PRIVACY |
| BILL | SUMMARY | CONGRESSIONAL ACTION | IAB POSITION |
| S. 418 Do Not Track Online Act of 2013 | Directs the FTC to develop standards for a DNT mechanism, through which consumers can indicate a preference to prevent collection of “personal information,” (undefined).Exception for collection of data if any identifying data is removed or thereafter deleted and the consumer consents to collection and use.Dual enforcement by FTC and State AGs. | Introduced (02/28/13): Sen. Jay Rockefeller (D-WV)Hearing held (04/24/13): “A Status Update on the Development of Voluntary Do-Not-Track Standards” | The scope is overly broad and would cover not only third party activities, but also first party uses of data, something the FTC explicitly rejected as unnecessary and not counter to consumers’ privacy expectations. The bill also grants blanket authority to the FTC to create and implement a Federal Do Not Track program. The IAB has publicly opposed this legislation. |
| REPORT | SUMMARY | ACTION | |
| The U.S. GAOReport – “INFORMATION RESELLERS: Consumer Privacy Framework Needs to Reflect Changes in Technology and the Marketplace” | The U.S. Government Accountability Office created a report to address growing consumer privacy concerns among members of Congress. The objective was to gather information on privacy laws applicable to information resellers, find any gaps in the law that may exist, and examine various approaches to improving consumer data privacy.The report found some gaps in the current statutory framework, namely that it does not reflect the Fair Information Practice Principles (a set of internationally recognized principles for protecting the privacy and security of personal information). This is primarily because there is no comprehensive privacy statute, but rather a sector-specific framework.The GAO recommended that Congress consider strengthening the current U.S. privacy framework, while ensuring that any new laws do not unduly inhibit the benefits that accompany data-sharing. It provided four main issues that should be considered:
|
Published (09/25/13)IAB Executive Summary |
CHILDREN’S PRIVACY |
| BILL | SUMMARY | CONGRESSIONAL ACTION | IAB POSITION |
| DRAFT Do Not Track Kids Act | Expands the Children’s Online Privacy Protection Act (“COPPA”) and extends coverage to teenagers. The bill creates a “Digital Marketing Bill of Rights for Teens” and limits the collection of geolocation information about both children and teens. The bill would require that online operators develop an “eraser button” for kids online – operators would need to implement mechanisms that permit users (children and teens) to eliminate content that is publicly available and “contains or displays” personal information of children or minors. | Rep. Edward Markey (D-MA), Rep. Joe Barton (R-TX)(10/28/13) Press release announcing a draft bill in the coming weeks. | In 2011 and 2012, the IAB did not endorse or oppose this bill but voiced serious concerns with the approach. The digital advertising industry takes the protection of children online very seriously and has supported the legal requirements under COPPA and the self-regulatory restrictions created by CARU, NAI, and the DAA, including prohibitions on knowingly targeting children with behavioral advertising. However, H.R. 1895 (112th Congress) would create legal obligations that require more tracking of individuals online, including the identification of children, in order to not track them further. We believe that this is the wrong approach and would be operationally and technically difficult if not impossible to implement. |
LOCATION & MOBILE PRIVACY |
| BILL | SUMMARY | CONGRESSIONAL ACTION | IAB POSITION |
| H.R. 1913 Application Privacy, Protection, and Security Act of 2013 | Directs mobile device application developers, before the application collects personal data about the user, to notify the user and obtain the user’s consent to collection, use, storage, and sharing of such personal data.Requires developers to provide users with a method to withdraw such consent, and to request that the developer delete personal data or refrain from further data collection or sharing; and, to take measures to prevent unauthorized access to personal and de-identified data.Expands FTC Rulemaking Authority to determine scope of notice, and to define key terms such as personal data and application developer.
Provides a Safe Harbor for adherence to NTIA Multistakeholder Code of Conduct for Mobile App Transparency. FTC enforcement and availability of State civil actions. |
Introduced (05/10/13): Rep. Hank Johnson (D-GA) | The IAB has questioned the need for legislation in this area and publicly opposes opt-in regimes that limit the marketplace. Specifically, any legislation that creates a safe harbor for self-regulatory programs should identify the types of practices that would qualify for the safe harbor and not specific Codes. The FTC should not have discretion to determine the scope of notice UI, to reject programs that meet the codified practices or to modify those codified practices; and, should not be given broad rulemaking authority to define personal data or other key elements of legislation. |
| BILL | SUMMARY | CONGRESSIONAL ACTION | IAB POSITION |
| S. 2171 The Location Privacy Protection Act of 2014 | The bill is intended to fill a gap in the Electronic Communications Privacy Act (ECPA), which currently allows mobile carriers to disclose the location of users if they are using an Internet-based mobile application; and criminally address cyber stalking apps. The bill would require companies to display just-in-time notice, and acquire express consent from consumers before collecting location data ; post online the kinds of data they collect, how they share and use it, and how people can stop the collection or sharing; and create criminal penalties for companies that knowingly and intentionally disclose geolocation data knowing that domestic violence or stalking could result. IAB’s full summary of the 2011 bill is located here. | Introduced (03/27/14) Sen. Al Franken (D-MN) | The digital advertising industry has always recognized the sensitive nature of geolocation data and supported higher levels of notice and consumer consent for the use of data for marketing and advertising purposes. However, S. 2171 would impose burdensome and potentially technologically implausible data retention requirements and could create unnecessary obligations on first party publishers, therefore we have reservations about moving this legislation in its current form. The Digital Advertising Alliance is currently working to expand the industry’s self-regulatory program to the mobile platform and this work should be allowed to continue as it may prove a more effective means of addressing consumer’s privacy concerns regarding the use of geolocation data.Venable SummaryIAB Response |
| BILL | SUMMARY | CONGRESSIONAL ACTION | IAB POSITION |
| S. 639 / H.R. 1312 Geolocation Privacy and Surveillance Act | The bill is intended to establish clear cut rules regarding when geolocation data—including location data from a mobile phone or device—may be used by law enforcement agencies. Under the bill, law enforcement would need probable cause to obtain a warrant to secure an individual’s current or past geolocation information. The bill maps out exceptions for emergencies, national security situations, and theft or fraud. The bill creates criminal penalties for the use of GPS data without a warrant. **Companies would need affirmative consent to collect and share location data with non-law enforcement third parties. | Introduced (03/21/13): Sen. Ron Wyden (D-OR), Rep. Jason Chaffetz (R-UT)Hearing held (04/25/13): “ECPA Part 2: Geolocation Privacy and Surveillance” | IAB has not endorsed or opposed this legislation. The IAB supports efforts to expand Due Process protections to the digital sphere, and will work to ensure the bill does not unintentionally implicate legitimate private sector practices. IAB does not support commercial regulation under the same standards as criminal/Due Process. |
| BILL | SUMMARY | CONGRESSIONAL ACTION | IAB POSITION |
| H.R. 983 Online Communications and Geolocation Protection Act | The bill would amend the Electronic Communications Privacy Act (ECPA) to establish due process requirements for law enforcement access to stored/online communications and geolocation information and prohibit a service provider from intentionally disclosing information to a government entity if due process requirements are not met. Does not regulate commercial activity or data collection. | Introduced (03/06/2013): Rep. Zoe Lofgren (D-CA)Hearing held (03/19/2013): “ECPA Part 1: Lawful Access to Stored Content”Hearing held (04/25/13): “ECPA Part 2: Geolocation Privacy and Surveillance” | The IAB has not publicly endorsed or opposed this legislation; however, supports efforts to expand Due Process protections to the digital sphere. |
SECURITY |
| BILL | SUMMARY | CONGRESSIONAL ACTION | IAB POSITION |
| Data Breach NotificationCalifornia S.B. 1386 | Requires an agency, person, or business in California to disclose any breach of security. | Letter written (05/22/2014): “DMA Leads Industry Call for National Data Breach Notification Law” | Information has transformed the ways in which businesses operate in America and has led to an increase in economic growth. IAB supports legislation that would protect consumers without causing undue harm to business operations. IAB remains concerned that far-reaching security protocols would cause a heavy burden for consumers.A federal notification standard should not be equated to a private right of action. IAB signed onto this letter from the DMA on 05/22/2014:DMA Leads Industry Call for National Data Breach Notification Law |
TRADE |
| AGREEMENT | SUMMARY | ACTION | IAB POSITION |
| TTIP – Transatlantic Trade and Investment Partnership(US /EU Negotiations) | Privacy and Data Security Non-Tariff BarriersConflicts of laws and regulatory impedimentsRevocation or elimination of Safe Harbor Program and adequacy determinations | Hearing held (07/18/2013): “President Obama’s Trade Agenda with USTR Michael Froman”Hearing held (07/24/2013): “The US – EU Trade Agreement: Tipping over Regulatory Barriers” | Many US companies and services are targeted for EU enforcement actions and added administrative burdens to do business in the EU. This harms US trade interests and holds back innovation in the EU to the disadvantage of EU consumersNegotiations should ensure privacy rules do not act as an unnecessary barrier to cross-border flows of information, including access to digital products and services regardless of method or delivery, and prohibit requirements that service providers use local servers or other infrastructure, or establish a local presence. Companies should be provided with a usable means to demonstrate compliance with local privacy rules so that information can flow across borders.Companies would be better equipped to compete and expand with an EU judgment that the US provides “adequate privacy protection” and through the establishment of a lead data protection regulator for US companies doing business in the EU. |
| BILL | SUMMARY | CONGRESSIONAL ACTION | IAB POSITION |
| S. 1788 Digital Trade Act of 2013 | Sets negotiation objectives for bilateral, plurilateral, or multilateral agreements regarding digital trade. Provisions include:Preventing or eliminating barriers to the movement of electronic information across borders.Ensuring transparency in measures affecting free flow of information across borders.
Prohibiting the use of local data, infrastructure, or investment as a condition for market access. Ensuring provisions on intermediary liability are consistent with U.S. law. |
Introduced (12/11/2013): Sens. John Thune (R-SD) and Ron Wyden (D-OR) | IAB supports the inclusion of provisions in future trade agreements that call for the elimination of barriers to movement of electronic information across borders. and prohibit the use of local data, infrastructure, or investment as a condition for market access. |
| BILL | SUMMARY | CONGRESSIONAL ACTION | IAB POSITION |
| H.R. 3830 Bipartisan Congressional Trade Priorities Act of 2014 | Sets negotiating objectives for the Administration and gives notice to U.S. trading partners about Congressional expectations.Establishes consultation and access to information requirements before, during, and after negotiations with Members of Congress and the public.Preserves procedures for an up-or-down vote on the final implementing bills without amendment. | Introduced (1/09/2014): Chairman Dave Camp (R-MI) and Sens. Max Baucus (D-MT) and Orrin Hatch (R-UT) | IAB has not endorsed or opposed this legislation. However, AB supports the inclusion of provisions in future trade agreements that call for the elimination of barriers to movement of electronic information across borders. and prohibit the use of local data, infrastructure, or investment as a condition for market access. |
STATE |
| BILL | SUMMARY | CONGRESSIONAL ACTION | IAB POSITION |
| CA Assembly Bill (AB) 242 – Internet Privacy Policies Amendment | The bill is the California State Assembly’s proposed amendment toSection 22575 of the Business and Professions Code. Specifically, it would require that the operators of commercial websites or online services to drop the label “Privacy Policy” and replace it with “Using Your Information”.It would also require these websites and online services to include a link to the California Attorney General and Federal Trade Commission websites where consumers may file complaints.This applies to all operators of commercial websites or online services that collect personally identifiable information about individual consumers residing in California who use or visit the website or online service. | Hearing in California Assembly Judiciary Committee scheduled for (01/14/14). | Official Position Statement Pending |
INTERNATIONAL |
| LAW | SUMMARY | ACTION | IAB POSITION |
| Draft EU Data Protection Regulation | Require explicit consent for “profiling”, defined as predicting a person’s economic situation, location, or behaviorBroaden definition of PII to include “online identifiers”Fine of up to 5% of annual worldwide turnover EU100 million
Revocation or elimination of Safe Harbor Program and adequacy determinations |
Introduced (1/25/2012)Passed EP LIBE Committee (10/21/2013) | IAB has not endorsed or opposed this legislation. IAB supports the creation of a one-stop shop for businesses dealing with national data protection authorities. |
REGULATION |
| AGREEMENT | SUMMARY | ACTION | IAB POSITION |
| CA Attorney GeneralReport – “Privacy on the Go: Recommendations for the Mobile Ecosystem” | The CA AG Report provides recommendations and guidance (asserting authority under CAL OPA) for data collection and disclosure practices in the mobile environment. The report focuses heavily on the types of entities in the marketplace: App Developers and Ad Networks, with education called for by Platforms.The report expands the definition of PII to include any information that can not only identify an individual, but a device such as unique identifiers. It further recommends “surprise minimization,” or collecting what is only necessary to the function of the app, “just-in-time” notice, user control over access to PII, and privacy protective default settings. The report also asserts that data collected for advertising is sensitive like financial or medical data. | Published (01/10/2013) | The mobile privacy guidelines were developed without the engagement or consultation of the vast majority of companies and consumers likely to be affected by them; nor are they grounded in any apparent legal authority. As a result, they do not reflect the perspective or input of the broader industry or represent industry consensus. Industry has already been working diligently to address mobile data practices through various self-regulatory forums. Significant work is already underway on these matters and we are concerned that issuing recommendations specific to California will result in confusion and mixed signals among companies and consumers alike. |
| AGREEMENT | SUMMARY | ACTION |
| Federal Trade CommissionStaff Report – “Mobile Privacy Disclosures: Building Trust Through Transparency” | The FTC Staff Report provides recommendations and guidance for privacy disclosures in the mobile marketplace broken up by entity: primarily mobile platforms, app developers, and advertising networks/third parties.Specifically, the report recommends “just-in-time” privacy notice disclosures, acquiring consent for sensitive data like geolocation data, photos, video, contacts, and calendar data, and offering a “Do Not Track” solution to consumers. | Published (02/01/2013) |
| AGREEMENT | SUMMARY | ACTION |
| Federal Trade CommissionCOPPA – Children’s Online Privacy Protection Act
|
First Party: The Final Rule makes first party operators liable for third-party data collection activities that benefit the first party. The Commission intends this language to impose a strict liability standard for first-party operators that allow third-party online services to collect personal information through their properties.Third Parties: that collect personal information through another operator’s website or online service will be subject to COPPA if the third party has actual knowledge that the site or service is “directed to children,” a higher liability threshold than the “reason to know” standard proposed in the 2012 SNPRM.
“Direct to Children”: The Final Rule retains the longstanding multi-factor analysis for determining whether a site or service is “directed to children,” with the addition of (1) music (as an element of audio content) and (2) presence of child celebrities or celebrities who appeal to children as factors in that analysis.
Personal information: will include any “persistent identifier that can be used to recognize a user over time and across different websites or online services.” Screen or user names will be considered “personal information” if they function in the same manner as online contact information. Photo, audio, and video files will be considered personal information if they contain a child’s image or voice. |
Rulemaking: Final and enforceable (07/01/2013) |
| AGREEMENT | SUMMARY | ACTION |
| Federal Trade CommissionPublic Workshop: “The Internet of Things”
(11/19/2013)
|
The staff of the Federal Trade Commission is interested in the consumer privacy and security issues posed by the growing connectivity of consumer devices, such as cars, appliances, and medical devices.FTC staff seeks input on the privacy and security implications of these developments. For example:
|
Meeting (11/19/2013) |
| AGREEMENT | SUMMARY | ACTION |
| Dept. of Commerce – National Telecommunications and Information Administration (NTIA)Multistakeholder Process to develop Voluntary Codes of Conduct: Mobile App Transparency | the DAA Self-Regulatory Program, announcing a Consumer Privacy Bill of Rights, and calling for a multi-stakeholder process to develop voluntary codes of conduct.The first MSH Process was focused on Mobile App Transparency. For details regarding all MSH meetings from July 2012 – July 2013, please view theNTIA Site.
The resulting document: a code of conduct for short form notice by mobile app developers/publishers, did not receive consensus for finalization, and is now in a “testing phase” to allow companies to review internally and bring the testing results back to the NTIA for potential changes to the document. Update (01/06/14): The NTIA will hold the first meeting of a privacy multistakeholder process regarding the commercial use of facial recognition technology on (02/06/14). The goal of this meeting, and the subsequently scheduled meetings, is to develop a voluntary, enforceable code of conduct that specifies how the Consumer Privacy Bill of Rights applies to facial recognition technology (as outlined in the White House’s Privacy Blueprint). During this process, stakeholders will discuss how best to ensure that consumers’ rights to control, transparency, security, access and accuracy, focused collection, and accountability are respected within the context of current and emerging commercial uses of facial recognition technology. A list of subsequent meetings is provided on the NTIA website. |
Convened (07/12/2012)Concluded (07/25/2013) |
| AGREEMENT | SUMMARY | ACTION |
| White House Intellectual Property Enforcement CoordinatorJoint Ad Networks Best Practices Announcement | On July 15, 2013, the IAB, in partnership with 24/7 Media, Adtegrity, AOL, Condé Nast, Google, Microsoft, SpotXchange, and Yahoo!, createdbest practices to address online intellectual property infringement.The signers of the best practices agree provide clear guidelines to content creators for reporting alleged copyright violations.
The White House released astatement of endorsement for the joint best practices. |
Published (07/15/2013) |
