Online Advertisers Prepped for Multistate Privacy Compliance Challenges

A man types on a laptop in the dark
Online ad trade group IAB is expanding its privacy framework to account for new state laws. (Image credit: Andrew Brookes via Getty Images)

The Interactive Advertising Bureau, the association representing online advertisers, has updated and expanded its privacy framework to help members navigate what it calls a patchwork of new state privacy laws related to consent for use of online data for targeted marketing and other purposes. It is seeking public comment on that framework.

The Multi-State Privacy Agreement (MSPA) update, which is currently in draft form (opens in new tab), stems from the Limited Service Provider Agreement that covered compliance with the California Consumer Privacy Act (CCPA) and now covers the Colorado Privacy Act (CoPA) (opens in new tab), Connecticut Data Privacy Act (CDPA) (opens in new tab), Utah Consumer Privacy Act (UCPA (opens in new tab)), and Virginia’s Consumer Data Protection Act (VCDPA) (opens in new tab).

In combination with IAB Tech Lab's Global Privacy Platform (GPP), online advertisers hope to be able to navigate the different consent and privacy regimes. IAB is urging the online advertising industry to adopt the GPP as the go-to privacy management regime.

Also: President Biden Signs New Global Privacy Safe Harbor Order

The IAB said the GPP is meant to enable all parts of the digital ad chain to comply with regional privacy regulations and describes it as a "transport layer that communicates user consent and preference signaling throughout the digital supply chain."

Getting the privacy part of targeted advertising right could be crucial to the continued health of what has been a booming online ad market. Statista.com predicts digital ad spending in the U.S. alone will top $200 billion by 2025.

"We have found a way to solve for key advertising use cases that puts consumers first, hews closely to the letter of the law, and, like the IAB Limited Service Provider Agreement, will be leveraged by small and large participants alike to meet their obligations," IAB/IAB Tech Lab executive VP Michael Hahn said.

While legislators on both sides of the aisle recognize the need for comprehensive privacy protection legislation to replace what will otherwise likely be an even more extensive patchwork of state privacy laws and different data use consent regimes, such legislation has yet to materialize due to differences over what types of data need special protections and how to do that.

IAB is giving commenters until October 27 to weigh in on its proposed framework. ■

Contributing editor John Eggerton has been an editor and/or writer on media regulation, legislation and policy for over four decades, including covering the FCC, FTC, Congress, the major media trade associations, and the federal courts. In addition to Multichannel News and Broadcasting + Cable, his work has appeared in Radio World, TV Technology, TV Fax, This Week in Consumer Electronics, Variety and the Encyclopedia Britannica.