Tags containing: "policy"

A state-by-state evaluation of internet privacy laws

February 6, 2023 Michelle Manafy, Editorial Director – DCN

Laws governing online privacy in the U.S. vary widely from state to state. To find out how each U.S. state ranks from least to most private, Comparitech evaluated each and every one of them based on 25 key criteria. The results reveal a wide range of varying privacy protections, that are visualized in the map below. Scores are displayed as percentages, with a score of 25 out of 25 being 100%.

The criteria range from laws that govern how companies can use and disclose customer data to those that protect journalists, children, and employees. The results of our research are compiled into the table below, with a simple “yes” or “no” answer as to whether an applicable law exists in each state. In some cases, where laws partially cover an area (e.g. genetic data protection is only offered for insurance purposes), states may score half a point. This is depicted by an orange square in the chart below.

2023 key updates and trends

During our 2023 edition of this evaluation, several key updates provided insight into privacy law trends within the U.S.:

Connecticut enacted a law to protect personal data and to regulate online monitoring (it’s effective from July 1, 2023)
Utah enacted its Consumer Privacy Act (it’s effective from December 31, 2023)
California strengthened its data privacy laws to protect employee data and children’s data
New York added a section to its Civil Rights Code to create safeguards for electronic monitoring in the workplace
Hawaii created social media privacy laws for employers and educational institutions
Hawaii, Kentucky, Minnesota, Tennessee, Vermont, and Wisconsin added insurance data security laws, taking the number of states that have implemented the Data Security Model Law, which was created by the National Association of Insurance Commissioners (NAIC), to 22
Colorado introduced a statute to govern artificial intelligence (AI) use, particularly surrounding the use of facial recognition technology. It becomes one of only a handful of states (6) that govern the use of AI within the state
Only 23 states offer specific safeguards for genetic data–and ten of these only provide some protections (e.g. for insurance purposes)
Only five states have laws to protect the collection and sale of geolocation data by organizations
Only four states stipulate that consumers have the right to request inaccurate personal data be amended by companies

Since last year’s evaluation, we added sections to cover specific laws on:

Employee data privacy
Genetic data
Geolocation data
Companies allowing customers to correct inaccurate data

We also combined:

Shield laws and court-recognized privileges for journalists into one category with the former scoring a full point and the latter scoring half a point (if no shield law is in place)

The states in the U.S. that most rigorously govern online privacy

California

Score: 80%

Our top scorer for the fourth update running, California, has enacted many laws for specific privacy issues that other states ignore. Not only did the state create what the ACLU called the most comprehensive digital privacy law in the nation, but it continues to add to and strengthen this law. As mentioned above, California has strengthened its privacy protections by ensuring employees’ data is governed by the law, making it the only state to have this provision in place at the time of writing. It’s also one of just two states to enact a law that specifically protects data gathered from the internet-of-things (Oregon is the other) and to protect privacy rights and enforce marketing restrictions for minors (Delaware is the other). It’s also one of a handful of states to protect the collection and sale of geolocation data.

The Electronic Communications Privacy Act prevents any law enforcement or investigative entity from forcing a company to give up electronic data or communications without a warrant. This includes cloud data, metadata, emails, text messages, location data, and device searches. Although other states have similar laws protecting some of these forms of data, California has so far been the only state to protect it all.

On June 26, 2018, California passed one of the toughest privacy laws in the United States, the Consumer Privacy Act of 2018. Effective in 2020, this bill empowers consumers with the right to know what information any company has collected about them and with whom that information is shared. Furthermore, consumers can demand that a company delete their personal data and have any inaccurate data amended.

Utah

Score: 52%

Utah’s recent enactment of the Consumer Privacy Act sees it rising through the rankings this year to take second place (alongside Virginia). This act, which comes into power on December 31, 2023, ensures consumers are aware of the data companies are collecting on them, can opt out of third-party data sharing, and can request that their data is deleted. The act also protects geolocation data, making Utah one of just five states to have this specific provision within its data protection laws.

Other key areas for Utah include data disposal laws for governments and companies, social media privacy laws for employers and educational institutions, and laws to govern the use of artificial intelligence and genetic data.

Virginia

Score: 52%

While there aren’t any new laws within Virginia for this update, its Consumer Data Protection Act ensures companies must delete personal data on demand, must enable customers to opt out of third-party data sharing, must disclose what data they’re collecting from customers, and must correct any inaccurate data. This law also provides protection for consumers’ geolocation data.

Virginia’s DMV doesn’t use facial recognition technologies and doesn’t share its photo database with federal agencies.

Honorable mentions

Delaware

Score: 46%

Delaware remains within the top five this year. Laws that require the government to dispose of customer data after a set period of time, protect genetic data, protect the privacy of e-reader and library data, and protect minors help the state stand out.

There were no updates for Delaware this year. However, it is one of the states that require consent from both parties before call recording can be carried out.

Illinois

Score: 40%

Illinois paved the way for legislation that specifically protects biometric data like fingerprints, face recognition scans, and retina scans, being the first state to enact this way back in 2008. It is only in recent years that several other states (California, Texas, and Washington) have followed suit. It is also one of 18 states to have a comprehensive genetic data protection law.

Both companies and the government must dispose of personal data after a set period of time. Employers and schools cannot force employees and students to hand over social media account login information. The state also enforces strict regulations regarding the use of artificial intelligence for video interviews and requires consent from both parties when recording calls.

States lagging in enacting privacy laws

None of the below states have comprehensive data privacy laws. None protect IoT data, biometric data, geolocation data, employee data, minors’ data, e-reader privacy, or the use of AI. Only South Dakota offers some protection to genetic data when it comes to the use for insurance purposes. ISPs are able to share customer data without explicit consent and law enforcement has unwarranted access to service provider data on users.

All of them have failed to introduce laws on data disposal, electronic monitoring by employers, social media monitoring by employers and educational institutions, and to govern data brokers.

Idaho

Score: 6%

Idaho scores one point for its law to protect K-12 student information and half a point for its court-recognized privilege for journalists.

Pennsylvania

Score: 8%

Pennsylvania has a shield law to protect journalists and requires two parties to consent to their calls being recorded.

Mississippi

Score: 8%

Mississippi also scores 8% or 2/25. Like Pennsylvania it also has a shield law to protect journalists but only one party is required to consent to call recording. Mississippi’s second point comes from its insurance data security law.

South Dakota

Score: 10%

In addition to a law to protect K-12 student information and a shield law to protect journalists, SD scores an additional 0.5 points thanks to some of the safeguards offered when it comes to genetic data. South Dakotan law specifies that the use of genetic tests in offer, sale, or renewal of insurance is prohibited, as is the sharing of genetic information with health carriers or life/long-term care insurers.

Iowa

Score: 10%

Iowa has a law to protect K-12 student information and an insurance data security law. It also scores 0.5 points for its court-recognized privilege for journalists.

Federal privacy laws

Some aspects of online privacy are governed by the federal U.S. government rather than state governments. Partial regulations exist, but there is no all-encompassing law regulating the collection, storage, or use of personal data in the U.S.

The U,S. Constitution never mentions privacy specifically and only protects against state actors, not individuals. However, the First, Fourth, Ninth, and Fourteenth Amendments limit government intrusion on individuals’ right to privacy.

In 2018, the Supreme Court ruled in Carpenter vs. United States that the Fourth Amendment protects cell phone location information. This means police now have to seek a warrant to obtain this data. While a success for privacy, there are still numerous questions over the government’s and law enforcement’s geolocation tracking abilities. Recently, it was found that law enforcement is purchasing commercially-available geolocation data so as to circumnavigate the warrant requirements.

The Privacy Act of 1974 governs the collection, maintenance, use, and dissemination of personally identifiable info about individuals stored by federal agencies. Again, this restricts how the government can access and use records and does not apply to individuals or businesses.

HIPAA was enacted in 1996 to protect medical records.

The Fair Credit Reporting Act (FCRA) allows individuals to opt out of unwanted credit offers and obtain one free credit report from each of the major credit reporting agencies every year.

The Electronic Communications Privacy Act can be used to impose criminal sanctions on anyone who intercepts electronic communications without consent, but a number of loopholes have rendered the law mostly useless, experts say.

The 1998 Children’s Online Privacy Protection Act requires that websites directed at children under the age of 13 must get parental consent among other compliance standards. The law has widely been discredited as ineffective and even counterproductive when it comes to protecting kids online.

Other federal laws relating to computer security and privacy law include (source: Wikipedia):

1970 U.S. Fair Credit Reporting Act
1970 U.S. Racketeer Influenced and Corrupt Organization (RICO) Act
1974 U.S. Privacy Act
1980 Organization for Economic Cooperation and Development (OECD) Guidelines
1984 U.S. Medical Computer Crime Act
1984 U.S. Federal Computer Crime Act (strengthened in 1986 and 1994)
1986 U.S. Computer Fraud and Abuse Act (amended in 1986, 1994, 1996 and 2001)
1986 U.S. Electronic Communications Privacy Act (ECPA)
1987 U.S. Computer Security Act (Repealed by the Federal Information Security Management Act of 2002)
1988 U.S. Video Privacy Protection Act
1990 United Kingdom Computer Misuse Act
1991 U.S. Federal Sentencing Guidelines
1992 OECD Guidelines to Serve as a Total Security Framework
1994 Communications Assistance for Law Enforcement Act
1995 Council Directive on Data Protection for the European Union (EU)
1996 U.S. Economic and Protection of Proprietary Information Act
1996 Health Insurance Portability and Accountability Act (HIPAA) (requirement added in December 2000)
1998 U.S. Digital Millennium Copyright Act (DMCA)
1999 U.S. Uniform Computer Information Transactions Act (UCITA)
2000 U.S. Congress Electronic Signatures in Global National Commerce Act (“ESIGN”)
2001 U.S. Provide Appropriate Tools Required to Intercept and Obstruct Terrorism (PATRIOT) Act
2002 Homeland Security Act (HSA)
2002 Federal Information Security Management Act of 2002

Prospects for future privacy legislation

Federal privacy legislation has been proposed a few times since 2019 but until recently such proposals didn’t have much bipartisan support. 2022 saw the first bipartisan bill, the American Data Privacy and Protection Act. That could result in some federal privacy law being passed in 2023, but it’s no guarantee.

My concern is that a federal law would preempt state laws like California’s CCPA, and the federal law might do less to protect people’s privacy. Influence from anti-privacy lobbyists could neuter the federal law by the time the president signs it, leaving individual states with little recourse.

A global federal privacy law is still a long way off. As the home of the world’s biggest tech companies, I think the U.S. needs to set a precedent first.

About the author

Paul Bischoff is editor of Comparitech and a regular commentator on cyber security and privacy topics in national and international media including New York Times, BBC, Forbes, The Guardian and many others. He’s been writing about the tech industry since 2012 for publications like Tech in Asia, Mashable, and various startup blogs.

Beneath conservatives’ big tech concerns, liberals may find a common cause

January 26, 2023 Chris Pedigo, SVP Government Affairs – DCN

Liberals and conservatives have different flashpoints when it comes to big tech. But they all trace back to the same problem.

Conservatives believe their viewpoints are being suppressed by big tech platforms and are taking steps to highlight the problem in this new Congress. Representative Jim Jordan (R-OH), the new Chairman of the House Judiciary Committee, recently wrote to five tech companies demanding information about whether they colluded with the Biden Administration to “suppress freedom of speech online,” in particular conservative viewpoints. Senator Ted Cruz (R-TX), the new Ranking Republican on the Senate Commerce Committee, filed an amicus brief with the Supreme Court as part of the landmark Gonzalez vs Google case to be heard next month. He claims that “platforms have not been shy about restricting access and removing content based on the politics of the speaker, an issue that has persistently arisen as Big Tech companies censor and remove content espousing conservative political views.”

In response, some have argued that tech platforms are simply trying to suppress offensive speech and disinformation. In fact, Twitter’s research showed that its algorithm actually favors conservative views. Google and Facebook and their proxies have made similar assertions that no such discrimination is happening. However, without any independent evidence, we’re left in a position where the platforms are grading their own homework and we’re all asked to simply trust them. Unlike the mass media, which thrives in the clear light of public scrutiny, it is impossible to understand the full impact of what goes on in the platforms’ black boxes.

Competitive viewpoints

Whether you agree with Rep. Jordan and Senator Cruz or not, conservatives’ concerns clearly underscore a related problem in our current marketplace: a lack of competition. Big tech controls untold data and influence. To date, they pretty much write their own rules with copious support from cooperative industry groups. The IAB has taken on a heavy load by carrying Google and Facebook’s water in its efforts to defend “commercial surveillance.” CEO David Cohen uses inflammatory and polarizing rhetoric intended to protect the interests of big tech under the guise of defending the interests of “entrepreneurs and small businesses.” In fact, the one thing guaranteed to protect the needs of smaller players is an end to monopolistic practices.

And, while he defends the practices of IAB members Google and Facebook, Cohen selectively calls out Apple for its ” cynicism and hypocrisy.” It seems more than coincidental that Apple is not a member of the IAB. Apple is, in fact, an organization with a clear track record of participating deeply at open multi-stakeholder groups like the W3C to develop privacy solutions.

Dominant industry platforms preference their own products and services to the detriment of any nascent competitors. We’ve already seen clear evidence of collusion emerge in the government lawsuits against Google and Facebook in which these two companies shut out their competitors in the advertising market. Undoubtedly, we’re likely to see more revelations of this nature are as the Department of Justice filed suit against Google this week alleging the company unfairly manipulated the advertising marketplace for its own advantage.

Apple has been accused of leveraging its dominant App Store to develop and promote its own apps to the detriment of competitors. Amazon is under the spotlight for developing its own products to compete with those in its ecommerce marketplace – by employing analytics derived from that same industry-dominating marketplace. The list of anticompetitive complaints against a handful of powerful players grows longer by the day.

Healthy competition

While revelations continue to emerge as these cases make their way through the system, we can’t help but wonder what other harmful activities are still hidden? Without competition, these companies can – and do – operate as monopolies with all the trademark bullying and unchecked arrogant, anticompetitive, even illegal behavior. Who’s to say these companies haven’t also used their dominant market position to suppress (or otherwise influence the proliferation of) political viewpoints?

Cultivating healthy competition in the digital marketplace would go a long way toward building transparency and accountability for the big tech platforms. If Instagram were still a separate company, imagine how differently it would have reacted after the endless scandals for Facebook starting with Cambridge Analytica? Imagine how the market would have reacted to news of Jedi Blue if there was a viable alternative to Google’s ad serving tools? What would pricing and user experience look like if the places we purchased goods weren’t tilting the scale hard in their own favor?

Instead, in today’s world of monopolies, we see a blizzard of PR and legal subterfuge followed by self-serving half-measures.

Policy lags but has legs

Europe passed the Digital Markets Act last year with enforcement expected to begin later this year. If past is prologue, true results will take a few years. Just look at the most recent groundbreaking cases from GDPR. Facebook was deemed to be illegally processing data at the end of 2022, though GDPR became law in 2018. Congress tried to pass bills last year to address the competition problem but frustratingly came up short. Now, Republicans enjoy the majority in the House. Yes, they are worried about the behavior of the big platforms but have voiced concerns about overly empowering federal regulators.

There are legitimate debates to be had about how best to inject transparency and restore healthy competition. But make no mistake, the marketplace for tech is broken and policymakers need to act. Without a policy solution, monopolists will continue to spin PR and make small performative adjustments while they shape the marketplace in their favor and to the detriment of everyone else: small and medium sized companies – and, yes, maybe even divergent political views.

Photo credit: Gage Skidmore

Policy issues on the streaming video horizon

October 27, 2022 Chris Pedigo, SVP Government Affairs – DCN

The streaming video marketplace is expanding and evolving at a breakneck pace. While the market was growing long before Covid, the pandemic lockdown spiked demand and cemented new habits for consumers across demographics. Consumers have devloped a ravenous appetite for streaming, which content providers are happy to satisfy.

Not surprisingly, the number of policy issues surrounding streaming video has grown at a similar pace. Some of these issues have been around for a while, while others emerged just this year. As with all expanding markets, it is critical to monitor regulatory and policy activities to ensure that the market is positioned for healthy growth. To that end, let’s review the current slate of legal, regulatory and legislative issues poised to impact streaming video companies.

New taxes and fees

A host of states and municipalities are attempting to extend franchise fees, which are typically levied on cable and internet service providers, to streaming video companies. Similarly, the Federal Communications Commission (FCC) is considering requiring edge providers (aka companies with apps and websites) to pay into the Universal Service Fund (USF).

The rationale is that the companies that provide high quality, high bandwidth content to consumers should pay for the infrastructure that enables consumers to access this content. Of course, this position fails to recognize the fact that franchise fees and the USF were initially established as a way for cable companies and ISPs to return the benefit they gained from public investment in their infrastructure.

Streaming video companies, however, did not receive any federal or local funding. While actions like these would be detrimental to the entire streaming market, they would disproportionately impact small and diverse content creators because they don’t typically have diversified revenue streams. Instead of levying new taxes on an emerging set of services, it would be better for Congress to continue funding broadband deployment initiatives, which helps level the playing field for equitable access.

Emergency alerts

In 2021, the FCC asked for comments on whether streaming companies should be required to broadcast emergency alerts in the same way that traditional television and cable providers are required to. DCN weighed in with big concerns about the technical and financial burdens of that proposal. We also noted that the costs would likely significantly outweigh the benefits when you consider the fact that consumers already receive these alerts on their phones. The agency prepared a report for Congress and appears to have shelved the proposal for now, but it’s worth monitoring.

Caught up in the techlash

Policymakers at the state and federal level have grown increasingly antagonistic toward big tech platforms. With each new scandal, we typically see a rash of bills introduced in an effort to right the wrongs. Unfortunately, sometimes those bills are overly broad, and they inadvertently affect streaming video companies.

One recent example is the Kids Online Safety Act (KOSA), which was introduced by a group of bipartisan well-meaning Senators after whistleblower Frances Haugen testified before Congress about Meta’s predatory practices with regard to kids on their platforms. The bill purports to address the role that “social media platforms play… in the mental health crisis for children and teens.” However, the bill would also cover streaming video companies which offer professionally-curated content in a safe environment – pretty much the polar opposite of social media services teeming with user generated content.

Data rights and consumer privacy

In the absence of a federal privacy law, five states have now passed their own privacy laws. Of course, these laws apply to a wide range of businesses, impacting far more than streaming companies. However, the new laws will certainly have an impact on how the sector develops, particularly on how consumer data is collected and used.

For example, the California Privacy Rights Act (CPRA) builds on existing California privacy law to provide consumers with robust rights to delete, correct and port data that companies hold about them. Starting next year, consumers will also enjoy easy ways to opt out of the sale or transfer of their data.

Meanwhile, big tech companies like Amazon and Google are battling with newer platforms like Roku, and a raft of advertising-supported video providers, to carve out space in the streaming business with an eye toward harnessing valuable flows of consumer data. If this plays out like the broader web, then whoever controls the data will corner the revenue.

As the streaming video market matures, more policy issues will surface. It’s the hallmark of every evolving sector. The question is whether the streaming video market can continue to grow with healthy competition or whether punitive fees and the collateral effects of dealing with the bad behavior of tech platforms will gum up the works.

To ensure that new entrants and innovation have the opportunity to flourish, DCN will continue to advocate for sound legislation that addresses the specified harms and that unnecessary hurdles are removed. Consumers have high expectations, so should we.

Advertising | Featured Post | Policy

The Google antitrust ship has set its course

May 21, 2020 Jason Kint, CEO – DCN

When DCN created our original chart, where we coined the term “duopoly,” it marked the first wave of what would become five years of interest and activity, marked by intense journalistic investigation – which heats up as antitrust scrutiny does. The line of inquiry often starts with challenging whether anything is new or different. While some industry pundits like to posit that they’ve already “seen this show,” this time around the players are wiser and the stakes are even higher.

In the seven years since the Obama-era FTC issued its decision not to take action against the cool kid in their class, Google, the company has managed to triple its U.S. ad revenues (source: GOOG SEC filings) in line with the overall U.S. digital ad market (source: IAB/PwC Internet Advertising Reports). Put differently, Google has maintained its market share, which is hovering at around 50%.

How on earth has Google maintained share during the same period in which Facebook has grown from virtually nonexistent to the other half of the two-headed duopoly monster? Answer: Pilfering the open web by establishing a walled garden to shift revenues from everyone else to Google’s own properties.

Tired arguments

Yet a small handful of academics, analysts, and influencers (who often fly too close to the sun) continue to rehash the tired arguments that were widely shared back in 2013. They start by broadly painting any scrutiny of Google as a combination of the jealousy of dying legacy media and protectionism by Europe. Often, they claim that news media is manufacturing outrage with an “axe to grind” rather than rightly doing its job of holding the powerful accountable.

They misleadingly suggest that Google makes no revenue from Google News while turning a blind eye to the billions in value they collect from harvesting news content. Much of the value of search would disappear without news content for consumers to find. And when these pundits finally get down to pragmatic analysis, they point out the “gift of web traffic” publishers receive from Google’s free search engine, as if the web, and publishers, couldn’t exist without Google’s pixie dust.

The new wave

However, what these arguments miss is that the voices and minds leading the case in 2020 have evolved their understanding of tech and the marketplace. There is a significant and growing body of consistent research and investigation around the globe about Google’s anticompetitive action from savvy digital thinkers in academia, think tanks, state and federal regulator offices. Say what you want about the various Congressional hearings these days, but they undoubtedly make the committees, public, press, and thought leaders wiser on the topic

Reading long investigative competition reports may not be your cup of tea, particularly during a global pandemic. So, I’ll summarize what DCN is focusing on, what the latest research shows, and what is most important to the health of our members’ businesses.

The latest research

Two key investigative reports have been released: The Australian Competition & Consumer Commissioner (ACCC) July 2019 Final Report and the U.K.’s Competition & Markets Authority (CMA) Dec 2019 Interim Report. If you can only read one, read the latter (and don’t miss Appendix E). The U.K. investigation launched well before those in the U.S. and it offers a solid look into how Google and Facebook are being examined.

I was also delighted to see a Yale professor, Dr. Fiona Scott Morton and co-author David Dinielli, publish “A Roadmap for a Digital Advertising Monopolization Case Against Google” earlier this week. They lean heavily on the U.K. CMA report and did a masterful job of translating hefty regulator documents into a readable form that anyone who has followed our industry will understand. They assert that any eventual court case will demonstrate how Google’s established monopoly in the search business was subsequently leveraged for market power in the design, growth, and capture of value through its intermediation of ads across the open web.

Inside Google’s walled garden

It is important to understand that approximately 90% of Google’s revenue growth (3x over the last seven years) was captured on its own properties (search, Gmail, YouTube, etc.). This led to a shift of Google’s source of revenue to increase from a total of 74% to 84% from their own properties, where their costs to acquire traffic approaches zero. Not coincidentally Google was, all the while, cementing a dominant position in the buying, selling, serving, and measuring of all ads across the open web.

This shift in revenue growth towards areas where Google keeps the most revenue has only been possible because of Google’s market power and ability to see large amounts of data throughout the consumer and advertiser journey, in its own so-called “walled garden.” This allows them to optimize the customer experience in a way that will inevitably keep consumers and advertisers driving the most profit to Google.

Revealing revenue research

Just a few weeks ago, the U.K. advertiser group ISBA published a transparency report. For the first time, the report laid out empirically just how much revenue was captured by intermediaries. Google was, of course, the most substantial player on all sides of the market. (Though there was a curious mystery 15% that the researchers couldn’t lock down.) At this point, it’s beyond hypocrisy each time Google preaches “transparency” but refuses to report both gross and net revenue for its advertising services.

Based on various investigations, Scott Morton and Dinielli expose how Google has achieved this dominance. They examine how Google collects 40% of the revenues across the open web, limits the use of data, and steers consumers to its Google-owned properties with its own higher-margin ads. Google does so while appropriating publishers’ data and audiences for its own gain on its own properties and elsewhere on the web.

Anticompetitive conduct

Morton and Dinielli clearly lay out 20 examples of Google’s potential anticompetitive conduct. Many of them tie to previously published concerns and research from DCN. All will require further investigation and subpoena power – but I’m sure we can agree that they pass the sniff test.

Acquiring Independent Companies To Cement Its Role Across the Ad Stack
Leveraging Market Power in General Search into Display
Designing Auctions That Facilitate Arbitrage and Rent Seeking
Cross-Subsidizing Competitive Functions of the Ad Tech Stack with Monopolized Functions In Order to Rise Rivals’ Costs and Foreclose
Deceptive Gathering and Integration of Data
Strategic Disabling of Interoperability To Disadvantage Rivals
Withholding Interoperability to Steer Demand and Supply Through Its Own Exchange
Providing Exclusive Programmatic Access to YouTube Though Google’s DSP
Retiring the Third-Party Cookie
Disadvantaging Rival Exchanges by Google’s Publisher Ad Server
Undermining Header Bidding Through the Development of So-Called “Open Bidding”
Undermining Header Bidding Through Exclusionary Features of AMP
Designing Analytics to Steer Market Participants to Google Products and Prevent Entry
Resisting Transparency at All Levels of Ad Tech Stack
Obscuring Fees So That Competitors Cannot Enter and Compete Effectively
Using Privacy Laws as an Excuse to Hide Performance Data
Thwarting Publisher Efforts to Understand Source of Payments
Designing Attribution to Favor Search and Disadvantage Publishers
Raising Rivals’ Costs and Foreclosure of Existing and Potential Horizontal Competitors
Capturing Publisher Data in Order to Monetize Their Audiences

Antitrust investigations

Finally, we should still ask whether Google’s lobby and power somehow afford it unique protection in the U.S. market. Only time will tell. But we expect Congress’ antitrust investigation to issue a report in the next 90 days.

Nearly 50 state attorneys general, who previously announced their inquiries, are expected to move forward along with the (not easily intimidated) Department of Justice. Both have broad subpoena power as well as the U.K. and Australian reports to inform their deliberations. Providing further confidence thus far is that the Texas Attorney General office is leading the states’ investigation. They provided Google with an extensive list of nearly 130 questions focused mainly on Google’s advertising business. (Note: DCN received this “CID” through a public records request). It certainly looks like they want answers to Morton and Dinielli’s claims.

The internet has evolved, and it continues to do so. While many of the arguments media pundits and academics may have made a few years ago seemed plausible at the time, that time has passed. It is clear that serious research and reflection is being done that will inform any discussions around the duopoly, antitrust in the advertising ecosystem, and restoring the value exchange between premium content and the “virtual pipes” of technology that control and make money off its flow.

Policy

DCN submits comments on CCPA’s revised implementation regulations

February 26, 2020 DCN

Today DCN submitted the final version of comments regarding the proposed revised regulations for implementation of the California Consumer Privacy Act (CCPA) to the California Attorney General (AG). The comments were developed with input from the DCN membership. They are in response to the revised comments the California Department of Justice, Office of the Attorney General released on Friday, February 7, 2020 to address the feedback received on their first draft of regulations, originally published and noticed for public comment on October 11, 2019.

DCN is actively involved and tracking the regulations, created to provide guidance for businesses about what is required under the CCPA, to ensure they take into account the needs of our membership. We’ll continue to review any updates and make sure that our members are up-to-date.

For reference, here are the comments filed by DCN in December 2019 regarding the initial set of proposed regulations.

Want to clean up Facebook? Don’t listen to Menlo Park

February 19, 2020 Chris Pedigo, SVP Government Affairs – DCN

Mark Zuckerberg is reportedly “begging to be regulated.” He has made several statements to that effect, suggesting that he supports state-backed regulation in four areas: elections, political discourse, privacy, and data portability. This week, Facebook released a white paper that outlines the company’s suggested path forward for content regulation. It does little to drive forward meaningful discussion around these serious issues. Instead, it clearly illustrates that Facebook would like to eschew responsibility for some of its profoundly negative effects in these areas while protecting its ability to continue business as usual in others.

As Zuckerberg put it in a recent op-ed, “regulation could set baselines for what’s prohibited and require companies to build systems for keeping harmful content to a bare minimum.” That said, Facebook’s plan suggests that companies like his should be required to have procedures for taking down offensive or illegal posts and to prepare quarterly reports on their efforts. If this isn’t the absolute bare minimum, I don’t know what is.

Clicky content

It is interesting that Facebook’s paper cites the European Convention on Human Rights which supports the needs of governments to regulate speech for “[T]he interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals…”

Some have argued that Facebook’s algorithms and data targeting capabilities, the same tools which have been refined and optimized for immense profits, actually encourage these sorts of activities. The argument goes like this: The algorithms promote content that gets clicks. The content that gets the most clicks is often salacious (yes, even to the point of being false) or highly targeted based on consumer data.

In this way, drug dealers target members of addict recovery groups, for example. Or false stories that reinforce specific bias, racism, or extremist views are targeted at specific individuals. Of course, those Facebook functions would remain very lightly regulated under the company’s proposal.

Competitive advantages

In his op-ed, Zuckerberg said he believes that “good regulation may hurt Facebook’s business in the near term but it will be better for everyone, including us, over the long term.” However, Facebook’s proposal clearly brings with it the added benefit (for Facebook) that the suggested regulations would build barriers and add compliance costs that entrenched companies are best equipped to overcome. It’s already a daunting challenge for a start-up social media company to break through in the current marketplace. This proposal would only increase that burden.

In what is quite possibly the icing on Zuckerberg’s cake, the proposal would grant global immunity to big tech platforms to carry out content moderation policies, which could also be used to shut out competitive services on their platforms. The proposal would essentially reinforce Section 230 of the U.S. Communications Decency Act globally, so that Facebook could claim legal protection for removing offensive posts and adjusting algorithms to disadvantage repeat offenders.

The last thing the world needs exported from America is blanket liability protection for Facebook. But Zuckerberg’s proposed immunity is intentionally broad to allow for all kinds of activity under a content moderation policy, including favoring its own services or certain business partners over others.

Anti-competitive landscaping

Facebook’s proposal includes an entire section about how – even with the proposed content moderation – enforcement of any guidelines will not only be a challenge; it will be imperfect.

Imagine if Instagram were still a separate company. Do you think Zuckerberg would be talking about how it’s too hard to scrub racist and sexist content from the service? Do you think he would offer only muddled, hazy responses about whether foreign governments manipulated his service to impact elections? Do you think he would be complaining that it’s hard to prevent drug dealers from targeting recovering addicts? No. He would be taking aggressive action to clean it up.

In fact, there is documented evidence that Facebook cared a lot more about these issues when they had competition. Acquiring WhatsApp and Instagram were likely a cheaper alternative to changing Facebook’s underlying and unhealthy business. Zuckerberg’s calculation could have been that turning his back on the public’s welfare was more acceptable than turning his back on shareholders.

The compliance question

As Facebook’s own report puts it, “Designed poorly, these efforts may stifle expression, slow innovation, and create the wrong incentives for platforms.” And Zuckerberg should know.

While Zuckerberg calls for “regulation,” it’s important to consider Facebook’s track record of complying with existing regulations. Their approach to the EU’s General Data Protection Regulation (GDPR) is disingenuous and sometimes misleading. In California, which recently rolled out the CCPA, Facebook is making case the that they don’t “sell” consumer data even under California’s very broad definition.

And that’s the point: Facebook is a for-profit company with responsibility only to its shareholders. Zuckerberg isn’t offering a real plan for regulation that will benefit society and democracy. He’s offering a plan to minimize the obligations and responsibility for Facebook. And this is why the best perspectives on how to clean up the mess that is Facebook are coming from outside of Menlo Park.

Advertising | Featured Post | Perspectives | Policy

Google continues its offensive, but we’re all smarter now

October 3, 2019 Jason Kint, CEO – DCN

There is a certain musical rhythm to our digital media industry calendar. If there was a crescendo, I expect it would be in the Fall, as leaders migrate from execution to strategic planning. And with this shift, conference season begins. There are many forces at work shaping these agendas, not the least of which are businesses wanting to get their messages to market.

As is so often the case, Google sits at the top of the influence food chain and its extensive industry relations efforts impact nearly everyone else’s agenda. Whether Google’s wishes and goals are delivered directly (as they are for a privileged few of their so-called “premium partners”) or through the company’s trade lobbies, press efforts, investments and research, Google’s impact is as predictable as the autumn leaves.

But this year is different.

As we wind down 2019, Google is a bit less focused on driving its own profits and a lot more focused on strengthening its fortress against scrutiny. Right now, it seems that Google’s first and only priority is to dispel or confuse any analysis being done on anticompetitive behaviors. This marks a more sensitive and controlled conversation for Google.

For us, it is important to bear in mind that one of Google’s best defenses can be getting the industry to support its efforts. This is where all of us come into play. We need to be sure we clearly see (and accurately portray) how self-serving Google’s “industry relations” efforts are. The good news is that we are all smarter now. And we – the media industry, the press, and politicians everywhere – are in a position to take informed, proactive action to confront wrongdoing in the form of untenable industry dominance.

The market today

Here is what we know about the scrutiny of Google:

Everyone has upped their game. Everyone. The people involved in the many antitrust investigations have done a lot of homework. This isn’t 10 years ago; it’s not even three years ago. Global scrutiny by international regulators, the press, and the industry has made everyone smarter on the topics. These days, critics are unlikely to get lost in the complexity of Google’s digital business. (As an example, this time around regulators are asking questions about nuanced industry topics like auction mechanics and data rules.)
Everyone understands Google’s core business. Everyone. Google operates free services in order to devour as much data as possible in order to micro-target advertising to audiences. Investigations appear to be focused on Google’s vertical control over experiences and the entire advertising stack funding them. This is where Google continues to make more than 85% of its revenue. And dozens of Google products work together to enable it.
Everyone is significant. Everyone. Investigations happening globally from Australia to the U.K. In the U.S., it includes 48 State Attorneys General, Congress, and the Department of Justice. Put another way, a lot of serious antitrust experts across nations, and political aisles, are aligning to explore areas of concern.

Growing concerns

These investigations primarily focus on the intersection of Google’s data practices and its market dominance. Both are protected by Google’s command of search and mobile operating systems – two areas where the company has already been found by EU regulators to have violated antitrust law.

Aggregating other’s content for searching the web was the original and easiest version of Google’s strategy to understand (and attempt to address). However, the company has extended into new services that exponentially increase its ability to collect data. And, as we now know, a majority of Google’s data collection occurs when users aren’t even choosing to interact with Google.

So, the roll-out of privacy laws in Europe (and now the U.S.) present escalating risk to Google’s business. As Google attempts to comply with these new data protection laws while maintaining its profits, it needs to avoid tripping more antitrust wires as it did last year in Europe.

Make no mistake, the cards are still stacked in Google’s favor. Its annual budget for academic research, think tanks, lobbying, publisher support, trade press PR, and event sponsorships likely matches the top lines of revenue for nearly every organization in the industry. No one wants to upset Google and therein lies one of the key symptoms of the problem.

What can the industry do?

But in the interest of transparency and support for a fair assessment of Google’s business practices, what can the rest of the industry do to be supportive?

1. Press scrutiny. I would emphasize that the trade and policy press must continue your great work to cover the company fairly and with the healthy bit of cynicism it deserves. This has shifted significantly over the past few years in a positive way as newsrooms have ramped up their coverage of big tech. We’re seeing fewer instances of the industry press simply rehashing Google’s announcements or sharing its carefully crafted blog posts. Instead, they’re reporting on them with proper context and careful analysis.

It is important to add that as an industry that seeks to inform, instead of simply propagating the spin of a corporate blog post, we have a responsibility to share the best coverage of issues, even when it’s written by the competition. With the advent of social, proliferating quality information must be one of our highest objectives.

2. Independent academic research. We saw something remarkable play out this past quarter. Academics at Carnegie-Mellon and Minnesota released independent, empirical research that showed how little publishers actually benefit from third party cookies (around 4%). The research spanned three years and offers critically important analysis as publishers consider changes to data policy. For this reason, it also very much threatens Google’s interests.

Recently, Google released its own “internal research” consisting of a single data point, which suggested that more than 50% of advertising revenue would be lost without third party cookies. It’s a ridiculous argument. After reporters and academics scorched Google for the claim, they eventually posted a thin three-page summary which they subsequently buried and backed off from (suggesting, perhaps, that they weren’t anxious for another careful analysis of the quality of this “research”). No doubt there are many more examples.

As an industry, we must continue to question self-serving or corporate-baked research. The onus is upon us to seek out the best independent research and share it widely.

3. Persistence. When Google’s Head of News put out a blog post defending its practices and unwillingness to pay publishers for use of their content despite competitors’ willingness to pay and new copyright laws rolling out in Europe, that’s not the last word. When Google sends a note to publishers in France extorting them to give Google permission to use their content for free or lose traffic to their website, there is only one answer: “No.” This all happened in the past week. Really, Google is not going to turn off Google News across Europe and they’re also not likely to want to be in an inferior position as other news platforms roll out.

As an industry, and bound by ethics and the law, we need to continue to hold the line for the proper value of trusted news and entertainment and the trust of the users and advertisers we serve.

The PR machine rumbles, but its workings are exposed

Just this week, we witnessed the incredible power of the Google disinformation machine. A senior executive at Facebook and several industry influencers are sharing a piece that uses an arcane analysis of file sizes (yes, as in bytes) instead of referral traffic to confuse the issue of the company’s search dominance and disparage the knowledge of a vocal antitrust proponent. It is disheartening to see this get any air. At the same time, we clearly see that politicians have increased their knowledge of how Google’s business (and PR machine) works. Rather than being buried by obfuscation, we see clear-eyed and immediate push back coming from lawmakers on both sides of the aisle including Senators Josh Hawley and Elizabeth Warren.

I considered titling this piece, “Winter is Coming” but that’s overused. I’ll just conclude with a note that there are significantly important investigations happening by competent authorities which will impact the future of our industry. And California offers new guidance for how data can be collected and used. Both issues play directly into publishers’ business interests.

Fortunately, there are positive signs. We see well-informed, reasoned calls for a close examination of technology’s impact and its business practices. Journalists and industry watchdogs have begun to see biased research and self-serving statements for what they are. And that is progress.

Confused about section 230? You’re not alone.

August 22, 2019 Bryson Masse – Independent Journalist

Hint: Try thinking about it in terms of user-submitted content

Passed in 1996, the Communications Decency Act includes a line under the Section 230 heading which reads: No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.

Written by (then) United States Representatives. Chris Cox and Ron Wyden, that line has been the shield online outlets have used to protect themselves from liability for certain kinds of content posted by users to their websites. It is important to note that Section 230 has nothing to do with content composed by publishers (user comments certainly count, though). Because of this, the law as become mired in the debate about online speech and the role moderation plays on online content platforms.

The statute is the focal point of the two sides of the American political spectrum—for almost diametrically opposite reasons. Republicans have claimed that it is at the source of infringement of conservative voices on popular online social media platforms. On the other hand, Democrats question why racist or violent content remains online despite calls for increased moderation.

Resolving these different perspectives won’t be easy. But what certainly isn’t helping things is the recurring problem of statue 230 being misinterpreted and misrepresented. These problems only confound the confusion over this already-complex issue. Corrections have been issued: Vox needed to rewrite a piece back in May with a mea culpa and more recently The New York Times took back a claim that Section 230 protects online publishers of hate speech (that’s the first amendment).

Conspiracy theories

Some have accused legacy of media being behind some sort of coordinated attack to undermine the power of big tech. However, Jeff Kosseff, an expert on the subject, offers another explanation.

“I think the problem, really, is just that it’s a complex issue,” he says. “And people don’t think it’s a complex issue because it’s a short law. I mean, the core of it is 26 words. But the problem here is that it’s not intuitive.”

Kosseff is a cybersecurity law professor at the United States Naval Academy and the author of The Twenty-Six Words That Created the Internet, the 328-page book that tackles the story of Section 230. One thing Kosseff is pretty sure about: there’s no conspiracy. “I seriously doubt that the Sulzburger family is telling the New York Times business section to write that Section 230 protects hate speech. That seems a bit too far fetched for me,” he says.

Historical perspective

That’s not to say all of the media coverage has been wrong either. Kosseff, who worked over seven years as a reporter at the Oregonian, points to pieces in Wired and The MIT Tech Review (both of which cite him) as successfully communicating Section 230’s intricacies. Going forward though, Kosseff recommends that reporters covering the online speech beat develop a better understanding of the statute and its history.

Although passed in 1996, Section 230 originally came about as a way to carry forward a legal principle decided in the 1950s and apply it to the online medium. Since the case Smith v. California in 1959, distributors of content have enjoyed protections against liability of the nature of content they do not produce, as was found in the California. (At that time “distributor” meant an outlet like a bookstore.)

The need for further clarity emerged after legal battles in the early 1990s. Two internet companies were targeted by people who felt they were harmed by the content found on the respective services. The cases resulted in two different legal outcomes. The first company, CompuServe, was spared liability for content on its platform as it had decided to not perform moderation. However, Prodigy, which did edit what was found on its service, was deemed liable for the content on its site.

Net not neutral

These two distinct outcomes are likely at the root of a common misinterpretation of the law: that a content platform needs to be a neutral party to defend itself from any legal claims. That is not the case. Section 230 was written so that content providers could decide what was added their sites by third parties without the risk of legal action.

According to Kosseff, this misinterpretation could be connected with the way the legal departments of news sites have historically navigated the law in relation to examples like crowdsourced projects, user-submitted reviews, and comment forums . “A huge misconception that even lawyers at news organizations have is that if you make any edits or moderate user content, you lose your Section 230 protections,” says Kosseff.

This point of confusion has manifested itself in the debate between the roles of publishers versus platforms. A May op-ed authored by GOP Senator Ted Cruz explained that Facebook risks losing its protection as a neutral platform and instead risked the liability of being a publisher. Except Section 230 specifically means that if you allow third party posting, you do not count as a publisher of that content (with some exceptions like content breaking federal criminal and intellectual property law). The difference between publishers and platforms is “not really a distinction under the law for Section 230,” says Kosseff.

In addition to encouraging reporters on the topic to do their due diligence, Kosseff recommends that publishers retain legal council with the most up to date knowledge. That’s the key to not only reporting correctly on topic of Section 230, but also managing news and other media websites with user generated content, as there could be negative consequences in the most common misunderstanding the law.

“It’s terrible for business reasons,” says Kosseff. “Because if you’re just sort of voluntarily keeping up all the worst content, you’re going to be driving readers away. And there’s no reason for you to do that.”

Policy

DCN perspective on ePrivacy regulation

May 25, 2017 Jason Kint, CEO – DCN

Dear Member(s) of European Parliament,

As you consider updates to the ePrivacy Directive, we are writing to offer the perspective of premium publishers of digital media content. Digital Content Next (DCN) was founded in 2001 and remains the only U.S.-based trade association that exclusively represents premium digital content creators. Several of our members are based in Europe and many more have a substantial presence in Europe. DCN members include many of the Internet’s most trusted and respected media brands, collectively reaching an unduplicated audience of 230.6 million unique visitors – or 100% of the U.S. online population monthly. Importantly, DCN members maintain direct, trusted relationships with consumers and advertisers.

We agree with the need to update and modernize the ePrivacy Directive to account for new technologies that are employed to track consumers in the digital world and hope to see a text which will more closely harmonize the Directive with the General Data Protection Regulation (GDPR). As you consider changes to the text of the Draft Regulation, we encourage you to focus on consumer expectations.

Context is Key

Consumers have nearly unlimited choices over where they can find news and entertainment online. If a consumer does not trust the site or the content, they can and do choose to go elsewhere. This creates a dynamic in which consumer-facing websites and apps must continue to earn the trust of their audiences or risk losing them. A key to maintaining that trust is to collect and use a consumer’s data in ways that meet with the consumer’s expectations. For example, when consumers visit a premium publisher’s site or app, they expect their data will be collected and used in ways to benefit their experience for purposes such as analytics, fraud protection, personalization, subscriptions and content recommendation. Consumers also are not likely to be concerned when their data will be used for benign purposes such as audience measurement or other uses where data is aggregated. At the same time, publishers need to be able to monetize their content through advertising in order to minimize costs for consumers. Certainly, there are also societal benefits from properly funded news organizations.

However, most consumers do not approve of their data being collected in one context and then used in a different context. For instance, absent any transparency, a consumer would not expect or even know that a data broker or a broadband service provider might be tracking their activity across the internet for the purpose of building a profile about them, which could then be used to deliver targeted advertising. A consumer might see the value in allowing a social media company or a search engine to track their activity while using their website or app, but that consumer would not approve of those companies continuing to track them long after the consumer had left their domain and visited a different website.

Our position is that the ePrivacy Regulation should require transparency and consumer consent in cases where consumer data will be collected and used across multiple contexts.Consumers understand and can see the benefits of the collection and use of their data within a single context. Conversely, collection and use of consumer data across different contexts is far less transparent and is much less likely to result in direct benefits for consumers. While differentiating between data collection and use within a single context versus data collection and use across multiple contexts would map with an average consumer’s expectation, it would have the additional benefit of avoiding over-notification of consumers. As the Draft Regulation notes in (22) of the preamble, “end-users are overloaded with requests to provide consent.” When consumers are flooded with notifications in digital media,they tend to become fatigued. They can also become annoyed when notifications cause friction in their digital experience – especially when they are simply attempting to access content from a trusted source. By focusing consent requirements on non-transparent data collection and use, the ePrivacy Regulation would minimize friction where consumers have trusted relationships while also creating a choice mechanism where a relationship does not exist.

The Role of Browsers

Finally, the current version of the ePrivacy Regulation suggests a central role for browsers in obtaining and storing consumer consent. While there may be merits to providing clear choices to consumers at the browser level, we are concerned that by making the browsers the sole point of obtaining consent for tracking, there could be an unintended consequence of increasing the leverage of large companies with browsers or platforms in the digital ecosystem, such as Google and Facebook, particularly if their primary business is selling advertising across the web thereby competing with publishers. At the same time, it would not make sense to require publishers to ask consumers for consent to track all of their activity across the internet. Indeed, publishers would likely ask consumers for consent to be tracked by the publisher and their chosen third party partners solely while on the site. As you consider the role that browsers can and should play, it is important that options are preserved and encouraged for narrow consent required for delivery of the context in which value is being delivered to the consumer.

We appreciate your efforts to protect the rights of European citizens. Please let us know if we can be of assistance.

Sincerely,

Jason Kint
CEO
Digital Content Next