This fall, in the US alone, companies ranging from pet care to travel were subject to data-privacy related lawsuits. This is incremental to the $1.2 million that a well-known beauty retailer paid in fines for selling customers’ data without their knowledge – the California Consumer Privacy Act’s (CCPA) first public enforcement action.
The combination of brands being held accountable for violating consumer privacy laws, the roster of new – and varying – US privacy laws set to take place in 2023, and consumers themselves increasingly opting out of sharing their personal data for advertising purposes is amounting to something of a rising tide in terms of consumer privacy.
An increasingly complicated landscape
It’s becoming increasingly more complicated and resource-intensive for companies who do business across the globe – or even more than one US state – to remain on the compliant side of a landscape of varied privacy laws and regulations.
In the US, five states’ laws are set to take effect in 2023: California Privacy Rights Act (CPRA), The Colorado Privacy Act (CPA), The Connecticut Data Privacy Act (CTPDA), The Virginia Consumer Data Protection Act (CDPA), and The Utah Consumer Privacy Act (UCPA).
Beyond the alphabet soup, these laws have differing definitions of personal information and each carry different requirements for notifying customers how that information will be used. Further, the threshold for the number of consumers companies can collect data on before being subject to regulations and whether they need to be citizens of that particular state also varies. Some states have cure periods – the grace period an organization has to rectify a violation before being fined – while CPRA will notably remove the cure period previously in place with CCPA once the calendar flips to 2023. It’s a lot to keep track of. And that’s before comparing and contrasting these regulations to the General Data Protection Regulation (GDPR).
The nuances and implications of these regulations run deeper and will only become more numerous as individual laws take effect throughout 2023. It seems, then, that the most strategic path forward might not be attempting to check the compliance boxes of numerous data privacy laws while holding tight to previous ways of monetizing users but rather a new, more responsible approach to activating audiences.
Consumer opt-out
In determining paths forward, it’s crucial to recognize that these laws didn’t simply materialize. The thing that each of these varying regulations have in common is clear: more consumer choice over how personal information is handled. The scaling of consumer protections is in direct response to what citizens have said they do or do not want their data used for.
Data from earlier this year indicated that 75% of US and UK consumers are not comfortable purchasing from a brand with poor personal data ethics, and a similar number (74%) are concerned about brands being able to view and track their online behavior to target them with advertising.
The way that we’re seeing consumers leverage the tools available to them to opt out of sharing their information for advertising is evident, from Apple’s App Tracking Transparency framework and Google rolling its ‘reject all’ button on Search and YouTube in Europe earlier this year. As a result publishers in Europe are seeing as much as a 50% opt-out rate – and 40% of users already disable them in Chrome on their own devices. This equates to 70% of the open web already being unaddressable today.
In order to combat this reduced addressability and thrive in a privacy-forward era, publishers, advertisers, and adtech companies must create a new digital ecosystem marked by responsibility and built on first-party, consented data.
A path forward
The data collected on consumers is one of the most powerful assets an organization has. But it’s up to them to act responsibly and ensure this data doesn’t become a liability.
The entire media ecosystem must move toward a more responsible web that is marked by respect for privacy when it comes to the collection, management, and usage of consumer data. By doing so, all parties will benefit from privacy-forward advertising that doesn’t compromise on addressability, relevance, or scale.
