameworks, which prohibit using nonpublic data for purposes other than those stated.

“As the complaint notes, Twitter obtained data from users on the pretext of harnessing it for security purposes but then ended up also using the data to target users with ads," said FTC chair Lina Khan. “This practice affected more than 140 million Twitter users, while boosting Twitter’s primary source of revenue.”

DOJ and the FTC will share enforcement of Twitter's compliance with the settlement, which still must be approved by the court before it goes into effect. ■

The U.S. is joining an effort to create global, cross-border privacy rules through a new Global CBPR Forum.

The White House said Thursday (April 21) that the U.S. was teaming up with Canada, Japan, the Republic of Korea, the Philippines, Singapore, and Chinese Taipei on a certification system based on the current Asia-Pacific Economic Cooperation (APEC) Cross Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) Systems.

Businesses already certified under those current systems will be automatically recognized in the new global forum.

The goal is to promote the free flow and protection of data and interoperability with other privacy frameworks and come up with best practices.

“The establishment of the Global CBPR Forum reflects the beginning of a new era of multilateral cooperation in promoting trusted global data flows that are critically important to our modern economy," said Commerce Secretary Gina Raimondo. "The Global CBPR Forum intends to establish the Global Cross Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) Systems, first-of-their-kind data privacy certifications that help companies demonstrate compliance with internationally recognized data privacy standards." ■

Apple CEO Tim Cook said proposed new privacy and antitrust regulations being teed up could put iPhone users’ privacy and security at risk.

Cook spoke at the IAPP Global Privacy Summit Tuesday (April 12) in Washington.

He said Apple supports a strong, comprehensive national privacy law, but said he is “deeply concerned” about regulations “that would undermine privacy and security in service of some other aim.” That aim would be competition.

In the name of competition, Cook said, some are taking steps to allow apps without privacy protections to circumvent App Store safeguards and “track users against their will.”

One example is the Open Markets Act, which would reduce the control that Apple and Google have over their respective app stores.

Cook countered the argument that new regulations directed at app stores would simply give people more choice and cause no harm. He said taking away a more secure option would leave users with less choice, not more.

He said he wanted to make clear that Apple supports competition that drives innovation and recognizes that supporters of antitrust rules have good intentions. But if Apple is forced to allow unvetted apps onto its phones, he said, the unintended consequences will be “profound.”

He said Apple is obliged to speak up, and would continue to speak up, to convince well-intentioned policymakers not to undermine privacy in the process.

Regulations must be crafted to protect fundamental rights, he said, and there is much to gain if Washington gets it right. ■

A little more than three months after changing its name to Meta Platforms and a day after Wall Street returned the favor of a massive revenue guidance miss by cratering its market cap, analysts scrambled to make sense of it all. 

Facebook parent Meta lost about $232 billion in market capitalization Thursday (February 4) — the largest one-day drop by a single company in U.S. stock market history — after it said Q1 revenue would miss Wall Street forecasts by $2 billion, spurred by a combination of intense competition from TikTok, increasingly onerous privacy requirements from Apple Inc. and just plain bad luck. Meta’s Reality Labs unit, which creates the augmented reality and virtual reality products that are expected to be the building blocks of the metaverse, lost about $10.2 billion on revenue of $2.3 billion. 

While Q4 revenue at $33.7 billion was even with estimates, Meta said it lost about 1 million daily global users in the quarter, adding to concerns that its relevance is slipping with younger consumers. 

Meta’s dilemma is eerily similar to Netflix, which saw its stock fall 25% in January after it missed Q4 subscriber growth targets and said it would add just 2 million paying customers in Q1. Netflix has gained some of those losses back: It was trading at $405.18 on Friday afternoon, about even with the previous day.

Also: Netflix Isn’t Quite Dead Yet 

Meta shares fell more than 26% on Thursday, forcing analysts to rejigger their models for the stock and try to find some sense in such a dramatic miss. The stock fell another 2% on Friday, priced at $232.67 at 12:07 p.m. 

In report after report, analysts that follow the stock pointed to the surprising impact of short-form video juggernaut TikTok — even Meta CEO Mark Zuckerberg said on an earnings conference call that TikTok was “growing at a much faster rate” than Facebook’s own Reels short-form video service. 

At the same time, Apple’s new privacy measures for its iOS products are having a huge impact on ad revenue. On the conference call, Meta chief financial officer David Wehner said those iOS privacy requirements will cost Meta about $10 billion in lost revenue in 2022, which he called “a pretty significant headwind for our business.”

Most analysts were pretty shocked by the revenue impact, but kept as much optimism as they could for the company, maintaining their ratings on the stock but slashing their 12-month price targets by nearly $100. For many, their advice to investors was to ride out the storm, buy the stock at its new low-point and reap the benefits later.

Also: Metaverse or Meh-taverse? 

MoffettNathanson media analyst Michael Nathanson, in a research report entitled “Facebook: The Beginning of the End?” maintained his “buy” rating on the stock but dropped his price target from $420 to $380 per share. Evercore ISI Group analyst Mark Mahaney kept his “outperform” rating but slashed his price target to $350 from $430 per share, while Bernstein tech analyst Mark Shmulik maintained his “outperform” rating on the stock but dropped his price target from $400 to $350 per share. 

“There are days in this job that suck. Today is one of those days,” Shmulik wrote in a note to clients after Meta released its results. Shmulik noted that most analysts severely underestimated the impact of Apple’s decision to let iPhone and iPad users opt in or out of the identifiers for advertisers (IDFA) that apps use to track movement through the web and target ads accordingly. When users opt out, it makes those ads a lot less valuable.

While Shmulik and other analysts believe Facebook will eventually figure out a workaround to the IDFA, management didn’t help things during the earnings conference call by “striking a negative tone around the duration and cost (~$10B on ’22 revenues) of any potential long term fixes,” the Bernstein analyst wrote.

Nathanson, who has been a big believer that Facebook would exceed ad forecasts in the past, reduced his Q1 revenue estimate by $2 billion and his full-year 2022 revenue predictions by $12 billion, or 8%. Although he said Meta’s Q4 results were in line with most estimates, its Q1 guidance was “incredibly weak” and was a “headline grabber and not in a good way.”

Still, other analysts were optimistic of Facebook’s resilience, and saw the low stock price as a Netflix-like inflection point, referring to the streaming giant’s recent stock drop. In his note, Evercore‘s Mahaney said that Meta “could well be dead money for several months,” but remained a buyer of the stock because it is trading close to its 2018 trough multiple of 17 times cash flow, which could limit downside and because he believes the company’s new Q1 revenue guidance suggests that revenue trends are stabilizing.

Mahaney also is confident that Facebook’s Reels — its short-form video answer to TikTok — will succeed, and that its macro challenges are temporary.

“TikTok is a real issue, but primarily for Instagram, and much less so for Blue, WhatsApp, FB Messenger, FB Marketplace, etc.,” Mahaney wrote, adding that he still believes Meta has a compelling long-term business model.

“Meta Platforms has a robust combination of revenue growth (17% CAGR ‘21E-‘24E) and profitability (~40% GAAP Operating margins and 50%+ EBITDA margins in ‘21),” Mahaney wrote. “Their core Family of Apps operating margins of near 50% in FY21, supports the significant investment in Reality Labs. The FCF generation has been equally impressive: $39B in FY21. And this has allowed them to execute sizeable share buybacks ($40B+ in ‘21) that we believe are sustainable going forwards.” ■   

A pair of House Energy & Commerce Committee Republicans on Tuesday (Nov. 3) unveiled a discussion draft of national privacy legislation, the Control Our Data Act, which would establish a “national privacy standard,” and they are drafting every GOP member of the Consumer Protection Subcommittee to work on it.

Also read: New Federal Data Privacy Bill Introduced

For the legislation to go anywhere, they will have to get buy-in from Democrats who control the committee and the House, though given how long it would take for a comprehensive bill to make it to a vote in either House or Senate, the Republicans may be hoping that by that time the 2022 midterms voters may have given them the upper hand and control of committees.

House E&C ranking member Cathy McMorris Rodgers (R-Wash.) and Consumer Protection ranking member Gus Bilirakis (R-Fla.), who teamed on the draft, said that, guided by four main principles, the bill will set clear rules for consumer privacy and data security, hot button issues in Washington as both sides of the aisle hammer Big Tech over its handling, or mishandling, of both.

The principles:

1.) “The internet does not stop at state lines, so why should one state set the standard for the rest of the country? Creating arbitrary barriers to the internet may result in different options, opportunities, and experiences online based on where you live.

2.) “A lack of transparency has led to where we are today and any federal bill must ensure people understand how their information is collected, used, and shared. We must also ensure that companies who misuse personal information must be held sufficiently accountable.

3.)”Any federal bill must ensure companies are implementing reasonable measures to protect people’s personal information.

4.) “We must also protect small businesses and innovation. We know that in Europe, investments in startups are down more than 40% since their data protection and privacy law — the General Data Protection Regulation — went into effect. We must guard against a similar situation here. We want small businesses hiring coders and engineers, not lawyers. 

The GOP member marching orders are as follows:

• Bilirakis will focus on creating a Bureau of Consumer Privacy and Data Security within the Federal Trade Commission;

• Rep. Fred Upton of Michigan will focus on how to define the legitimate purpose is defined for the use and retention of consumer data is handled so as not to become a cybersecurity target;

• Rep. Bob Latta of Ohio will focus on the need for a standard that avoids conflicting regulations and allows for proper third-party data sharing;

• Rep. Brett Guthrie of Kentucky will handle risk assessment and mitigation techniques like blockchain to protect consumer data;

• Rep. Larry Bucshon of Indiana will deal with privacy by design, that design being reasonable policies for collecting, using and sharing data;

• Rep. Neal Dunn of Florida will focus on data security;

• Rep. Debbie Lesko of Arizona will handle categories of sensitive information and anti-discrimination policies;

• Rep. Greg Pence of Indiana will work on the definition of small and midsized entities as well as the definition of personal information, which has been a huge sticking point between Republicans and Democrats;

• Rep. Kelly Armstrong of North Dakota will focus on the proper use of the FTC's enforcement authority, collaboration with state attorneys general, self regulatory guidelines and safe harbors.

“Today’s announcement from Reps. McMorris Rodgers and Bilirakis is the latest reminder that there is broad support to enact comprehensive data privacy legislation in Congress,” said Privacy for America, a coalition of advertising industry groups pushing for federal privacy legislation. “We note that there are significant areas of agreement in proposals advanced by members of both parties on the core principles to protect all Americans. We encourage members of Congress to come together to reach agreement on a framework that will lead to real privacy protections for consumers — no matter where they live — and establish clear rules of the road that allow for the responsible use of data.”

The FTC has concluded that ISPs are collecting and sharing more data about their customers than those customers are aware of, including internet traffic and real-time location data, while "failing to offer consumers meaningful choices about how this data can be used."

FTC chair Lina Khan said the report would be part of an "ongoing conversation" about commercial data practices, but one that could be "incorporated" into FTC action.

That is according to a staff report culminating a two-year investigation into the data practices of AT&T, Cellco Partnership (Verizon Wireless), Charter, Comcast, T-Mobile and Google Fiber, a report the FTC said revealed "troubling aspects of some ISP data collection practices." The FTC also sought info from three affiliated ad entities, AT&T’s Appnexus (rebranded Xandr); Verizon’s Verizon Online; and Oath Americas (now Verizon Media).

Cable ISPs pushed back hard on the report and its "lumping" of their business with the Big Tech platforms NCTA-the Internet & Television Association suggested should be the FTC's focus.

Also Read: FTC Asked to Prevent Surveillance Advertising

The report pointed out that news outlets had reported that location data had been shared with third parties including "car salesmen, property managers, bail bondsmen, bounty hunters, and others without reasonable protections or consumers’ knowledge and consent."

It also said that while companies claim to give consumers choice, many make it tough to exercise that choice, and while they promise to keep data only as long as it is needed for a business purpose, what falls under that definition varies "widely."

The FTC said the report's findings underscore the need to restrict data collection and use.

The report was approved unanimously 4-1 by the commission, with Khan issuing a separate statement.

Khan said the report highlighted 1) problems with the notice-and-consent framework for data collection and sharing; 2) the expansion of ISPs into vertically integrated businesses including ones providing content for their broadband "pipes"; and 3) the potential use of "hyper-granular" online dossiers to discriminate against users.

Khan also said she thought the FCC had the expertise to "fully oversee internet providers," and that it should reassert that authority by "once again put[ting] in place the nondiscrimination rules, privacy protections, and other basic requirements needed to create a healthier market."

That was a reference to the FCC's decision during the Trump Administration to reclassify broadband access as an information service, eliminate those rules, and deed oversight of most of that to the FTC. To reassert that authority and return the rules, the FCC will need a third Democrat since the commission is currently at a 2-2 political tie.

While the FTC has appeared to be more focused on big edge players like Facebook and Twitter of late, it talked about how the ISPs had become tech giants offering "voice, content, smart devices, advertising, and analytics" that all implicated data collection on a big scale.

Among the "troubling" practices report found were that several of the ISPs "combine data across product lines; combine personal, app usage, and web browsing data to target ads; place consumers into sensitive categories such as by race and sexual orientation; and share real-time location data with third-parties."

The companies have privacy protections, but the FTC said that while a number of them promise not to "sell" data to third parties, they allow it to be shared and otherwise monetized "and hide disclosures about such practices in fine print of their privacy policies."

While the association's representing telecom ISPs provided cautious responses focusing on their support of federal privacy legislation, NCTA led with major pushback on both the report and the FTC's characterization of ISPs before joining in a call for consistent privacy rules across all sectors, including online platforms and other Big Tech.

“Consumers’ online safety and privacy is a top priority for the wireless industry, and federal legislation that uniformly protects users across all platforms is the best way forward," said CTIA, the wireless association. "We are looking forward to continuing to work with the FTC, lawmakers and companies across the ecosystem to ensure consumers are protected.”

“As the FTC has called for numerous times, and as previously urged by USTelecom, Congress must enact a national, comprehensive federal privacy framework that puts consumers first and applies uniformly to all companies operating online," said USTelecom, which represents wired telecom ISPs.

“The FTC’s report provides a highly distorted view of ISP data collection policies and inappropriately attempts to lump broadband providers into the same category as the Big Tech platforms. Cable broadband providers take seriously their responsibility to safeguard the personal information of their customers and do not surveil their customers or sell their location data. Viewed objectively, today’s presentation is a broad attack on online advertising generally, not specific ISP actions. And what is further missing from today’s report is the much larger story about Big Tech platforms that are premised on maximizing user attention. What is needed is a consistent set of privacy rules across the online marketplace on a technology-neutral basis. We look forward to continued engagement with policymakers to forge a strong, consistent framework for privacy protection.”

The Federal Trade Commission is being asked to use rulemaking authority to protect privacy, cybersecurity and civil rights.

That tall order comes from Capitol Hill, where federal privacy legislation has proved a hill too high for Democrats and Republicans to help themselves and the country surmount.

Nine Democratic senators are calling on the commission to fight back against what they said is “Big Tech’s unimpeded access and abuse of consumers’ private information, anti-competitive behavior and data breaches, as well as alarm over rising discrimination using personal data that undermine civil rights.”

They argue that privacy has become a consumer crisis and while Congress has failed to come up with a national standard via legislation, lawmakers are calling on the FTC to do what it can in parallel with that ongoing Hill effort to protect consumer privacy using every tool in the regulator’s toolkit.

Also Read: FTC Boosts Big Tech Regulatory Profile

The FTC's tools have generally been to file lawsuits or settle suits over unfair and deceptive practices, but the commissioners do have some rulemaking authority.

The senators want the FTC to launch a rulemaking looking at, among other things, “the banning of exploitative targeting of children and teens and other specific practices, implementing opt-in consent rules on the use of personal data and global opt-out standards.”

The debate over opt-in vs. opt-out data collection regimes has been arguably the biggest sticking point between Republican and Democratic approaches, as well as what qualifies as the sensitive personal information in need of the most protection. But as Big Tech has been more in the sights of lawmakers on both sides of the aisle, there could be more common ground on Capitol Hill when it comes to privacy protections.

Signing the letter were Sens. Brian Schatz (D-Hawaii), Ron Wyden (D-Ore.), Elizabeth Warren (D-Mass.), Chris Coons (D-Del.), Ben Ray Luján (D-N.M.), Amy Klobuchar (D-Minn.), Cory Booker (D-N.J.) and Ed Markey (D-Mass.).

The letter comes only days after President Joe Biden nominated privacy advocate Alvaro Bedoya to a seat on the commission. 

Bedoya was the first chief counsel to the Senate Judiciary Subcommittee on Privacy, Technology and the Law, which oversees Big Tech.

House Energy & Commerce Committee Republican leadership said Thursday (Aug. 19) that they had big issues with the theft of data from T-Mobile, saying Congress has to pass privacy legislation ASAP.

“The T-Mobile data breach is of serious concern. While we have more to learn to determine how this breach happened and its potential wide-ranging consequences, we urge all companies to do everything they can to safeguard and protect American’s personal information," they said in a statement.

"They" were E&C ranking member Cathy McMorris Rodgers (R-Wash.), Communications and Technology Subcommittee ranking member Bob Latta (R-Ohio), and Consumer Protection ranking member Gus Bilirakis (R-Fla.).

They pointed out that last month the committee approved bipartisan legislation to promote cybersecurity information sharing.

That appeared to be a reference to H.R. 4046, the “NTIA Policy and Cybersecurity Coordination Act,” which would authorize the NTIA's Office of Policy Analysis and Development and re-christen it the Office of Policy Development and Cybersecurity.

The office administers the network security information sharing program established by Congress in the Secure and Trusted Communications Act. It passed along with a raft of tech/cybersecurity bills last month.

But they said more needs to be done. "We need to build on that work to protect Americans’ privacy. This breach is yet another example of why Congress must pass a national privacy and data security law. We need strong national standards that ensure industries can innovate, strengthen cybersecurity and data privacy, and keep up with the evolving ways bad actors steal personal information.”

Both Republicans and Democrats have argued for national legislation, but have yet to agree on just what should be in that law.

A coalition of dozens of groups and academics from around the world are calling on Facebook to scrap plans to launch a version of Instagram for children. Facebook is countering that it continues to explore the option, which it said will be age appropriate and managed by parents. 

The coalition signaled that stance in a letter to Facebook CEO Mark Zuckerberg.

The groups, led by the Campaign for a Commercial-Free Childhood, cited a BuzzFeed report that Facebook plans to build a version of the social media site that "allows people under the age of 13 to safely use Instagram for the first time.”

Also Read: Hill Dems Says Instagram for Kids May Do More Harm Than Good

While they said they agree the current version of the site is not safe for the millions of kids who have lied about their age to create accounts, they argued launching a version for kids is not the right remedy, and would instead put users at "great risk" by "exploiting their fears of missing ou[t] or the desire for peer approval," leading them to constantly check their devices and share photos. "A growing body of research demonstrates that excessive use of digital devices and social media is harmful to adolescents," they write, including contributing to obesity, lower psychological wellbeing, decreased happiness, and decreased quality of sleep. "Instagram’s focus on photo sharing and appearance makes the platform particularly unsuitable for children who are in the midst of crucial stages of developing their sense of self," they said.

Also Read: Hill Continues Big Tech CEO Punishment

Besides, they argued, creating a new site for kids does not eliminate the problem of underagers on the current site. For example, they argued, "children between the ages of 10 and 12 who have existing Instagram accounts are unlikely to migrate to a “babyish” version of the platform after they have experienced the real thing."

Finally, they argued that Facebook has a track record of exploiting young people that makes it particularly unsuitable to be "the custodian of a photo sharing and social messaging site for children."

Among the other groups signing on to the letter are the Center for Digital Democracy, the Consumer Federation of America, the Parents Television and Media Center, Child Online Africa, and Global Action Plan UK.

"We’ve just started exploring a version of Instagram for younger teens," said a Facebook spokesperson. "We agree that any experience we develop must prioritize their safety and privacy, and we will consult with experts in child development, child safety and mental health, and privacy advocates to inform it. In addition, we will not show ads in any Instagram experience we develop for people under the age of 13.”

They also pointed out that "the reality is that kids are online. They want to connect with their family and friends, have fun, and learn, and we want to help them do that in a way that is safe and age-appropriate. We also want to find practical solutions to the ongoing industry problem of kids lying about their age to access apps."

Facebook is working on new age verification methods to get the under-13s off the site while "exploring an Instagram experience for kids that is age-appropriate and managed by parents."

Advocates for a secure and safe online environment for kids have filed a complaint against Google with the Federal Trade Commission seeking an investigation into what they said are app recommendations for kids that don't comply with the Children's Online Privacy Protection Act (COPPA).

Google counters that it makes protection of children a priority.

The complaint was filed by the Campaign for a Commercial-Free Childhood (CCFC) and the Center for Digital Democracy (CDD), which filed a similar complaint two years ago (December 2018) that did not motivate the Donald Trump FTC to action. They are looking for a better result with the Joe Biden FTC and their message is simple: "Google is certifying as safe and appropriate for children apps that violate COPPA and put children at risk."

Also Read: Privacy Advocates Push FTC for Kids Data Collection Transparency, Oversight

They argued that given the increase in kids' screen time during the pandemic, the need for FTC action is even greater.

They conceded Google has made changes since that initial complaint was filed, but said Google had failed to address the core problems, pointing to studies that found that a "significant" number of Google Play apps collected and shared children's personal information without getting parental consent first, a big no-no in COPPA land.

They also said that websites' Sec. 230 immunity from liability over most third-party content would not shield Google from Sec. 5 liability (false and deceptive) because two prongs of the three part Sec. 230 liability shield test would not be met.

While Google may be an interactive computer service (prong one), the second prong is not met because the content at issue is statements made by Google Play in its parent guide and blog, not developed by another content provider. The third prong of the shield would also not apply, they say, because it is Google's speech being held liable, not a third party's.

"While the FTC has brought a few enforcement actions against developers of children’s apps, its whack-a-mole approach cannot fix the systemic problem that Google Play, the largest source of apps for children, misrepresents children’s apps as complying with COPPA when they do not," the complaint alleged. "Thus, it is important that the FTC conduct a thorough review of Google Play’s practices regarding children’s apps."

Also Read: Groups Seeks FTC Investigation of Child-Directed Digital Marketplace

“Parents reasonably expect that Google Play Store apps designated as ‘Teacher approved’ or appropriate for children under age 13 comply with the law protecting children’s privacy. But far too often, that is not the case," said campaign chair Angela Campbell case. "The FTC failed to act when this problem was brought to its attention over two years ago. Because children today are spending even more time using mobile apps, the FTC must hold Google accountable for violating children’s privacy.”

"The Federal Trade Commission must swiftly act to stop Google’s ongoing disregard of the privacy and well-being of children," added Jeff Chester, executive director of CDD.

“Back in 2018, I sounded the alarm and raised concerns about whether the Google Play store is failing to protecting children’s privacy," Sen. Ed Markey (D-Mass.) told Multichannel News. "I’m disturbed, but not surprised, to see new evidence that this is still a problem today."

"Children are spending an unprecedented amount of time on their devices right now, and they shouldn’t be tracked at every turn. I authored the Children’s Online Privacy Protection Act because I believe that kids are a uniquely vulnerable population online. Unfortunately, the threats to kids’ privacy and well-being on the internet have increased by orders of magnitude since that legislation was signed into law decades ago, but violators have far too often been let off the hook. That has to stop. It’s time for Big Tech to be held accountable for prioritizing profits over privacy, particularly when it comes to our children.”

“Google Play is committed to providing a positive and safe environment for children and families," the company said in a statement. "Over the last few years, we’ve taken significant steps including updating our Google Play Families and Designed for Families programs with more stringent requirements around ads, content, and personal data and introducing a Kids tab in Google Play filled with “Teacher-approved” apps to help families find quality apps and games for their kids. We will continue to make the protection of children on our platform a priority.” 

A Google spokesperson said that the company has stringent policies for developers and enforcement, as well as promoting quality content, and has made it easier for parents to supervise their children's use of Google play.

Consumer Reports is celebrating Virginia Governor Ralph Northam's signing of the Consumer Data Protection Act.

“This is a historic moment for privacy rights,” said CR senior policy analyst Maureen Mahoney. “Virginia is now just the second state [after California] to pass a comprehensive privacy bill. While we're pleased that Virginians will have new privacy rights, legislators should continue working in the next session to strengthen it. This bill has some important privacy provisions, but consumers need more practical options for controlling their data.”

Also Read: Virginia Passes Consumer Privacy Bill

It establishes standards for data control and processing but does not apply to state or local governments and has exceptions for types of data and information governed by federal law. 

Consumers have the right to access, correct, or delete their personal information and obtain a copy of that information, as well as to opt out of the processing of personal data for targeted advertising. 

Also Read: Ad Group Proposes Privacy Bill

The bill does not go into effect until January 2023.

Consumer Reports is praising the Virginia legislature's passage of the Consumer Data Protection Act (CDPA), which would join California as the second state/commonwealth to pass its own privacy bill after a Democratic  FCC effort to regulate privacy on the federal level was nullified.

The Virginia bill applies everyone doing business in the Commonwealth that control or process the personal data of at least 100,000 consumers or get over half their gross revenue from the sale of personal data of at least 25,000 consumers.

Also Read: ANA Opposes Hawaii Privacy Bill

It establishes standards for data control and processing but does not apply to state or local governments and has exceptions for types of data and information governed by federal law. 

Consumers have the right to access, correct, or delete their personal information and obtain a copy of that information, as well as to opt out of the processing of personal data for targeted advertising. 

The bill, which governor Ralph Northam, a Democrat, is expected to sign, will not take effect until January 2023, so opponents have plenty of time to weigh in on its impact.

Also Read: Ad Group Proposes Privacy Bill

“We commend the Virginia legislature for advancing comprehensive online privacy protections,” said Maureen Mahoney, Consumer Reports policy analyst. “We urge Governor Ralph Northam to approve the measure, and for legislators to continue working in the next session to strengthen it. This bill has some important privacy provisions, but consumers need more practical options for controlling their data.”

“While there are some thoughtful provisions in the Virginia privacy proposal, ANA still feels that privacy is too important of a value to be handled on a state by state basis," said the Association of National Advertisers. "Therefore, we are pushing hard for a strong national privacy law that provides tough protection for consumers and a balanced level playing field for business. We believe that the Privacy for America Coalition draft legislation is the best and fairest proposal put forward to date.” – Association of National Advertisers."

Media buyer GroupM said it has collaborated with Unilever to create a Data Ethics Compass, an online tool to help evaluate the risk involved with using data assets to target consumer with marketing campaigns.

The tool is used when campaign are being planned to judge the appropriateness of using data, based on, among other things, who the data is collected, and also to consider whether consumers might feel that the way the data is being used is “creepy.”

Also Read: GroupM Brand Safety Report Looks at CTV

The Compass takes into consideration where the campaign will run, where the advertiser and agency is located and the category in which the client competes.

“Our Data Ethics Compass provides clients a consistent approach on how best to navigate ethical risk and prioritize and respect the privacy of people on the other side of the screen,” said Krystal Olivieri, GroupM’s Global senior VP for data strategy and partnerships. “This new capability demonstrates GroupM’s belief that even though you have access to certain data, it doesn’t mean you should always use it. We have an obligation as an industry to re-establish an appropriate balance.”

Also Read: GroupM Starts Addressable TV Ad Company in Canada

The compass is designed to highlight concerns the agency and its client might want to address before launching campaigns employing data using a continuum ranging from green and yellow, which would indicate low to acceptable risk, to orange and red, warning of potential problems.

“Creating a responsible digital ecosystem continues to be a priority for Unilever and adding an ethical overlay for use of data in media is a key next step,” said Jennifer Gardiner, Unilever’s senior director of media. “Consumers are growing increasingly distrustful of advertising and lack clarity in how their data is being collected and used in profiling tactics. Our partnership with GroupM on the launch of this much-needed tool sends a reassuring and bold signal that we must all hold ourselves, our partners and agencies to the highest standards, truly putting consumers first.”

As more marketers adopt advanced advertising approaches, including addressable advertising the use of data because more integral to the process. Marketers and media companies want to use the data to make advertising more engaging and improve the media experience for consumers. But privacy is also also a concern among consumers and violating a customers trust could lead to severe consequences.

“The burgeoning of privacy protection laws around the world reflects the widespread consumer demand to have the interests of the individual paramount in considerations concerning data usage,” said Nicola McCormic, general conceal at GroupM. "With ethics ranking three times more important to company trust than competence, binary decisions taken on whether data is ‘opted in’ or not are no longer sustainable in our industry. GroupM’s Data Ethics Compass enables us to think more holistically about data use and the impact on the end-user.”

The ad industry is telling California officials that the state is layering confusion upon confusion when it comes to trying to comply with new privacy laws, which they suggest are a moving target that is virtually impossible to hit.

That came in comments to California Attorney General Xavier Becerra on a third set of modifications to the California Consumer Privacy Act, modifications on top of changes proposed in a Nov. 3 ballot initiative that is likely to pass, the ad groups concede.

Related: CCPA Enforcement Begins Without Final Rules

The groups claim the modifications threaten businesses' free speech rights because they "(1) unreasonably restrict consumers from receiving important information about their privacy choices, (2) prescriptively describe how businesses must provide offline notices, and (3) unfairly fail to hold authorized agents to the same consumer notice standards as businesses."

Related: Consumer Groups Have Issues with CCPA

They argue that the changes would do nothing to help consumers, while impinging on businesses' free speech rights. They want the modifications further modified, including by "clarify[ing] that businesses communicating with consumers via telephone may direct them to an online website containing the required opt out notice as an acceptable way of communicating the right to opt out."

Related: Ad Agencies Say California Law Threatens Commercial Speech

Joining in the comments were the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, Network Advertising Initiative, American Advertising Federation, and the Digital Advertising Alliance.

ANA's Dan Jaffe said the new modifications on top of the old modifications on top of the ballot initiative will lead to a "never-ending fight to comply with privacy law in California."

The Senate Commerce Committee waded into the longstanding issue of a national privacy law Wednesday (Sept. 23) with an assist from four former top Federal Trade Commission members and through the new lens of the COVID-19 pandemic.

The committee was holding a hearing on "Revisiting the Need for Federal Privacy Legislation." The revisit was driven in part by the increased use of broadband data during the pandemic, including for telehealth and contact tracing.

Related: Republicans Introduce COVID-19 Tracing Privacy Bill

Sen. Roger Wicker (R-Miss.), chairman of the committee, has joined with other Republicans to introduce the American Framework to Ensure Data Access, Transparency, and Accountability Act (SAFE DATA Act).

That bill is a revise of the United States Consumer Data Privacy Act, a draft of which was released in November 2019.

At the hearing, Wicker said that legislation was two years in the making, with input from a variety of stakeholders, and came even as California adopted its own privacy legislation, the California Consumer Privacy Act. Wicker said that CCPA is difficult to understand and could become more so, arguing that was one reason that federal legislation was needed.

Related: CCPA Enforcement Begins Without Final Rules

Wicker said that the pandemic has shown that national privacy legislation is more necessary than even, including as more data is collected to do contract tracing.

Wicker said the bill gave them a chance to pass privacy law. He asked his colleagues to look seriously at the bill and work together to pass it.

Ranking member Sen. Maria Cantwell (D-Wash.) agreed COVID-19 had put a spotlight on privacy and Congress needs to establish privacy protections. Her version of that is the Consumer Online Privacy Act. She suggested Republican legislation would maintain the status quo, with loopholes that weaken rights by preempting state laws, like the CCPA--California Attorney General Xavier Becerra appeared at the hearing in defense of the law. He said it was the first time people in the state had the ability to tell businesses not to share their information. He called the states "laboratories of democracy."

One of the things she said needs to be in privacy legislation is a private right of action, which the Wicker bill does not include.

Wicker pointed out that other important national privacy litigation including COPPA (the Children's Online Privacy Protection Act) and HIPPA (the Health Insurance Portability and Accountability Act) contain no private rights of action and that CCPA's right is only for a breach. He said that the push for that private right of action is a stumbling block that may prevent overarching national legislation from being enacted. 

The divergence that still remained between Cantwell and Wicker on what should and should not be in a privacy bill is emblematic of the divide between political parties on the issue despite the fact that both agree a national privacy bill is necessary.

But there were signs of a thaw. Former FTC commissioner Julie Brill said there were enough similarities among various privacy bills that she was hopeful a bipartisan national privacy law was achievable. Former Chairman Jon Leibowitz agreed that he was heartened by the similarities.

Sen. Wicker said he agreed there is much to be said for Sen. Cantwell's approach and appreciated Brill and Leibowitz for praising both approaches. He said they needed to remember those similarities as they try to iron out "what differences remain."

Among the takeaways from the hearing:

1. Sen. Cantwell said that the committee Democrats would be issuing a minority report next week on the value of local journalism, particularly in the time of COVID-19.

2. Cantwell also said that whether/how the government violates privacy rights is something the committee should also be looking at.

3. Sen. Wicker said he planned to hold a hearing on the invalidated Privacy Shield, the regime that had allowed U.S. companies to meet the EU's data protection standards, but was thrown out by the EU Court of Justice because it did not feel that the U.S. could hold up its end of the data protection agreement to protect data transferred from the EU to the U.S. given the current state of privacy protections, or lack of them.

4. The FTC either needs more authority, or perhaps a new data privacy protection agency should be created. Currently the FTC can not impose civil penalties for first-time offenses and little rulemaking authority, instead enforcing through lawsuits and settlements.

5. Former FTC chairman Jon Leibowitz said that the fact that he is opposed to preempting state laws does not mean it passing a weaker federal law. He said any new federal law should be at least as strong as the CCPA. Wicker agreed that preemption did not mean weaker protections.

6. Asked by Sen. John Thune (R-S.D.) whether they think that greater transparency from internet platforms about how they filter content is something congress should "address," all four of the former FTC officials said "yes."

New America’s Open Technology Institute (OTI) and almost a dozen other civil society groups are strongly against the Republicans' latest effort to come up with national privacy legislation.

That came in a letter to the Senate Commerce Committee opposing the American Framework to Ensure Data Access, Transparency, and Accountability Act (SAFE DATA Act). 

The committee is holding a hearing Sept. 23 titled "Revisiting the Need for Federal Privacy Legislation."

Related: Senate Commerce to Revisit National Privacy Legislation

The bill, which is a revise of the United States Consumer Data Privacy Act, a draft of which was released in November 2019.

The bill would: 

1. "Require businesses to allow consumers to access, correct, delete, or port their data; 

2. "Prohibit businesses from processing or transferring consumers’ sensitive data without their consent; 

3. "Prohibit businesses from denying consumers products or services for exercising their privacy rights; 

4. "Minimize the amount of consumer data businesses can collect, process, and retain; 

5. "Limit secondary uses of consumer data without their consent; 

6. "Establish uniform data protections across the country enforced by the Federal Trade Commission (FTC) and state attorneys general;

7. "Direct businesses to be more transparent and accountable for their data practices by: 

8. "Require businesses to disclose a privacy policy to consumers detailing their data collection, processing, and transfer activities, and notify consumers of any material changes to those activities;

9. "Require businesses to conduct privacy impact assessments of data processing activities that may present a heightened risk of harm to consumers; 

10. "Require businesses to secure consumers’ data and maintain internal controls and reporting structures to assess data privacy risks to consumers; and

11. "Require online platforms to be transparent about their use of secret algorithms.

12. "Authorize the FTC to develop new rules to expand categories of sensitive data;

13. "Require the FTC to share any information with the appropriate Executive or State agency if it obtains information that a business has processed or transferred consumer data in a way that violates Federal anti-discrimination laws; 

14. "Require the FTC to maintain a data broker registry; 

15. "Expand the FTC’s authority to oversee the data use practices of common carriers and nonprofit organizations; and

16. "Restore the FTC’s authority to obtain monetary remedies for consumers."

That sounds like a lot, but OTI and company don't see it that way. They say it would not protect consumer privacy and lacks the basic principles https://newamericadotorg.s3.amazonaws.com/documents/Public_Interest_Privacy_Principles.pdf) that would have to be in any "meaningful" data protection bill: 1) strong, meaningful and comprehensive privacy protections; 2) civil rights protections; 3) a whole of government approach; and 4) a private right of legal action.

“As Congress revisits the need for federal privacy legislation, members should reject legislative proposals that fail to meaningfully curtail invasive online tracking and data-driven discrimination," said Christine Bannan, policy counsel at OTI. "The SAFE DATA Act would cement the flawed “notice and consent” model that places the burden of protecting privacy on individual users rather than the companies that exploit personal data.”

Both Republicans and Democrats agree there needs to be national legislation, but remain divided over how it should be constructed and enforced. 

Signing on to the letter were Access Now, American Association for Justice, Campaign for a Commercial-Free Childhood, Center for Digital Democracy, Color of Change, Common Cause, Constitutional Alliance, Consumer Action, Consumer Federation of America, Fight for the Future, Free Press Action, Media Alliance, National Hispanic Media Coalition, National Workrights Institute, New America's Open Technology Institute, Parent Coalition for Student Privacy, Privacy Rights Clearinghouse, Public Citizen, Public Knowledge, and U.S. PIRG.

Witnesses for the hearing are former Federal Trade Commissioner Julie Brill and former chairs William Kovacic and Jon Leibowitz, as well as former acting chair Maureen Ohlhausen.

There is bipartisan Hill support, as well as industry support, for some form of privacy legislation. But what form that takes continues to divide legislators along party lines. 

Republican Federal Trade commissioner Noah Phillips said the government should not rush into national privacy legislation.

That came in an interview for C-SPAN's Communicators series.

Phillips has repeatedly said to Congress, privacy means different things to different people. For some he said it meant control of their data, for other it was the security of that data. 

He said that before Congress legislates, he wants it to identify the problems it is trying to solve. "When you say we need privacy, why do we need it," he said, before focusing on the questions around remedies, like: "Should we preempt state laws; "should we have a private right of action [so consumers can file civil suits for violations]"; what about penalties."

Related: Senate Commerce to Revisit National Privacy Legislation

He said Congress needs to get that right, but what he sees currently in the legislative process is that they are fighting about those things. He said it should focus more on what it wants the regime to be: "What do we want to be permitted; what do we want to not be permitted; what do we want subject to a consent requirement and do we want that to be opt in our opt out. There are a lot of thorny questions."

Phillips said of Congress that taking its time is important, "rushing it less so."

The commissioner will likely get his wish about no rush to legislation, but in the near term because an election is intervening, as well as the political divide that continues over issues like opt in and opt out and preemption.

Asked about net neutrality--the FCC returned internet service provider privacy oversight to the FTC with its reclassification of ISPs as information service providers--Phillips said the FTC is currently doing a market research study of internet privacy practices for ISPs but that net neutrality remains fundamentally an FCC issue.

The Communicators interview with Phillips airs on C-SPAN Saturday, Sept. 19, at 6:30 p.m. ET and on C-SPAN2 Monday, Sept. 21, at 8 a.m. and 8 p.m. ET.

People are more willing to share personal information in order to get more customized experiences, a survey by independent advertising and analytics company Innovid found.

According to Innovid, consumer data is core to ad personalization, so it asked consumers how willing they were to share personal information with brands compared to 1-2 years ago. Nearly a quarter of consumers are more willing than years prior, and see value in sharing personal information in exchange for a more relevant, individualized experience from brands. 

After polling more than 1,000 U.S. adults in July 2020, the findings show that nearly a third of respondents like the ads they see to be personalized and 30% like brands more when they personalize ads. 

“Make no mistake, despite this increase, consumers are overall more discerning about the information they share with third parties today,” said Stephanie Geno, senior VP of marketing at Innovid.. “This comes as no surprise as privacy concerns on platforms like TikTok have recently come to light, making consumers reassess what and how they’re sharing information with brands and platforms. However, if their data is used to deliver a better overall experience and true utility, the incentive for data-sharing becomes much stronger. Marketers need to provide a clearer value exchange to win consumer consent and buy-in.” 

The study found that consumers are most comfortable sharing data about the things they like and dislike. They’re also comfortable sharing gender information, location and their birthday. They were less willing to provide browser histories, employment information and income.

Consumers said they would be even more comfortable with sharing personal information if brands were more transparent about how the data was being collected. Among the respondents, 35% said they wanted to be able to dictate data collection preferences, 12% said they wanted brands to share data collection policies and 7% would like a data collection certification. 

Overall 57% said there were methods that could make them more comfortable with sharing data and 43% said they just weren’t comfortable sharing data.

“The data show brands aren’t doing enough to personalize across channels, although consumers have voiced a desire for it, which leads to a consumer ad experience that is lacking or low impact,” said Geno. “To adapt to the needs and wants of the Now Consumer, marketers need to prioritize personalization and make it a key part of their omni-channel strategy.”

Senators from both sides of the aisle expressed their concerns to Twitter Thursday (July 16) following reports of a massive bitcoin-related hack that affected high-profile accounts from Bill Gates to Joe Biden. 

Reportedly, the accounts were hacked to send tweets to followers asking them to donate to a cryptocurrency account. 

"I understand that Twitter is investigating the matter and has taken steps to remove the offending tweets," Sen. Roger Wicker (R-Miss.), chairman of the Commerce Committee, said in a letter to Twitter CEO Jack Dorsey. "But it cannot be overstated how troubling this incident is, both in its effects and in the apparent failure of Twitter’s internal controls to prevent it." 

“I’m extremely troubled by this hack of Twitter accounts,” said Sen. Ed Markey (D-Mass.) one of Congress' longest and strongest voices for consumer privacy. “While this scheme appears financially motivated and, as a result, presents a threat to Twitter users, imagine if these bad actors had a different intent to use powerful voices to spread disinformation to potentially interfere with our elections, disrupt the stock market, or upset our international relations," he said in a statement. "That is why Twitter must fully disclose what happened and what it is doing to ensure this never happens again. This hack also make clear how essential it is that we establish strong cybersecurity standards to protect Americans’ from scams, misinformation, and data theft online.” 

Wicker agrees with the potential for such hacks to extend beyond stealing. "It is not difficult to imagine future attacks being used to spread disinformation or otherwise sow discord through high-profile accounts, particularly through those of world leaders," he told Dorsey. 

In the wake of the hack, Fight for the Future has launched a campaign to get the company to implement default end-to-end encryption on its Direct Messages (DMs), though it was not clear whether the hack extended to DMs.

The bipartisan Exposure Notification Privacy Act has been introduced in the Senate, a bill that would protect consumer privacy in COVID-19 tracking apps and put public health agencies at the controls. 

The bill would ensure that participation in commercial notification systems is voluntary, with "strong" controls over consumers' personal data and limits on the type collected and how it can be used, according to Cantwell's office. 

Related: Big Data Hearing Raises Big Questions

Public health officials are exploring using exposure notification technologies to track and stem the spread of COVID-19. 

The bill was introduced by Sens. Maria Cantwell (D-Wash.), ranking member of the Senate Commerce Committee and Bill Cassidy (R-La.). Sen. Amy Klobuchar (D-Minn.) will co-sponsor the bill.   

“Public health needs to be in charge of any notification system so we protect people’s privacy and help them know when there is a warning that they might have been exposed to COVID-19,” said Cantwell. 

The bill would:  

1. "Require that public health officials be involved with the deployment of any exposure notification systems. In order to give consumers the confidence they need that the apps they are using are legitimate and not created by unqualified actors, public health officials would be involved in the deployment of any commercial apps used by consumers. 

2. "Allow only medically-authorized diagnoses be submitted to exposure notification systems. In order to guard against false reports, exposure notification systems would only accept authorized medical diagnoses. 

3. "Require that participation be voluntary and based on consumer consent. In order to protect consumer choice, participation in exposure notification systems would be voluntary and require affirmative, express user consent. 

4. "Limit the collection and use of data to that which is necessary for the purpose of the system and prohibit any commercial use of data. In order to protect user rights and privacy, apps would be prohibited from collecting or using any data not absolutely necessary and would be strictly prohibited from using data for any commercial use. 

5. "Allow participants to delete their data from an exposure notification system at any time. In order to protect consumer privacy and safeguard consumer rights, users would be able to delete their data from the systems at any time. 

6. "Prohibit discrimination against an individual based on information provided to an exposure notification system. In order to safeguard users and promote participation, the legislation prohibits discrimination against any individual in places of public accommodation based on the information they provide to an exposure notification system, or based on their choice not to participate. 

7. "Create strong data security safeguards. In order to protect user data, the legislation creates comprehensive data security requirements and obligations to immediately notify individuals in the event of a security incident. 

8. "Create strict enforcement measures. In order to ensure consumer rights are protected, federal and state authorities would be empowered to prosecute violations and pursue strong penalties, and state laws and rights will be preserved." 

"We need to regulate apps that provide COVID-19 exposure notification to protect a user’s privacy, prevent data misuse, and preserve our civil rights -- and this bill offers a roadmap for doing all three," said Public Knowledge policy counsel Sara Collins. "The bill marks a valuable first step in the long road ahead to protecting Americans’ data."  

“The novel coronavirus pandemic presents one of the greatest national and personal security challenges in recent history," said National Urban League senior VP of policy and advocacy Clint Odom. "The times demand a contact tracing effort of historic human and technological proportions. The Exposure Notification Privacy Act can help us flatten the curve and perhaps get ahead of it. Contact tracing technology can only gain widespread adoption with the features of consumer choice, data protection, and limited duration." 

High-profile Senate Republicans say they plan to introduce a data privacy bill, the COVID-19 Consumer Data Protection Act, that would hold companies accountable for their use of personal data to fight the COVID-19 pandemic. 

There are concerns that contact-tracing technology employed by companies including Apple and Google could wind up producing a surveillance state or put consumer data at risk for misuse or follow-on use by third parties. 

Related: Sen. Markey Pushes Back on White House Pandemic Database

They say the bill would give Americans more "transparency, choice, and control" over the collection of health, geolocation and proximity data, all key to contact tracing, and would "hold businesses accountable to consumers if they use personal data to fight the COVID-19 pandemic." 

The "they" in this case are Senate Commerce Committee Chairman Roger Wicker (R-Miss.), chairman of the Senate Committee on Commerce, Science, and Transportation, Communications Subcommittee Chairman John Thune (R-S.D), Consumer Protection Subcommittee Chairman Jerry Moran (R-Kan.), and Sen. Marsha Blackburn (R-Tenn.). 

The senators suggested that while the severity of the health crisis can't be overstated, the importance of individual privacy, even in times of crisis, should not be undervalued. 

Complete Coverage: The Coronavirus Pandemic

“This bill strikes the right balance between innovation – allowing technology companies to continue their work toward developing platforms that could trace the virus and help flatten the curve and stop the spread – and maintaining privacy protections for U.S. citizens," said Thune. 

The bill would: 

1."Require companies under the jurisdiction of the Federal Trade Commission to obtain affirmative express consent from individuals to collect, process, or transfer their personal health, geolocation, or proximity information for the purposes of tracking the spread of COVID-19. 

2. "Direct companies to disclose to consumers at the point of collection how their data will be handled, to whom it will be transferred, and how long it will be retained. 

3. Establish clear definitions about what constitutes aggregate and de-identified data to ensure companies adopt certain technical and legal safeguards to protect consumer data from being re-identified.

4. "Require companies to allow individuals to opt out of the collection, processing, or transfer of their personal health, geolocation, or proximity information. 

5. Direct companies to provide transparency reports to the public describing their data collection activities related to COVID-19.

6. "Establish data minimization and data security requirements for any personally identifiable information collected by a covered entity. 

7. "Require companies to delete or de-identify all personally identifiable information when it is no longer being used for the COVID-19 public health emergency. 

8. "Authorize state attorneys general to enforce the Act."

Consumer and human rights groups from around the world are calling on governments and educators to protect children from commercial exploitation during the COVID-19 pandemic. 

Related: Dems Seek Government Privacy Protections for EdTech-Collected Kids Data

Distance learning could become the new normal. For example, the White House is proposing that all school-age children get high-speed broadband access and teachers get training in online curricula as part of his plan to reopen the economy. 

Given that new reality, the groups want to make sure that in the rush to deliver online instruction, children's rights, to privacy and others, are not undermined with effects lasting beyond the crisis. 

Related: Dems Seek Distance Learning Dollars in COVID-19 Aid Bill

In an "open letter," the groups ask data protection authorities to get together to publish guidelines, monitor companies and enforce compliance for e-learning platforms and edtech.  

And with government putting millions into edtech and connectivity, the groups want governments to take responsibility for the products they subsidize or recommend, and to make upholding children's rights--as recognized by the UN--the quid pro quo. 

Related: For all the Latest News on COVID-19 Impact on Industry

They said kids deserve a "secure space" to learn "without commercial interference," the point being that children's mandatory online participation not be "exploited." 

Singing on to the letter were Defend Digital Me; Campaign for a Commercial-Free Childhood; Access Now; Aspiration; Badass Teachers Association; Berkeley Media Studies Group; Biometrics-in-Schools; Bolo Bhi; Child Rights International Network (CRIN); Consumer Action; Consumer Federation of America; Corporate Accountability; Digital Rights Foundation; EDRi (European Digital Rights); Educadigital Institute - Open Education Initiative; Electronic Frontiers Australia (EFA) Inc.; Electronic Privacy Information Center (EPIC); El Instituto Panameño de Derecho y Nuevas Tecnologías (IPANDETEC); Instituto Alana; New Dream; Obligation, Inc.; Open Rights Group; Parent Coalition for Student Privacy; Parents Across America; Parents Together; P.E.A.C.E. (Peace Educators Allied For Children Everywhere); Privacy International; Privacy Salon; Public Citizen; Public Knowledge; TEDIC (The Association of Technology, Education, Development, Research, Communication); TRUCE (Teachers Resisting Unhealthy Childhood Entertainment); and Women Leading in AI Network.

Rep. Suzan DelBene (D-Wash.) is calling on the Trump Administration and tech companies to adhere to data privacy standards as they use Big Tech to help track, and ideally, control, the spread of the coronavirus. 

Related: White House Calls for Mining COVID-19 Data 

She was responding to Google's publication of cell phone location data reports from 131 countries showing how people are following social distancing mandates. 

She acknowledged that the pandemic requires using "every tool in our tool belts" to slow the spread, but does not want those tools abusing people's sensitive information. 

Related: Senate Commerce Schedules COVID-19 Paper Hearing

“The Trump administration and tech companies should set the global standard by adopting data privacy principles around anonymization, use limitations, data security, prohibiting re-identification, and destruction after the pandemic," she said. 

She pointed out that telecoms have restrictions on data sharing, but tech companies like Google and Facebook do not. She said the pandemic underscored the need for federal privacy legislation.

Consumer Reports has called on California attorney general Xavier Becerra to reject industry efforts to delay the enforcement of the California Consumer Privacy Act (CCPA). 

The law went into effect Jan. 1, but the state has yet to finalize rules to enforce it, rules that are supposed to be in place by midyear. 

Almost three dozen trade associations including the Association of National Advertisers, American Advertising Federation and the Association of Magazine Media, are invoking the coronavirus pandemic in asking California to delay enforcement. 

Some of the same advertiser groups argued for a similar delay back in January. 

By contrast, Consumer Reports suggests the pandemic put an exclamation point on the need for the law.  

"This latest effort to avoid complying with the CCPA comes as more and more consumers increasingly rely on online communications to work, stay in communication with healthcare professionals, and obtain access to necessary supplies," Consumer Reports said Monday (March 23). 

“It is more critical than ever for policymakers to ensure fairness, safety, and transparency for consumers in the marketplace," said Justin Brookman, Consumer Reports’ director of privacy and technology policy. "The law has been in effect for over three months. This is a cynical attempt by industry to avoid honoring California consumers’ constitutional right to privacy, and industry shouldn’t exploit the health crisis to ignore consumer requests to companies to stop selling their data. We hope the Attorney General does the right thing and begins enforcement as scheduled.” 

The advertisers said that coming up with "innovative business procedures" to comply with the new law and enforcement regime is a formidable task, and too tall an order when many of those workers are at home and all are "doing their best to manage their personal and professional lives in the face of uncertain times." 

They said they support privacy--though many including ANA was not a fan of how the bill tries to secure it--but want the extra time to "understand and effectively operationalize" the new rules. 

More Democrats weighed in Thursday (March 19) to raise caution flags over the Trump Administration's discussions with tech companies about using smart phone location data to help combat the coronavirus by tracking its movement. 

Phone companies have to collect location data to provide the underlying service, so users don't have the option of blocking that collection. 

Related: Sen. Markey Concerned About Coronavirus Geolocation Tracking 

While Sen. Ed Markey (D-Mass.) wrote to U.S. CTO Michael Kratsios to register his concerns about the data collection, Reps. Suzan DelBene (Wash.) and Anna Eshoo (Calif.), joined by Sen. Ron Wyden (Ore.), aimed higher.  

In a letter to President Donald Trump and Vice President Mike Pence, the legislators said they supported bold moves to stem the crisis, but that "prohibiting government intrusion into the private lives of Americans is, and has always been part of the DNA of our country." 

The trio called on the White House to protect personal location and health data by adopting various privacy principles, including 1) data minimization and anonymization, 2) preventing the data from any other uses--behavioral targeting, for example, or by law enforcement or immigration agencies--and 3) destroying data after the pandemic is over.

Sen. Ed Markey (D-Mass.) said he is concerned about reports that the White House Office of Science & Technology is considering partnering with Google, Facebook, IBM and others to analyze geolocation technology to stop the spread of the coronavirus. 

In a letter to chief technology officer Michael Kratsios, Markey cited a Washington Post story that the White House is talking with tech companies about tapping into smart phone geolocation to track the virus. 

Related: White House Calls for AI Mining of New COVID-19 Database

Markey said he agrees that there needs to be tech innovation and collaboration with the private sector to combat the virus. But he said he is concerned about a "wholesale privacy invasion." 

He urged them to balance privacy with any data-driven solutions to the current pandemic. 

He conceded the Post story said that the Administration was not looking to create a database of people's whereabouts, but is instead “looking to leverage aggregated, anonymized data to glean key insights for COVID-19 modeling efforts.” 

But Markey said that is not sufficient to protect against privacy violations. 

Markey wanted answers to the following questions by March 26: 

1. "Please identify any companies with which the Administration is collaborating to use location data for fighting COVID-19 and describe the nature of these collaborations in detail. 
2. "Please describe the location data to be used in any projects that the Administration is considering, including the granularity of data, how it was initially collected, how it is being anonymized and aggregated, and how the Administration is ensuring that it cannot later be de-anonymized.
3. "Please detail the evidence-based rationale for these collaborations and the specific objectives they aim to achieve.
4. "How will any data be collected and stored, and what data security safeguards will be in place to protect this data from malicious attacks or inappropriate access?
5. "Who will have access to location data collected for fighting COVID-19? Will you restrict use of this data solely to purposes of fighting COVID-19? If not, why not? 
6. "Will you ensure that the government stops collecting location data and disposes of any collected data once the COVID-19 health crisis has been resolved? If so, please describe your plans for this data disposal in detail. If not, why not?" 

Almost three dozen trade associations including the Association of National Advertisers, American Advertising Federation and the Association of Magazine Media, are invoking the coronavirus pandemic in asking California to delay enforcement of a new privacy law, the California Consumer Privacy Act (CCPA), until Jan. 2, 2021. 

The California Consumer Privacy Act (CCPA) went into effect Jan. 1, but the state has yet to finalize rules to enforce it, rules that have to be in place by mid year.  

Some of the same groups, including ANA and the IAB, argued for a similar delay back in January, citing the "extraordinary complexity of the law and the wide range of open issues to be clarified" as the reason for seeking a similar six-month delay from July 1, 2020. 

In a letter to California Attorney General Xavier Becerra Thursday (March 19) , they said that "given current events and the presently unfinished status of the regulations implementing the CCPA, businesses will not have the operational capacity or time to bring their systems into compliance with the final regulatory requirements." 

They argue that coming up with "innovative business procedures" to comply with the new law and enforcement regime is a formidable task, and too tall an order when many of those workers are at home and all are "doing their best to manage their personal and professional lives in the face of uncertain times." 

They say they support privacy--though many including ANA were not fan of how the bill tries to secure it--but want the extra time to "understand and effectively operationalize" the new rules. 

ANA has also argued that the law as approved could damage the California economy, an economy that, like all state economies, faces tough times ahead without that added issue.

Policymakers "need to take a fresh look at existing allocations of spectrum, including the allocation of spectrum to broadcasters" to determine if "that spectrum is still needed by the broadcast industry or if it is better used in other areas," said Jim Ciconni, senior executive VP of AT&T at a Washington think tank event. Criticizing 50-year-old government policies, Ciconni also pushed for re-examination of the spectrum reserve that is hoarded by federal agencies, especially the Defense Department, that could be reassigned or shared for commercial purposes.

Claiming that the "government put its thumb on the scale" when it gave TV operators so much spectrum, Ciconni argued that, "It's time to take a fresh look ... at the geographic monopoly bestowed by the government" to broadcasters, whom, he charged, are not fulfilling the obligations of their licenses - especially since they rely on MVPDs for much of their distribution and revenue.

Ciconni also said its time to reexamine the policy preferences given to digital platforms when they emerged in the 1990s, when the internet was nascent. He said some of those policies "make little sense today."

Cicconi eased into his assaults on broadcasting and digital behemoths by questioning the large spectrum reserve held by the federal government, especially by the Defense Department.

"The issue that cries out for Congressional action is the immense amount of spectrum still held by the Federal government," citing the value of "sharing Defense Department spectrum if we're to move forward," he said.

AT&T's D.C. lobbyist, who acknowledged he holds the job on an "interim" basis (called back six months ago after a two-year retirement), focused on broadcasters' "ineffective" use of airwaves and the "unlevel playing field" at a time with growing demand for wireless spectrum.

"Stations are not owned by locals to the extent they were 50 years ago," he said, citing the "conglomerates and hedge funds" that now hold TV licenses. He claimed that TV stations do not fulfill "the social contract" that was part of their local license agreement. In particular (reflecting AT&T's ownership of the fading DirecTV service), Ciconni denounced the "constant blackouts and threats of blackouts ... [that] have ticked off customers, who are leaving broadcast for streaming services."

"The status quo is not sustainable," Ciconni said.

Ciconni waived off a question from Multichannel News about the potential impact of ATSC 3.0 ("NextGen TV"), which enables broadcasters to offer internet protocol wireless services, potentially in competition with telecom 5G ventures.

"I don't really know," Cicconi chuckled.

Unified Privacy Accord, Wireless Policies on Agenda Albeit Washington Priorities Uncertain

Ciconni's tirade was part of the centerpiece panel during the Free State Foundation's 12th annual Telecom Policy Conference in Washington on Tuesday, March 10. Reflecting the theme of the event ("Broadband Beyond 2020: Competition, Freedom, and Privacy"), the panel delved into an array of issues, supplementing points made by the program's keynoters from the White House, Department of Justice, Federal Trade Commission and Federal Communications Commission.

Related: DOJ's Rosen Signals Possible Action if Big Tech Proves 'Innovation' Threat

FTC commissioner Christine Wilson led the call for a single nationwide privacy policy rather than the evolving state-by-state privacy process that is emerging now that the California Consumer Privacy Act has gone into effect. Wilson cited studies showing that consumers don't understand how personal information is used, and acknowledged that "although I have great faith in markets, sometimes legislation is necessary" to assure that consumers are treated fairly.

"Government intervention through the form of privacy legislation may help consumers," she said, urging a "comprehensive privacy" law, and recommending that "the FTC ... should be the enforcement agency." She also suggested that the FTC "should have jurisdiction over non- profits and common carriers" that collect large amounts of personal data. Preemption is key to precluding a patchwork of state laws that will hinder businesses and data flows, Wilson said.

After endorsing continued use of the FCC's Restoring Internet Freedom Order, Wilson pointed out that the FTC is "actively strengthening its existing expertise in broadband and technology markets." She cited the newly created "technology enforcement division," whose jurisdiction includes internet policies and called the group "incredibly busy."

WiFi-6 vs. 5G, 5.9 GHz and Beyond, Despite Shifting Policy Landscape

During the conference's panel discussion on spectrum usage, the focus turned to licensed versus unlicensed allocations - and a total geek-fest evolved.

"If we don't have more spectrum, then WiFi in homes and offices will become a chokepoint," warned Mary Brown, senior director for technology and spectrum policy at Cisco. She said that more unlicensed spectrum is vital "to keep up with DOCSIS 3.1 and DOCSIS 4.0, which is on the drawing board."

"Unlicensed is part of our 5G future," she said, emphasizing that it is necessary because "our broadband speeds are increasing."

Brown added that "the point of opening up the 6 GHz band" is to capitalize on the "fixed inks that are already there."

The panel agreed that the evolution of WiFi 6 (the next generation of near-range wireless service) is part of the rollout of 5G systems.

James Assey, executive VP of NCTA - the Internet and Television Association, insisted that, "we need both [licensed and unlicensed spectrum]."

"We need a balanced spectrum policy that ... recognizes the tremendous value in unlicensed spectrum," he said. "Unlicensed has shown it can revolutionize how people use that band. ... We are going to need ...both sufficient spectrum for licensed users and to support unlicensed and gigabit WiFi ... [which] will serve as a backbone for future services."

As for the evolving FCC decision on use of the 5.9 GHz spectrum, Brown explained that the "5.9 band is a difficult problem." She cited the FCC proposal to continue to silo part of that spectrum for Intelligent Transportation Service.

"However, radio [can be] untidy," she said. "You'll need rules about adjacent channel use." Brown expects that the way in which the FCC "resolves that problem will be critically important." She cited the cable industry's views on preserving the bottom of that bandwidth for specific uses.

Assey pointed out that 5.9 GHz band has been "a vacant lot" for past 20 years, and he complimented FCC chairman Ajit Pai for beginning a probe into how to use it to create "a new gigabit channel."

While the technology lobbyists concurred on the range of policy issues ahead, they were less sanguine about resolutions in the current unsettled political environment. For example, when asked about the role of the Interdepartment Radio Advisory Committee (IRAC), the speakers diverted to a discussion about the status of its parent National Telecommunications and Information Administration, which has been led by a succession of "acting" officials.

Cicconi complained that the agency is "semi-dysfunctional," because "you don't have any degree of continuity ... [without] a Senate-confirmed position" heading the agency. Without such leadership, Cicconi said, "It's hard to make policy."

Brown supported the efforts of the agency, but added that,"without consensus, decision don't get made." She also fretted that "lurching toward security policy ... is not a great way to proceed. I hope for better days ahead."

Other speakers at the FSF event included FCC chairman Ajit Pai, who appeared via a 10-minute video recording. He updated the group about the FCC's 5G, rural broadband and other developments. Robin Colwell, special assistant to the president for Technology, Telecom and Cybersecurity, read a prepared presentation about White House focus on rapid 5G deployment, mid-band spectrum availability and the Administration's goal to promote 5G security worldwide. FCC commissioner Michael O'Rielly and former commissioner Mignon Clyburn chatted about telehealth, rural broadband in a final on-stage conversation with FSF president Randy Mays, foreshortened because FCC commissioner Brendan Carr could not join the group.

Major advertising associations have called on California Attorney General Xavier Becerra to delay enforcement of the state’s tough new privacy law, the California Consumer Privacy Act, which went into effect Jan. 1, though a formal enforcement framework has yet to be hammered out.

The Association of National Advertisers (ANA), American Association of Advertising Agencies, American Advertising Federation (AAF), Interactive Advertising Bureau (IAB), and Network Advertising Initiative (NAI) told Becerra that the thousands of companies they represent need more time to review and implement the final regs once they are released.

RELATED: IAB Floats CCPA Compliance Framework

The industry groups argued that even though the law went into effect, how it will be overseen and enforced has yet to be determined so it is unclear what the compliance obligations will be.

"Given the extraordinary complexity of the law and the wide range of open issues to be clarified from the draft guidance, there will not be sufficient time for many businesses to effectively implement the final regulations prior to the anticipated enforcement date of July 1, 2020," they said.

There could be even less clarity if the rules change between now and when they are finalized, the groups added.

They say the law should not be enforceable until six months after the final rules are released, rather than the current July 1 trigger date.

The new year has brought new action on the privacy front as states and the federal government try to figure out how to protect user data while allowing it to be monetized to support the free internet content model the country has come to rely on.

The alternative could be a Balkanized internet with sites charging for access and users asked to determine for themselves what information they want to share and when they want to share it.

While access and choice was once the mantra — and access still is — privacy activists are concerned that choice could become a synonym for putting the onus on users to figure it all out. For their part, websites would simply provide transparency about all that collection — likely in slightly larger type or in less Byzantine privacy policies.

Platforms big and small are concerned that if an approach like the tough California privacy law that just went into effect becomes a road map for federal legislation — which many Democrats looking to capture both House and Senate in the fall would like — the free online model could definitely be in trouble.

Amazon is no fan of the California Consumer Privacy Act (CCPA), particularly of its broad definition of personal information. The bill established a consumer right of privacy based on disclosure, the right to opt out of data collection or third-party sharing and the right to have data deleted if a user so chooses.

One site dedicated to providing info on where to find radio stations on the internet (StreamingRadioGuide.com) closed its doors at the end of the year, citing the California privacy law. “I have decided to cease operations rather than face the potential legal threats from the California Consumer Privacy Act (CCPA), which goes into effect at midnight on January 1st, 2020,” Fred Stiening, the site’s founder, said in a note to former users.

All of that comes against a backdrop of tension and suspicion aimed from inside the Beltway toward Big Tech in general over breaches and data over-sharing and under-informing, not to mention “real” fake news, election ad issues, accusations of bias and attacks from both the right and the left at web platforms’ current shield from legal liability over third-party content.

Looking to steer that model toward self-regulation, the Trump administration’s National Institute of Standards and Technology (NIST) has released a guide to privacy best practices.

The idea is to continue to get the benefits of data collection while mitigating the privacy risks and avoiding a one-size-fits-all approach, an approach which deregulatory types often associate with "heavy handed" government regulation.

The self-regulatory framework is not binding, but is instead meant to be a tool for privacy-by-design practices that put privacy risks on the same level as other risks.

It is billed as supporting:

• “Building customers’ trust by supporting ethical decision-making in product and service design or deployment that optimizes beneficial uses of data while minimizing adverse consequences for individuals’ privacy and society as a whole;

• “Fulfilling current compliance obligations, as well as future-proofing products and services to meet these obligations in a changing technological and policy environment; and

• “Facilitating communication about privacy practices with individuals, business partners, assessors and regulators.”

NIST said the framework is the result of input from public and privacy stakeholders and the product of three workshops, requests for info and comment, five webinars and hundreds of stakeholder meetings.

The National Institute of Standards and Technology (NIST) has published a guide to privacy best practices, "Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management." 

The idea is to continue to get the benefits of data collection while mitigating the privacy risks while avoiding a one-size-fits-all approach, an approach which deregulatory types often associate with "heavy handed" government regulation.  

Related: Commerce Releases Suspect Tech-Vetting Framework 

The self-regulatory framework has no force of law and is not binding on anyone. Instead, it is meant to be a tool for privacy-by-design practices that put privacy risks on the same level as other risks and is meant to work in concert with the "Framework for Improving Critical Infrastructure." 

Related: Ad Groups Form Privacy Coalition 

It is billed as supporting:  

• "Building customers’ trust by supporting ethical decision-making in product and service design or 

deployment that optimizes beneficial uses of data while minimizing adverse consequences for individuals’ privacy and society as a whole;1 

• "Fulfilling current compliance obligations, as well as future-proofing products and services to meet these obligations in a changing technological and policy environment; and 

• "Facilitating communication about privacy practices with individuals, business partners, assessors, and regulators." 

NIST says the framework was the handiwork of public and private stakeholders and the product of three workshops, requests for into and comment, five webinars and hundreds of stakeholder meetings.  

Given the almost daily news about a new security breach, it is impossible to conclude that the tech industry is doing enough to protect privacy.

That was the message from Democratic Federal Trade Commission member Rebecca Slaughter at a Chief Privacy Officer roundtable at CES 2020 in Las Vegas. She said it would not make much sense to draw that conclusion.

But while that general conclusion is pretty straightforward, Slaughter told her tech company audience, what to do about it can not be generalized. She said that is very company-specific and industry-specific and practice specific, and to protect not just from today's harms but ones that can be "downstream" but a result of current practices.

Jane Horvath, Apple's top privacy officer, agreed that the tech industry can never say that it is doing enough to protect privacy, but said that Apple was focused on privacy by design and had the buy in of its top management. "We should always be doing more," she said. "We always have to be pushing the envelope."

She said Apple was focused on putting consumers in control of their data.

Facebook chief privacy officer Erin Egan, whose company last fall agreed to pay $5 billion to settle an FTC complaint about handling of user data, said Apple's privacy-by-design approach resonated with how Facebook approached privacy, citing the built-in accountability in their FTC settlement order.

Egan said the key is what people "expect" about how their data is being collected and used. She said the heavy lifting will be making sure that people understand that.

She talked about the company's launch of a "privacy check-up" tool to help users know who is using the data, and why, and whether they are comfortable with that.

Slaughter pushed back on some of the "consumer in the driver" seat focus. She said consumer control is important, but that she is concerned about a universe in which "the entirety of the burden is to protect one's data lies with the consumer."

She said that even if consumers can "walk through a privacy checkup," the amount of info they would need to process to understand what is happening to their data is "untenable." She said she is pretty savvy about privacy and she can't possible figure out what is being done with all her info in first-party relationships, not to mention third-party sharing.

She said there also needed to be some burden shifting to the "collectors and stewards" of the data, for example to minimize the data collected so there is not an "endless trove" that can disappear into the ether.

Horvath said Facebook does use data minimization principles, including "differential privacy," which is giving consumers choice without their sacrificing privacy," and on-device privacy, so that the devices are "smart" and can see the info--like facial recognition--but Apple doesn't.

Egan agreed with Slaughter that the user should not be burdened, and pointed out that on the policy front, the legislative model is moving away from consent to responsibility, fiduciary obligations and accountability for the platforms, as well as de-identifying and differential privacy.

But she said while some smarts reside on the device, like an Oculus, but that it can't always stay there because people come to Facebook to share and connect. "That needs centralization." But she said that doesn't mean it is less privacy protected.

Egan said she thought privacy was protected today on Facebook. Slaughter said she did not want to talk about specific services, but said she did not think privacy was currently protected today "as a general matter."

The Federal Trade Commission has given commenters a couple more days to weigh in on its enforcement of the Children’s Online Privacy Protection Act via its COPPA Rule. It had already extended the deadline from Oct. 23 to Monday (Dec. 9).

The new deadline is by 11:59 p.m. on Dec. 11. 

That is because the federal government's Regulations.gov portal is "temporarily inaccessible." 

The FTC is also allowing commenters to submit their comments by e-mail (secretary@ftc.gov). The vote to extend was 5.0.

Sen. Ed Markey (D-Mass.) provided a ringing denunciation of Amazon's privacy policies and civil rights protections--or lack of them--related to its Ring internet-connected video doorbell. 

Markey's investigation began in September and he said Tuesday (Nov. 19) that the findings showed "an alarming disregard for basic privacy protections for consumers, as well as a lack of codified rules or policies to protect consumers from invasive or even discriminatory information-gathering practices." 

Markey broke out his denunciation in the following list: 

• "Ring has no restrictions on law enforcement sharing users’ footage with third parties
• "Ring has no policies that prohibit law enforcement from keeping shared video footage forever
• "Ring has no evidentiary standard for law enforcement to request Ring footage from users
• "Ring refuses to commit to not selling users’ biometric data
• "Ring has no oversight/compliance mechanisms in place to ensure that users don’t collect footage from beyond their property
• "Ring has no oversight/compliance mechanisms in place to ensure that users don’t collect footage of children
• "Ring has no compliance mechanisms in place to prohibit law enforcement from requesting and obtaining footage that does not comply with Ring’s Terms of Service."

To check out Amazon's responses as part of the Markey investigation click here and here. 

“Ring users place their trust in us to help protect their homes and communities, and we take that responsibility very seriously," said a Ring spokesperson. "Ring does not own or otherwise control users’ videos, and we intentionally designed the Neighbors Portal to ensure that users get to decide whether or not to voluntarily provide their videos to the police. Details about how we work with law enforcement and how we protect user privacy can be found in the following blog post by Jamie Siminoff, Founder of Ring.”

Leading Energy & Commerce Committee Democrats have asked the CEOs of Google and health care provider Ascension for briefings with the companies on reports that Google got access to tens of millions of patient health records as part of the "Project Nightingale" initiative.

That came in letters to both companies.

The legislators want a briefing by Dec. 6 on the project, including how the data is being used and shared, who at Google/Alphabet has access to it, the extent to which patients were informed about the use of their data, and how the companies are protecting privacy

“While we appreciate your efforts to provide the public with further information about Project Nightingale, this initiative raises serious privacy concerns,” they wrote to the companies. For example, longstanding questions related to Google’s commitment to protecting the privacy of its own users’ data raise serious concerns about whether Google can be a good steward of patients’ personal health information.   

"Additionally," they said, "despite the sensitivity of the information collected through Project Nightingale, reports indicate that employees across Google, including at its parent company Alphabet, have access to, and the ability to download, the personal health information of Ascension’s patients. Concerns have also been justifiably raised about Ascension’s decision not to notify its patients that their information would be shared with Google or how their information would be used." 

Signing on to the letter were Energy & Commerce Committee Chairman Frank Pallone, Jr. (D-N.J.), Health Subcommittee Chairwoman Anna G. Eshoo (D-Calif.), Oversight and Investigations Subcommittee Chair Diana DeGette (D-Colo.), and Consumer Protection and Commerce Subcommittee Chair Jan Schakowsky (D-Ill.).  

Eight out of 10 people say that the potential benefit from widespread data collection by companies is not worth the risks. A smaller, but still two-thirds (66%), majority say the same about government data collection.  

Given that result, it is no surprise that almost as many 79% say they are concerned about the way their data is used after it is collected by companies, with 64% saying the same about the government.  

But in either case, a majority say there is nothing they can to do stop it. 

That is according to a new Pew Research Center survey on digital privacy. 

It found that 79% said they were not confident that companies will admit mistakes or take responsibility for misuse of personal data. 

"Eight-in-ten adults say they are at least a little concerned about how much personal information social media sites (85%), advertisers (84%), or companies they buy things from (80%) might know about them," the survey found.

Data security is also a big concern, with 70% saying their personal data is less secure than in the past, with only 6% saying they believe data is more secure now. 

The survey found that six of 10 U.S. adults say they do not think it is possible to through daily life without having data collected on them by both. 

There are some race-based differences in views of privacy. 

Blacks (60%) are much more likely than whites (43%) to say they think the government is tracking most or all of what they do on their computers, tablets and phones.  

The survey was conducted June 3-June 17, 2019, among a total of 4,272 U.S. adults. The margin of error was 1.9 percentage points. 

Sen. Josh Hawley (R-Mo.) read TikTok and Apple the riot act in absentia Tuesday (Nov. 5) after the Chinese-backed social media platform and the social media giant declined to send representatives to his hearing on Big Tech's data handling, or mishandling, and risks from their connections to China. 

Sen. Hawley began the hearing asking about all the data TikTok is collecting from American users. Hawley warned that the short-form mobile video platform and its massive data collection could be leveraged by the Chinese government against the U.S. 

He then lit into Apple for providing cloud services to China.

Hawley said he wanted to get it on the record that TikTok is collecting "a lot of data," including content, location, contacts, behavioral data on use of the platform, and information from messages and users' phone books. 

He said that was comparable to the "massive data harvesting" machines Google and Facebook. 

And while TikTok said that data is stored in the U.S. and Singapore, Hawley pointed out that TikTok's parent is ByteDance, which is based in China and subject to a 2017 Chinese national intelligence law that requires Chinese companies to cooperate with state intelligence work. 

He said that means TikTok's doors could be opened at any time to the Chinese Communist Party and Beijing could tell parent ByteDance to scoop up data on Americans and give it to Beijing. 

Hearing witness Klon Kitchen, senior research fellow at the Heritage Foundation, said that was "without a doubt true." 

Related: Sen. Whitehouse Hammers Social Media

Hawley ticked off some of the ways TikTok or another Chinese platform could abuse all that data, particularly using data to help artificial intelligence train autonomous weapons systems to identify targets--China is reportedly investing heavily in AI tech. 

Asked how the U.S. could ensure that TikTok or other Chinese tech companies weren't Trojan Horses gathering data on Americans and sending it back to the Chinese government. "I'm not sure we can," said Kitchen. He said that anyone who thinks a Chinese company, even if a portion of the company is in the U.S., can say no to the Chinese government, "that is a fundamental misunderstanding of the way the government in Beijing works." 

Apple, which was another hearing no-show, took it on the chin from both Hawley and Kitchen. 

Hawley said he was concerned about American companies--specifically Apple, which provides cloud services to China--storing both data and the tools to decrypt it in China.  

Kitchen said that while Apple was providing decryption keys for Chinese data stored there, doing so would give China a better understanding of the inner workings of Apple's iCloud accounts and could allow them to collect data "outside of that border." 

Hawley asked Kitchen whether he thought Apple and others were compromising U.S. data security by storing both data and encryption keys. He said, yes, any company complying with China cybersecurity laws was risking not only data security but national security.  

Related: Sen. Hawley Says Big Tech Is Exploiting Digital Tread Mill

Kitchen followed that with his most sobering observation/allegation, one that particularly struck Hawley, who said it summed up the problem: "China imprisons and tortures and kills religious minorities and political dissidents, and it is using compliant companies to do this at scale." 

Neither Tik Tok nor Facebook had responded to a request for comment at press time on the tenor of the hearing or the company's decision not to participate. 

But Vanessa Pappas, GM of TikTok U.S. has posted on the issue, saying: "[W]e store all U.S user data in the United States, with backup redundancy in Singapore. TikTok’s data centers are located entirely outside of China. Further, we have a dedicated technical team focused on adhering to robust cybersecurity policies, and data privacy and security practices."

Sen. Josh Hawley (R-Mo.) read TikTok and Apple the riot act in absentia Tuesday (Nov. 5) after the Chinese-backed social media platform and the social media giant declined to send representatives to his hearing on Big Tech's data handling, or mishandling, and risks from their connections to China. 

Sen. Hawley began the hearing asking about all the data TikTok is collecting from American users. Hawley warned that the short-form mobile video platform and its massive data collection could be leveraged by the Chinese government against the U.S. 

He then lit into Apple for providing cloud services to China.

Hawley said he wanted to get it on the record that TikTok is collecting "a lot of data," including content, location, contacts, behavioral data on use of the platform, and information from messages and users' phone books. 

He said that was comparable to the "massive data harvesting" machines Google and Facebook. 

And while TikTok said that data is stored in the U.S. and Singapore, Hawley pointed out that TikTok's parent is ByteDance, which is based in China and subject to a 2017 Chinese national intelligence law that requires Chinese companies to cooperate with state intelligence work. 

He said that means TikTok's doors could be opened at any time to the Chinese Communist Party and Beijing could tell parent ByteDance to scoop up data on Americans and give it to Beijing. 

Hearing witness Klon Kitchen, senior research fellow at the Heritage Foundation, said that was "without a doubt true." 

Related: Sen. Whitehouse Hammers Social Media

Hawley ticked off some of the ways TikTok or another Chinese platform could abuse all that data, particularly using data to help artificial intelligence train autonomous weapons systems to identify targets--China is reportedly investing heavily in AI tech. 

Asked how the U.S. could ensure that TikTok or other Chinese tech companies weren't Trojan Horses gathering data on Americans and sending it back to the Chinese government. "I'm not sure we can," said Kitchen. He said that anyone who thinks a Chinese company, even if a portion of the company is in the U.S., can say no to the Chinese government, "that is a fundamental misunderstanding of the way the government in Beijing works." 

Apple, which was another hearing no-show, took it on the chin from both Hawley and Kitchen. 

Hawley said he was concerned about American companies--specifically Apple, which provides cloud services to China--storing both data and the tools to decrypt it in China.  

Kitchen said that while Apple was providing decryption keys for Chinese data stored there, doing so would give China a better understanding of the inner workings of Apple's iCloud accounts and could allow them to collect data "outside of that border." 

Hawley asked Kitchen whether he thought Apple and others were compromising U.S. data security by storing both data and encryption keys. He said, yes, any company complying with China cybersecurity laws was risking not only data security but national security.  

Related: Sen. Hawley Says Big Tech Is Exploiting Digital Tread Mill

Kitchen followed that with his most sobering observation/allegation, one that particularly struck Hawley, who said it summed up the problem: "China imprisons and tortures and kills religious minorities and political dissidents, and it is using compliant companies to do this at scale." 

Neither Tik Tok nor Facebook had responded to a request for comment at press time on the tenor of the hearing or the company's decision not to participate. 

But Vanessa Pappas, GM of TikTok U.S. has posted on the issue, saying: "[W]e store all U.S user data in the United States, with backup redundancy in Singapore. TikTok’s data centers are located entirely outside of China. Further, we have a dedicated technical team focused on adhering to robust cybersecurity policies, and data privacy and security practices." 

Human nature inevitably involves a few bad people doing lots of bad, and a few good people occasionally doing some bad. It’s no surprise then that we have now – and will likely always have – safety and security concerns when it comes to using our electronic devices.

Thank goodness, last week I received the notice below from a friend who subscribes to a well-known pay TV service, known as Dish Network. The written warning is that good, and good enough that I wanted to share it with everyone who reads this and perhaps also pass it along to a friend or family member. That would especially include a dear one who is not as sophisticated as the sender, when it comes to avoiding losses coming from evildoers and their hacking/thievery.

The notice below succinctly and professionally notifies not just Dish subscribers, but really everyone how to avoid bad pay TV actors.

As easy as it is for some hackers/thieves to get into your computer, financial account, or similar electronic service, this kind of Consumer Protection 101 cheat sheet is essential.

Pass this along! It will help everybody to use their computers – be they PCs, laptops, set-tops, smartphones, or tablets, for example – better and safer!

“Webmail –Main Link:

Periodically, Dish gets reports from Dish subscribers regarding suspicious calls in which our subscribers are asked for their account information or to make additional payments. This is an annual protection reminder intended to keep you and your personal information safe. No action is required at this time. Never assume the caller ID is correct for any call you receive. Scammers can easily spoof (i.e., incorrectly alter) their caller ID.

Scammers use a variety of tactics:

· They will give you a sense of urgency. For example, you will lose your service if you don’t act now, or what they are offering is for a limited time

· Scammers may ask you to help someone in need or a loved one

· A scammer may offer some kind of incentive or something of value in return for your personal information

· Scammers impersonate government agencies. The scam may include saying your taxes are past due, or you are violating some law

· Scammers commonly reference computer vulnerabilities. They may say things like, “your device needs new software”, or “your computer has a virus”

Scammers have two main goals. They try to persuade you to:

· Make a payment by providing a credit card number or bank account number. Typically, these payment methods are different from your normal payment method

· Give up a piece of information: password, PIN, date of birth, social security number, account number or a device number - like a number from your receiver, computer or telephone

If you receive a suspicious call:

· Do not give out any information

· Do not make any payments or give out any of your banking information

· If you were left a voice message, don’t return the call

· If you have doubts, contact the company you’re doing business with directly. Get the company’s contact information from a separate source. Don’t use any number or email given to you by the caller.

For additional information and tips for protecting your information visit my.dish.com/support/consumer-protection or click the button below.”

Thank you, Dish.

And be safe!

Jimmy Schaeffler is the chair and CSO of The Carmel Group, a broadband, broadcast, and pay TV/video consultancy. He has spent nearly five decades producing, studying, writing, researching and analyzing, working with every type of player in the space. If you are looking to expand or better understand the industry, feel free to reach out to him at jimmy@carmelgroup.com, or go online to www.carmelgroup.com.

Sen. Maria Cantwell (D-Wash.), ranking member of the Senate Commerce Committee, wants to get a better handle on the Federal Trade Commission's July settlement with Facebook. 

She asked for that info in a letter Thursday (Oct. 10) to FTC Chairman Joseph Simons. 

“I am concerned that the settlement lets Facebook off the hook for unspecified violations, and given the many public reports of Facebook’s mishandling of consumer data, it is difficult to fully understand the impact of this provision of the settlement on the data privacy protection of the millions of U.S. consumers that have used and continue to use Facebook,” Sen. Cantwell wrote, according to a copy obtained by Multichannel News. 

Critics of the settlement, including Cantwell, are concerned it absolves the company of liability for past conduct that might not have yet been uncovered.  

Related: State AGs Investigating Facebook 

Cantwell wants information on "how [the FTC] conducted its investigation of Facebook, including the impact of Facebook’s release from liability, the impact that release has on future Commission actions, and whether the settlement really provides any true independent oversight of Facebook." 

FTC Chairman Joseph Simons has said in defense of the deal that the FTC's $5 billion settlement with Facebook was the best deal it could get with limited authority, and called on Congress to pass comprehensive privacy legislation. 

Simons said he was faced with two choices, get an "excellent" settlement, as he suggested this was, or face years of litigation that would likely achieve "far less" relief than the FTC got, which he took pains to outline. 

He called the settlement the only "real world" choice the agency had, and an "excellent" job. Simons pointed out that the $5 billion was more than 20 times that of the toughest European settlement under its GDPR privacy regime, and 200 times the previous record for a U.S. settlement. He also said it represented 9% of 2018 revenue, and 23% of 2018 profit. 

He also said the decision was laying down a marker for others dealing with consumer privacy, saying it "resets the baseline for privacy cases."  

Sen. Chuck Schumer (D-N.Y.) has asked the FBI and Federal Trade Commission to look into the face morphing FaceApp from a company headquartered in Russia, concerned the Russian government might be getting access to users' personal data. 

According to Appfigures, it is the top-ranked iOS App Store app. 

The app takes photos and makes the subjects appear older (see photos below) or younger or changes men to women, women to men, or the unhip to the hip. 

It also may be harvesting more data than users know, said Schumer. 

"In order to operate the application, users must provide the company full and irrevocable access to their personal photos and data," said Schumer. "In practice, providing this level of access to a user's data could mean that any photos taken with the application could be used publicly or privately in the future without a user's consent," he said. 

Schumer said it would be "deeply troubling if the sensitive personal information of U.S. citizens was provided to a hostile foreign power actively engaged in cyber hostilities against the United States." 

He wants the FBI to mitigate the risk of the app's aggregation data, and for the FTC to investigate whether there are "adequate" privacy safeguards for American users of the app, including government personnel and members of the military. If not, it wants the FTC to issue a warning to that effect. 

Against the backdrop of increasing pressure from Washington for more consumer control over privacy, Mozilla has announced that it has added a default cookie-blocking setting on its Firefox browser. 

In a blog post Tuesday (June 4), new Firefox SVP Dave Camp said that while Big Tech has been talking big about privacy, Mozilla was been doing something about it "long before" the issue became hot-button, but that given that current heat, the time was right to unveil it. 

"For new users who install and download Firefox for the first time, Enhanced Tracking Protection will automatically be set [to] "on" by default as part of the ‘Standard’ setting in the browser and will block known 'third-party tracking cookies,' " he said. 

Firefox is also updating other privacy procedures, including "an upgraded Facebook Container extension, a Firefox desktop extension for Lockwise, a way to keep their passwords safe across all platforms, and Firefox Monitor’s new dashboard to manage multiple email addresses." 

"Competition between products that respond to different consumer preferences serves consumers better than heavy-handed regulation," said Computer & Communications Industry Association President Ed Black. "This action expands the choices consumers have when it comes to online privacy.”