Three US politicians have introduced bills into both the House of Representatives and Senate which would place wide ranging restrictions on use of personal data in targeted advertising.
The lawmakers involved say that the bill, if passed, will “prohibit advertising networks and facilitators from using personal data to target advertisements, with the exception of broad location targeting to a recognised place, such as a municipality”. The bill would also prohibit advertisers from “targeting ads based on protected class information, such as race, gender, and religion, and personal data purchased from data brokers”.
The ‘Banning Surveillance Advertising Act’ has been introduced into the House by congresswoman Anna G. Eshoo, whose district in California includes Silicon Valley, and Illinois’ Jan Schakowsky, who is also senior chief deputy whip. In the Senate the bill has been introduced by Corey Booker, a senator for New Jersey who also ran as a Democrat nominee for the 2020 presidential election.
The draft bill itself is fairly short, and some of the language leaves open questions about whether use of publisher first-party data would be barred. But judging by the wording, the implications of the bill would be huge if passed. It seems that at the very least Facebook, and likely other social platforms, would be barred from using their own first-party data to target ads. This rule could even apply to all online publishers who collect and use first-party data.
The rules for advertisers
The bill starts by outlining the rules for “advertising facilitators”, defined as any company which receives payment to disseminate ads and collects or processes personal information – Facebook, Google DoubleClick, and data brokers the examples provided in supporting documents.
But to understand the bill’s implications, it makes sense to first look at the rules for advertisers themselves.
Advertisers are completely banned from targeting ads using personal data, unless they’ve obtained it directly from the related individuals. So third-party data would be completely banned under the law.
Even for data directly provided by individuals, advertisers can’t use it for targeting if it relates to a “protected class” category, or would reasonably be known as a proxy for a protected class.
Many of these protected class categories, such as religion and sexual orientation, are already banned within a lot of ad platforms. But others aren’t. Sex and gender identity are counted as protected classes, as is familial status. So you would no longer be able to target, say, married men with children – even if that’s first-party data collected by the advertiser.
The bill does however include an exemption for targeting based on a ‘recognised place’ – defined as either a state, Indian land, municipality, census designated place, Nielsen TV market, or congressional district. Zip codes are not included. So local advertisers can still target their specific towns (and politicians can still, handily, target their congressional districts). But more granular, zip code-based targeting would be outlawed.
The rules for ad tech
The first thing to note for advertising facilitators is that they can still target ads using advertisers’ first-party data. But the advertiser would need to give the ad tech company a ‘written attestation’ that they themselves are following all the rules as described above.
It’s not clear what would constitute a ‘written attestation’ here – and the definition is important. If advertisers can just click a check box in a programmatic platform saying they’ve collected the data lawfully, that’s not too much of a challenge. If they have to send an email to every individual ad tech company in their supply chain stating that they’re compliant, programmatic advertising could become a lot more cumbersome.
Aside from this, advertising facilitators’ role in targeting would be largely neutered. Advertising facilitators would be banned from enabling advertisers or third-parties to target ads by providing them with lists of individuals or connected devices, or any information which could identify individuals or connected devices. So emails, unique IDs, and even device IDs would all be out the window – unless provided directly by the advertiser, which in turn collected them directly from the individuals concerned.
Ad tech would be consigned to using advertisers’ first-party data as best they can, rather than layering in their own.
The big exception for advertising facilitators is contextual advertising. Targeting based on information which the individual is viewing, engaging with, or has searched for would still be allowed. But these ads must be displayed “in close proximity” to the original contextual data. So that rules out retargeting (which would be very hard to do anyway given the ban on IDs).
And the bill also prohibits “further use of information related to the delivery of contextual advertisement”. This appears to suggest that any data on who engages and interacts with ads couldn’t then be used for further targeting.
This clause also potentially rules out more advanced contextual techniques. Contextual companies can currently pick out trends in their data which show, for example, that coffee lovers also watch a lot of TED Talks, allowing contextual placement of coffee ads on TED Talk content. This could be seen as “further use” of contextual information, and banned by the bill.
The rules for publishers?
What’s most unclear from this bill is whether there would still be a role for publishers’ first-party data. A lot of third-party personal data is already being stripped out of digital advertising due to privacy shifts from Google and Apple. Many media buyers’ plans for the future hinge on the ability to match their own first-party data with advertisers’ first-party data, via privacy-compliant clean rooms.
But the bill in its current state doesn’t clearly define the rules for publishers’ data. Facebook itself seems to count as an ‘advertising facilitator’, and thus would be barred from using its own data for targeting. But many major publishers have invested heavily in building their own ad platforms, powered by their first-party data collected from signed-in users. It’s not clear whether these platforms could survive if this bill were to be passed.
Given the current wording of the bill though, it seems unlikely they would. The language used by the three politicians suggests they’re primarily targeting tech companies and data brokers. But the definition for ‘advertising facilitators’ is given as follows:
“A person who receives payment to disseminate ads and collects or processes personal information.”
This would seem to cover publishers’ own ad platforms which make use of personal data.
A long road ahead
While much of the above might be panic-inducing reading for many in the industry, there’s still a long road ahead before any of it becomes a reality.
Bills must be debated in both chambers of Congress and then reconciled into one document – and then signed by the President – before they become law. The contents of a bill can change completely in that time.
Reining in big tech is one of the few bipartisan issues currently being debated in the US legislature. If the bill can pick up support from both sides of the House and Senate, it will have a much easier time passing.
Expect plenty of debate – and private lobbying – in the coming months. The bill has already picked up support from a number of pro-privacy organisations and academics, including Professor Shoshana Zuboff, author of The Age of Surveillance Capitalism.
But industry groups including the IAB, fresh from its fight against European efforts to completely ban personalised ads, will make their case against the bill – as will the tech giants themselves whose businesses could be hamstrung by the law.
