The following is an excerpt of remarks by Justin Brookman, and attorney and director of technology policy for Consumer Reports, the nonprofit product and service testing organization. Brookman spoke to Justin Hendrix, of TechPolicy.Press, in a podcast that included Nora Benavidez, of FreePress.net. They were discussing provisions of H.R. 8152, the American Data Privacy and Protection Act (ADPPA) as referred to the full House of Representatives on July 20, 2022.
“Yeah. I mean, I feel like 70% of privacy bills all kind of look the same, right? They have access rights, and deletion rights, and maybe correction rights. And this has correction rights. They have data security obligations. The trickiest thing is what the law does around secondary use, right? Primary use, we kind of get. I go to Amazon, I buy stuff and they process it and they charge my credit card and they give my information to FedEx, bring it to me. And that’s all directly in service of what I ask for. And that’s fine.
“It’s all of the other stuff, like the sharing data with data brokers, or for targeted advertising that like the law really needs to get to. And there’s usually three basic ways you can deal with that. You can ban it . . . You can say, this is super illegal. You can require opt-in consent for it. You have to… Someone has to click okay for them to do the extra stuff, or you can have opt-out rights. And like, you can go out of your way to say no, don’t do that. And they all have their flaws, I think.
And this bill has had three different versions, and each one does it in really, actually very different ways. The way they ended up, I think is actually probably the strongest that I’ve seen
“And it’s tricky. It was really hard. This is a really hard issue to get to. And this bill has had three different versions, and each one does it in really, actually very different ways. The way they ended up, I think is actually probably the strongest that I’ve seen. They actually do prohibit, straight prohibit, most secondary use. And they have some carve outs for things that are allowed, and some targeted advertising. But most targeted advertising I think, is actually straight prohibited . . . .
“And there probably need to be some exceptions. You need to be able to do analytics, some basic product improvement, count accounting, right. And so that’s where the meat is. Okay, what extra stuff is allowed. And they do exclude targeted advertising, and they say certain targeted advertising is allowed, okay. And we’re going to subject that to opt-outs. But again, other parts of the bill actually prohibit the use of cross site data for targeted advertising, so it’s actually just a pretty limited scope of things.
“But overall, that framework is great. I think the conversation has evolved beyond what we call notice and choice. Like people having to make informed decisions all time. No one wants to make privacy decisions all the time. They just want it to work, and to trust that it works. And I think that this bill was written with that in mind.than we’ve seen in Europe. That’s stronger, certainly, than we’ve seen at the state level.
Consensus on ending targeted advertising?
“This market had been five, 10 years ago, there would’ve been concern about ‘targeted advertising, is the life blood of the internet, and we need our targeted ads.’ . . . But no one’s saying that anymore. There does seem to be the bipartisan agreement that people don’t don’t want their data collected and shared and sold all the time. And that privacy rules really should reign that in. And we shouldn’t buy these arguments that you’re not going to get free content anymore, unless you’re allowed… [unless] we allow hundreds of companies to watch everything we do. That bargain is no longer on the table. So I was really surprised by how little disagreement there was, on the actual substance of the bill . . . .
“This market had been five, 10 years ago, there would’ve been concern about ‘targeted advertising, is the life blood of the internet, and we need our targeted ads.’ . . . But no one’s saying that anymore.
“We’re seeing Apple take steps to get rid of cookies, Google’s getting rid of cookies… Taking all these steps to get rid of tracking. I think a lot of people are aware that the data free for all is going away. That people care about this, and one way or another it’s going to go away. And then maybe just having one national standard, instead of having to worry about what California’s going to do, maybe pre-emption is worth it for them, and so they’re not going to raise a hue and cry. Again, because the bill got much stronger, actually I expect the hue and cry to come, but we surprisingly haven’t heard a lot of it yet.
“The data minimization framework says, just use data in the service of what the person asks for, and hopefully that’s the way it does work in practice. I mean, GDPR was designed to do some of this, but the way it was written, led to consent fatigue and an annoying experience. This is written in reaction to that, this is the intent. But obviously, a lot of these companies are who rely upon tracking, aren’t are going to just go kicking and screaming.
Expected reaction from ad-tech industry . . .
“They’re going to do everything they can to try to find ways to track, to try to find loopholes. We saw this with the CCPA, the California law that allowed people to opt-out of selling their data. And the company’s adopted these tenacious interpretations to say, well, we’re not selling your data. We’re selling ad based and we’re giving the data away and therefore the law doesn’t apply to us. And so they’re going to look for any possible loophole they can, to try to keep doing what they’ve been doing for the last 20 years. But certainly the goal, and I think this is written more tightly than some of the other laws, would be again to make things more private, less annoying.
“They’re going to do everything they can to try to find ways to track, to try to find loopholes.
“I think section 406 says Congress is authorized to give them more money, but it doesn’t actually give them more money. That’s a separate conversation. They’re going to need a ton more money. Even setting aside private enforcement, they’re going to need a ton more money to actually implement this bill.
“But again, if section 101, the data minimization really works, then I think there won’t be these data stores.”