Ad Privacy Legislation: What It Means, What It Doesn't, & Why There's No Need to Panic

Intro VO  00:06

Welcome to revenue rehab, your one stop destination for collective solutions to the biggest challenges faced by marketing leaders today. Now head on over to the couch, make yourself comfortable and get ready to change the way you approach revenue. Leading your recovery is modern marketer, author, speaker and Chief Operating Officer at Tegrita Brandi Starr

Brandi Starr  00:34

Hello, hello hello and welcome to another episode of revenue rehab. I am your host brandy star and we have another amazing episode for you today, I am joined by Gary Kybele. Gary is a partner in the digital media technology and privacy practice group of law firm Davis and Gilbert LLP in New York City. He is a Certified Information Privacy professional and a member of the publication advisory board of the International Association of privacy professionals. Davidson Gilbert, a full service law firm is recognized as one of the premier law firms in the United States representing the marketing communications industry and has done so for over 110 years. Gary also serves as general counsel to the performance marketing association. Prior to becoming an attorney Gary was an Information Systems Analyst in the investment banking division of Merrill Lynch Co. Gary, welcome to revenue rehab, your session begins now.

Gary Kibel  01:42

Thanks very much for having me, Brandy. It's good to be here.

Brandi Starr  01:44

Awesome. I am happy to have you. We've got a hot topic today. But before we jump into that, I like to break the ice with a little woozy moment that I call buzzword. banishment. So Gary, tell me a buzzword that you'd like to get rid of forever?

Gary Kibel  02:03

Sure. And maybe it's sort of a two word phrase surveillance advertising. This is become a buzzword for privacy advocates for aggressive regulators that view that any sort of data driven advertising has this sort of negative connotation and call it surveillance. I mean, that that sounds bad, right? You hear the words? Oh my god who wants surveillance, where in reality, you know, the vast majority of the industry is just you know, trying to understand your habits to retarget you for a good ad for shoes. But unfortunately, a lot of the online behavioral digital retargeting advertising industry is being branded with this term surveillance advertising. And one more thing about that it's kind of shocking that the advertising industry is being out branded.

Brandi Starr  03:01

Weird. irony there.

Gary Kibel  03:05

regulators and advocates are brand in the advertising industry. And the advertising industry cannot brand itself properly take No, no, no, it's, it's wonderful. Because it's data driven advertising. It's more effective and personal. No, they've got this term surveillance advertising, we got to get rid of it. I love that

Brandi Starr  03:23

our sights I love the idea of getting rid of that. It's funny when I hear the word surveillance, it always makes me picture like the guy in the inconspicuous car with like a sandwich like watching someone with binoculars for like, old school crime drama. And it's gonna like maybe that's what advertisers are doing. Are they outside my window? But no, that is good, and so on topic for what we're going to discuss today. So now that we've gotten that off our chest, tell me what brings you to revenue rehab today?

Gary Kibel  03:57

Well, I mean, I work as you mentioned, during your introduction, Brandy Davis and Gilbert works with tons of different marketers and communications companies. I spend the group that I work with spends their day working with ad agencies and brands and media companies on every single part of their marketing communications work, you know, whether it's sweepstakes and promotions, or talent in union issues or licensing or, or advertising claims, substantiation. And I focus primarily on privacy and data security, which in the advertising industry has just gotten bigger and bigger and bigger. I I've been doing this probably for over 20 years now. And when I first started doing it, like privacy was this little sliver of the concerns, and I had to explain to people that yes, there is a privacy issue, but there weren't many laws to deal with it. And now I don't have to explain to people what I do. When I say I'm a privacy it's Already they go, Ah, I get it. And I said, I focus mostly on the advertising marketing industry. And the goal. Yeah, definitely I get it. Because everybody knows, you know, you're on a website, you're looking at something, then you take out your phone and your Facebook feed, miraculously, you have an ad for that thing you're looking at, on the website.

Brandi Starr  05:18

Yes. And as a consumer, I have such a love hate relationship with it. Because, you know, on one hand, it's like, you kind of hate it, because, you know, like stuff is following you around the web. But on the other hand, like, you can make it work for you, like I can remember I needed a new travel backpack, and I had some really specific requirements. And so I literally just went and just clicked around on the top two, you know, websites for that kind of product, and just waited for the ads, and then they served them up. And I've found the perfect bag. So like, you know, there are some positives and negatives there. But before we get to talking about that, I believe in setting intentions, it gives us focus, it gives us purpose, and most important, it helps our audience to understand what they should expect from our conversation today. So what would you like our listeners who, you know, are CMOs and VPs of marketing? What would you like them to take away from our discussion,

Gary Kibel  06:20

that everyone in the organization that's involved in the marketing effort needs to be focused on privacy issues, there needs to be coordination between the marketing team, the legal team and the tech team, for example, you know, the tech team should not be throwing pixels up on your website without having a discussion with legal and with marketing, about what data is going to be collected, how it's going to be used, and then to see if your website or service is going to make all the proper disclosures to comply with applicable law. And, you know, in these days, you get a lot of providers that say, Hey, I'll give you my pixel for free to put on your website, you'll get these fantastic stats and analytics, I get to suck out data, which I get to use from your website. And sometimes when people think, oh, it's for free, it's just analytics. It's just, you know, a benefit to everybody. They're not thinking about the legal ramifications. So not saying you can't do these things. But it's to stop for a second, make sure you get the right people in the room or in the virtual room and talk about the way it's going to work. So that way, you can do it in a compliant manner.

Brandi Starr  07:27

Okay, yeah. And I know, I can think back, you know, email marketing is our sweet spot at Tegrity. And I can think about when I first started, you know, using email as a channel, going through legal was like the pain in the bottom part of the process that at that time just didn't seem to make sense. It always seemed like legal was just nitpicking some wording. And so fast forward to now where these things are a whole lot more prevalent, and much bigger, because now we have so many different technologies. I think it is something that especially the more junior marketers, who are the ones that are hands on, and doing things don't really think about because to your point, I have seen those like, oh, there's this great browser plugin, or, you know, we should add this on here to track this other thing. And it does seem really harmless. So I'd like to start with help me understand, like, what are the things that the law addresses, you know, on the local level, the international level, for those that are less familiar with all the current and you know, in the works legislation, let's lay a little bit of a foundation around what we need to be thinking about?

Gary Kibel  08:44

Sure, that's a good point. And there'll be a lot of acronyms that I'm gonna throw out here. So, you know, you may be familiar in Europe, with the GDPR. People have heard about that the general data protection regulation, it's a comprehensive privacy law that applies to all processing of personal data in the member states, the law has been in effect almost five years. In the United States. We don't have an equivalent federal privacy law. We have different sectoral laws in different issues, like you just mentioned, email marketing, we have federal laws about collecting personal information from children. If you've ever gone to a doctor's office, you fill out the HIPAA consent forms. There are things or financial services, but there's not one overarching federal privacy law that would apply to all marketing activities. The closest thing we have is the Federal Trade Commission enforces the Federal Trade Commission Act. And there's one sentence that says they're allowed to regulate deceptive and unfair practices in or affecting commerce. That one sentence is what they used to regulate privacy law, they have nothing else. So if you have a privacy policy that says we're not going to give your email address to anybody else, and it does If that's deception, if you collected personal information and you had a security breach, that could be unfairness, this same standard of deception, unfairness is what's used to regulate all of advertising. If you have a car commercial, and it says the car goes zero to 60, in four seconds, but it actually takes 10 seconds. That's deception. So there's, it's really a really vague standard on the federal level. So what's happened as a result is that states are jumping into this void. And California was the first one to jump into this void. So California enacted three years ago, the CCPA, the California Consumer Privacy Act, and that was the nation's first standalone, comprehensive consumer privacy law. And being how big California is, it's almost becoming a de facto national standard. You know, I don't want to put down anybody in other states. But you know, if North Dakota had passed the first comprehensive consumer privacy law, the industry might have ignored it. But you know, you can't ignore California. And so I'll continue with the history here a little bit. So what's happened is California was the first and then no federal law has been passed. So all the other states are looking around and thinking, Hmm, we want to get in on the act as well. And so now there's a total of five states that have passed comprehensive consumer privacy laws. In addition to California, there's Virginia, Colorado, Connecticut, and Utah. And that together, they cover about almost 20% of the US population. So this is becoming a serious issue. These laws are phasing in, I mentioned that CCPA from California was enacted was became effective three years ago, there's a new California law that's going to become effective this year. Virginia's law actually became effective two weeks ago, on January 1, and Colorado, Utah and Connecticut become effective later this year. So right now, the industry kind of running around, like, you know, chicken with their head cut off, because they've got so much to do. And they're all these new requirements are going to be coming down the pipe that are going to apply to marketers and brands.

Brandi Starr  12:16

Okay, and I know, I was reading, trying to understand all the acronyms, and I saw that there's talks around AD PPA, that is something that seems to be in the works at the federal level. Did I understand that? Correct?

Gary Kibel  12:33

Correct. And I may actually get what it stands for. And correct me it's the American data privacy protection act. I think that actually is it. Okay. So this was, there have been many, many bills proposed in Congress. But usually most of them don't make it out of committee never get voted on by the full chamber. This one, the ADP EPA, really had a lot of traction because it was a bipartisan bill. It was a very comprehensive consumer privacy law. And it seemed to have traction, it was gonna go someplace. Then we had the midterm elections, Congress turns over. And there were some two major stumbling blocks that the even the bipartisan group was having a hard time getting their hands around. Number one is, would they allow what's called a private right of action, meaning with the law allow individuals to sue if there's a violation. And if you allow individuals to sue, you're basically allowing class action lawyers to show up and Sue. And of course, businesses don't want that they don't want, you know, the floodgates to open with this new law, and then suddenly, all the class action lawyers show up. The second thing they had to compromise on was preemption. Is this federal law going to preempt all the different state laws that have been passed? And so there was a real difference of opinion, the California delegation, and Congress did not want preemption, because they said, Hey, we've got this awesome law in California, we spent a lot of time and effort to make this work. We don't want it to go away. And so they came up with a compromise, that there would be preemption, but the private right of action would not kick in for I think, three or four years. And that seemed to be a decent compromise. But then the clock was running out on Congress, midterms came around, and then you got to start again in the new Congress. So if I was to look into my crystal ball, I would say I don't expect this law to be passed this year. Maybe there's a chance this happens in 2024. But my own personal pro business biased view is that I think a federal law that preempts all these other state laws would be so much easier for businesses to implement, and I think it's be more beneficial to consumers. Because it's so confusing to consumers. When there's all these different standards. These five laws don't line up with one another. So it's not as if a client says to me, Gary, What's the strictest law? I'll just go with that standard isn't California the strictest? Well, actually, it's not, there are elements of the other states that are actually stricter. And the challenge is these laws do not line up perfectly. So you need to work to deal with compliance on multiple different points here.

Brandi Starr  15:17

And I think that that is what has stemmed a little bit of the panic for marketers, because you know, there are some unscrupulous marketers out there that don't care about the law, and you know, just try to find their way around it. But for most people, they want to be ethical marketers. And I know, like, when CCPA first came out, I had multiple clients asking, Well, do we just need to exclude California from our marketing efforts? And what does that look like? How does that impact our potential for revenue? And, you know, so there's so many now that more states are doing and it's like, to your point, it's about 20% of the population, you know, no business is going to say, well, you know, just screw that we're not going to mark it to 20% of the people. And so it is a lot of panic around, what do we need to do? How do we need to, you know, make sure that we stay compliant without, you know, becoming legal people? And how do we stay agile? Because that's the big thing in marketing is things change so fast. And you know, it's not like a contract where it can be hung up in legal review for weeks at a time, like, how do we balance that? And so in the companies that you've talked to, what have you seen people doing that is working around being able to stay compliant, but also still be able to market?

Gary Kibel  16:43

Right? So the challenge is, how do you implement these new rights that have been imposed by law, some of the rights are not that challenging to deal with, some of them are very, very difficult to deal with. Again, the laws all differ, but they usually have common elements, that they're mostly opt out laws. And they give the consumer the ability to reach out and ask, what information do you have about me and give me a copy of it, the consumer can say, I want you to delete all my personal information. And then the most challenging part is they have the right to opt out of the sale of their personal information or of targeted advertising. I'll get to that last part in a second. But the first part is someone reaches out and says, Hey, I'm in California, I want you to delete all my personal information. Now, there's a law that requires that you honor that request, you would need to verify that they are actually a California resident, and verify that they are the person who is requesting the deletion of someone's information, because God forbid, you have, you know, some disgruntled, you know, you know, ex, you know, spouse, asking to delete someone else's information. But you have to have a process in place to do this. Now, if you've got one request a month, you'll figure out a way to do it. But think if you got 1000, in one day, you would need a process to do this. And that can be a challenge. So putting that process in place is very important. The real complex thing is that last part, I mentioned earlier about the opt out of sale, the opt out of targeted advertising. Now when I say to someone, you have to give the consumer the right to opt out of the sale of their personal information, the initial intuitive responses, oh, we don't sell personal information. That's not our business. But it's the way lawyers always latch on to definitions. And it's the way that it's defined. And it's defined so broadly, that a sale could be something as simple as you put a retargeting pixel on your website, and the pixel provider is collecting data that they can then use for their own benefit or for the benefit of other clients. If that happens, then your website is deemed to be selling personal information to that pixel provider. And you need to offer the consumer the ability to opt out. Now, if you're not very technically savvy, you might be saying how do I offer someone the ability to opt out of a pixel in the background that's collecting data. And there are services, there are some proposed industry solutions, but there does need to be a process to make this happen. If you go to the bottom of many websites, major brands these days, you might see a link that says do not sell my personal information. And this link is because of the new California law. And when you click that link, there has to be a process for you to be able to opt out of the cookie and pixel data being sold off to these other parties. So this is challenging to implement. And using third party services is what people often do. In other states. It's called the right to opt out of targeted advertising. But it is a challenge if you're not very technically proficient or been following this for a while.

Brandi Starr  19:51

Okay, and yeah, and so I think that is I do see that as I'm browsing around and things pop up And opting out of ads brings me to the main thing that I'd like your input on, which is just the ad industry in general, you know, there's all this talk about, what does a cookie list world look like, you know, first party third party data, like, we've had so much technology that has been put in place over the years to allow us to better target, you know, which helps with you know, ad spend, so you're only spending money where it should to help with relevancies. So that the consumer, whether it's a consumer product, or b2b, that they are only seeing content that is actually useful to them. And so we've put all this work in, we bought all this different technology to help us do this effectively. And now with all the various legislations, there is a lot of talk of will we even still have the data to be able to do this? And so this is where I think a lot of heads of marketing, feel the need to prepare, of how do we drive this same interest and, you know, pipeline, if we don't have the ability to do the things that we know, have been working? What are your thoughts there?

Gary Kibel  21:17

Yeah, and it's, you know, it's important to keep in mind that, fortunately, these laws mostly work on an opt out basis. So you don't have to get someone's consent to target them in the US outside the US can be a different analysis. But these are mostly opt out laws. And it's an opt out of, as I mentioned, sale of personal information, and an opt out of targeted advertising. But it's not an opt out of advertising. You know, the consumer will still get advertising. The question is, is the advertising going to be data driven, and targeted based on previously collected personal information, which of course, that's what's fantastic. Going back to our example of browsing the website, look at your Facebook feed, you get that targeted Ed, it works. It's fantastic. And again, I'm more of a pro business vent events, to quote a line from a famous movie, Rudy, you know, I'm five foot nothing and 100. And nothing. I don't want ads from big toy stores, you know, those have no value to me. So I actually like getting targeted ads that have products and services that are relevant to me. But these new laws give consumers the right to opt out of that targeted advertising. And the reality is, most consumers don't opt out. But putting in place the compliance mechanism to offer them that ability to opt out. That's what's really difficult. And then what do you do if they do opt out? Well, then you're not doing data driven, targeted advertising, you may be doing some contextual advertising, some other advertising based on you know, dma's, or general, you know, deterministic models, but not based on sorry, probabilistic models, but not based on the deterministic data that you previously used. So it does change the way that advertising happens. But it's not going to wipe advertising off the map. But it does make the inventory less valuable, it makes those eyeballs less valuable if you don't have the targeted ads.

Brandi Starr  23:14

Okay, so what I'm hearing is for all the marketers that have been panicking about what a cookie list environment could look like, is it is not that all these things are going away. It's that we just need to change how we're looking at those audiences. So we've got those people that we still can target based on all the things we know about them. And then we have those that have opted out, which almost becomes a generic bucket of advertising.

Gary Kibel  23:42

Well, I think we need to we talked with a cookieless world. And that's sort of a different issue that's not really been driven by these laws, that the cookieless world is being driven by Google, because Google decided that they are going to phase out the use of third party cookies in Chrome, that was not a legal requirement. That is what Google decided to do. So being pushed into that cookieless world is because Google has decided on a change, just like you probably noticed with starting about two years ago, you started to get pop ups on your iOS device, saying, Are you going to consent to this app tracking you across other devices, that was not because of a legal change in the law. That's because Apple changed their policy. They used to allow app providers to collect what's called the identifier for advertising the IDFA. They would allow them to collect that on an opt out basis. It basically if you didn't want the app to collect it, you had to go into your iOS settings and turn on limit ad tracking. But Apple on their own, decided we're going to change from an opt out model for the IDFA to an opt in model. And that made it harder for marketers to authenticate users on the iOS ecosystem. So we sort of have to things going on at once we have new laws that are making things more challenging. And then we have industry on their own, making changes that make more challenging. When you're a marketer sitting in the middle, then yes, your head is spinning, because oh my god, everything I used to love doing is now becoming more challenging.

Brandi Starr  25:17

Yeah, it almost feels like, you know, every year there is some uproar about some change, like I remember, you know, CCPA, GDPR, even with email, when Apple made the change to advertising opt in, and even the auto opens with email, you know, and then it's like, it's like, every year, there's some thing that seems to change whether it's legal, or you know, someone major in the industry that kind of shakes this all up. And and I think your point that I agree with, is that it is that combination of things that really has people in a bit of a turmoil.

Gary Kibel  25:58

Yeah, I mean, your head really needs to be on a swivel in this industry, especially in the ad tech world, because it's just changing so much. And we never know what's gonna happen next. There could be new laws that are passed later this year. That could be another major change from one of the very large portals that everybody uses in their in their advertising campaigns that are required change, because again, while Apple and Google made those changes on their own, they weren't required by law, you know, when they make a change, it's almost the same as the impact of law, because every marketer uses those services, and you have to comply with their rules, otherwise, they will kick you off of their platforms.

Brandi Starr  26:38

Yes, agreed. And I want to actually jump back to something you said in the beginning, you talked about the importance of the relationship between marketing technology and legal in being able to manage all the stuff that is tied to the various laws. Can you talk a little bit more about what good looks like in that relationship?

Gary Kibel  27:00

Sure. So hopefully, your in house counsel at your company, if you do have in house counsel are approachable and friendly. Like, hey, lawyers are not all bad people. We are normal people. We have flesh and blood. We have families, we have pets, you know, so yes, we are human beings, too. We don't just live at night. And you know, we're black capes. So you should develop a relationship with your legal because, look, it's much better to talk about these things in advance, than at the end, when suddenly are regulators knocking on your door, there's something happening on the website, legal, I had no idea about it, or there was some marketing campaign you did, which wasn't run by legal. And now you have a big problem. I mean, that's how you get, you know, big fines for a company or people lose their jobs. So talk about things in advance, hopefully, your counsel is willing to work with you, you know, they're not just going to be sitting there with a rubber stamp that says no, you know, they're going to find the solution to get you to where you need to do to where you want to be. So I think having that open dialogue and discussing, you know, how are we targeting consumers? What data is involved? Who are the other partners we're working with? How does this campaign unfold, it's really important because at least when I work with clients, oftentimes we can get to where you want to go, there just may need to be some steps to get there. So if you haven't already done it, I know a lot of us are in the virtual world now. But I'll make an old school reference, you know, walk down the hallway, you know, knock on the lawyer's door, introduce yourself and develop that relationship.

Brandi Starr  28:33

So I love it. I love it. And then the last question that I have for you is, we've talked about, you know, the things we need to do to get it right. What's the danger if we don't like, you know, for anyone that may not be aware of what the risk is? Can you kind of summarize what that could look like?

Gary Kibel  28:51

Sure. And, you know, for someone like me, that works a lot on privacy, disclosures and, and policies and things than that. We always joke that like, you know, consumers never read privacy policies. The only one who reads privacy policies are plaintiff lawyers, that regulators, judges, they will read it and unfortunately, that's the reality. So what can go wrong? Well, if things are not right, you could get a consumer class action if the claim is right, for a class action. And class action lawyers are looking for one thing and one thing only money. That's all they want. You know, it's under the guise of protecting consumers. And look, this is my personal opinion, and I'm biased, but it's under the guise of protecting consumers. It's really to get money. Regulators have a different motivation. Regulators are trying to protect the consumers and the way they protect the consumers is by enforcement actions and fines and making companies make take corrective measures. The challenge is if you have a class action lawyer coming after you, they can be made to go away with money. If You have a regulator going coming after you. They're not motivated by money, and they have endless resources. So they're not going to say, Gosh, this is too expensive to go after this company with this regulatory action, they have endless resources, they will keep going until they get their solution that they want. And so to you, as a company to a brand to a marketer, it's going to be time and expense. I mean, at best, it'll just be legal costs and time and effort for people in your company. And at worst, it could be fines, it could be corrective action, and it can really disrupt your business.

Brandi Starr  30:35

So bottom line, we need to get this right, because there is no marketer that I have ever met that wants to deal with regulators or corrective actions.

Gary Kibel  30:47

What is a, an ounce of prevention is worth a pound of cure. That couldn't be more true in this area. Yes, it takes a little time takes a little effort takes a little money to put the proper systems in place. But that is far better than dealing with a regulatory action or a lawsuit.

Brandi Starr  31:04

Well, perfect and talking about our challenges is just the first step. And nothing changes if nothing changes. So in traditional therapy, the therapists will give the client some homework, but here at revenue rehab, we like to flip that on its head and ask you to give us some homework. So I'd love to hear what would be your one action item for our listeners, that one takeaway first thing that they can do to make sure that they are you know that they are doing the right things when it comes to privacy and add legislation.

Gary Kibel  31:40

I would say the one thing is go to your own website right now. Go to your own website, scroll to the bottom, look for the privacy policy, see what other links are there, click on the privacy policy, see what it was last updated? does it speak to these California issues? does it speak to the right to opt out. And I know I'm not really saying one thing, I'm putting it all together but and if you use a plug in or tool like I use, look at what pixels are on the website as well see what's going on there. And that might give you a sense of whether or not you're in a good position or a bad position, you might be in a good position if the privacy policy was updated in the last few months. And there are ways for consumers to exercise their rights, you might be in a very bad position. If it says this privacy policy was last updated in 2017. And it's only three paragraphs long. So take a look.

Brandi Starr  32:32

Okay, I love that as an action item. I like the quick wins of what we can do. So after listening to this episode, your next step is to go to your own website and to figure out where you sit so that you can start making steps in the right direction. Gary, I appreciate that. And I have enjoyed our discussion so much. But that's our time for today. But before we go, can you tell our audience how to connect with you?

Gary Kibel  33:01

Sure. So you can find me my email address on our law firms website. The email address is GK i v e l at DG law.com. That's as in Davis Gilbert law.com. And our website is DG law.com. There's a lot of great articles on marketing compliance there. You can find me on LinkedIn Gary Kibo, you can find me on Twitter, Gary cable. And who knows, maybe you actually find me in the real world walking around somewhere.

Brandi Starr  33:31

Well, we will at least make, we will add the links to you in the digital world in the show notes. So for anyone listening, you'll be able to connect with Gary, and to tap into the wealth of information that is on the Digi Law website. So Gary, thank you so so much for enjoy for joining us today.

Gary Kibel  33:55

Thanks very much for having me. Brandy. This is great.

Brandi Starr  33:58

Awesome. And thanks, everyone for joining me. I hope that you have enjoyed my discussion with Gary. I can't believe we're already at the end the next time.

Outro VO  34:08

Bye bye. You've been listening to revenue rehab with your host brandy stone. Your session is now over but the learning has just begun. join our mailing list and catch up on all our shows at revenue we have dot live. We're also on Twitter and Instagram at revenue rehab. This concludes this week's session. We'll see you next week.