The Bottom Line
- Some lawmakers and regulators are clearly seeking to step up the heat on data collection and usage practices in the Adtech industry. All participants in the online advertising ecosystem should carefully consider the privacy practices of any service that they provide or use.
Senators Wyden and Cassidy, along with eight other members of Congress, sent a letter to Federal Trade Commission (FTC) Chairman Joseph Simmons on July 31 urging the FTC to investigate what they called “widespread privacy violations by companies in the advertising technology industry” in connection with the industry’s real time bidding (RTB) practice, the process through which advertisers compete in nearly-instantaneous auctions for individual online advertisements.
According to Senators Wyden and Cassidy, Adtech companies are violating Americans’ privacy by collecting sensitive data about potential recipients of online advertising (including device identifiers and cookies, location data, IP addresses and other demographic and biometric data), sometimes called “bid-stream data.” The Adtech companies then provide this bid-stream data to potential bidders in the RTB process, including those with losing bids, even though only the winner of the auction uses that data to deliver an advertisement. The Senators also assert that data brokers take this bid-stream data and sell it to third parties who use it in ways that violate Americans’ privacy rights, like tracking participation in protests or building religious profiles based on an individual’s location data showing their visits to a place of worship.
Senators Wyden and Cassidy asked the FTC to investigate this practice under Section 6(b) of the FTC Act, which authorizes the FTC to conduct broad-based studies called “special reports” to seek information to determine whether these Adtech companies and data brokers have violated federal laws prohibiting unfair and deceptive business practices. While there have been many calls for transparency and investigation into Adtech companies’ compliance with privacy laws, the RTB process and the use and collection of bid-stream data is becoming an increasing concern for regulators in the United States and across the globe.
The United States may be catching up to the European Union in this regard. In 2019, the United Kingdom’s Information Commissioner’s Office (ICO), the regulator responsible for data protection, issued a report detailing various privacy issues with respect to the Adtech industry’s collection and use of RTB data in the UK. The ICO’s report identified unlawful processing of personal information by many RTB Adtech companies and a widespread lack of understanding and compliance with data protection law by these companies. Following the investigation, after a short period allowing Adtech companies to bring their practices into compliance with data protection laws, the ICO expects all companies to have addressed the concerns set forth in the report.
Mobile Carriers and Bid-stream Data
Earlier this year, the FCC accused the US’s major mobile carriers of selling consumer location data to third parties in violation of FCC privacy regulations, with proposed multimillion dollar fines. However, now the FCC has turned its attention on mobile carriers that are also engaged in problematic data collection and processing practices in connection with RTB.
FCC Commissioner Geoffrey Starks sent a letter to AT&T and Verizon CEOs asking questions about the companies’ involvement in RTB and their practices and procedures for protecting consumer information, including location data. Specifically, the FCC Commissioner asked the companies whether they have ever bought, sold, shared or received bid-stream data. AT&T and Verizon have not yet responded to the FCC’s inquiry, but their responses may provide helpful insight into mobile carriers’ collection and use of bid-stream data.
The increased attention from legislators and regulators on Adtech companies’ RTB practices and potential violation of consumer’s privacy rights in the United States and abroad show momentum building on this important issue. While we will continue to see pressure grow on Adtech companies to be more transparent about their data collection and use practices, it is unlikely that there will be any concrete enforcement steps taken by regulators before the presidential election in November.