Privacy Is a Right. Protecting It Is Not Extreme.

There comes a time in any lobbyist's career when the moment calls for taking a fringe position completely at odds with emerging policy consensus. When both political parties, industry players, and civil society activists have all grown wise to whatever con your particular interest group is playing and the walls are closing in, stick to a tried-and-true message: "I'm not extreme, you're extreme!"

Call it boldness, call it projection. Either way, this tactic was on full display last week as Interactive Advertising Bureau head David Cohen spoke at the advertising industry lobbying organization's annual leadership forum.

On the topic of federal comprehensive privacy legislation, Cohen labeled as “extremists” everyone from civil society organizations to both political parties and other industry supporters of the American Data Privacy and Protection Act (ADPPA). By themselves, these incendiary remarks are not meaningful: a mostly predatory industry built on unethical use of data being scared of a federal privacy standard is practically a given. However, renewed bluster from the digital advertising industry should serve as a reminder of how close we came to passing ADPPA in 2022, and give us a renewed sense of purpose for 2023. This can be the year we successfully pass federal comprehensive privacy legislation.

More than anything, our starting point is a pragmatic one: privacy is a fundamental human right, paramount to the functioning of a just and fair society, essential for the protection of a plethora of other rights—including freedom of expression—in the age of big data, algorithmic decision-making, and surveillance capitalism. Moreso, despite our status as a catalyst for digital innovation, the U.S. woefully lags behind its peers on comprehensive nation-wide data privacy legislation. Look no further than the European Union, whose General Data Protection Regulation took effect in 2018, or Brazil, with its own General Data Protection Law in effect since 2020.

The ADPPA presents the U.S. with an opportunity not just to join the ranks of other countries with comprehensive privacy legislation, but to do it right—building out new industry responsibilities and providing strong protections. We can fundamentally re-shape business models that are built on deception, which extract millions, if not billions, of dollars by selling and re-selling data companies shouldn’t have had in the first place. That’s why OTI and Ranking Digital Rights supported the ADPPA in the first place. The IAB realizes just how close we are to making it happen, and they are terrified.

And we are close. Last year, Congress very nearly passed the ADPPA with bipartisan support after the bill cleared the House Energy and Commerce committee with a bipartisan vote of 53-2. The version that came out of committee incorporated numerous changes making the bill stronger while also maintaining its crucial bipartisan support. In today’s polarized political space, the ADPPA is basically a miracle. While not perfect, ADPPA would codify provisions that are extremely important and necessary, like civil rights protections on the use and processing of data; a national registry for the shady data broker industry; new user rights to access, edit, and delete personal data, data minimization obligations; and much more.

ADPPA ultimately failed to receive a floor vote last Congress—owing to entrenched opposition from California lawmakers who bowed to bad faith concerns from state regulators rather than stand up for a strong, bipartisan bill. While the bill’s opponents may feel like taking a victory lap, it’s clear that ADPPA, or something quite like it, can still move forward in this Congress.

What David Cohen and the IAB well know is that the status quo on privacy is not sustainable long-term. Tired of federal inaction, many states are moving ahead with their own privacy laws. With varying degrees of protection, and differing sets of rights and responsibilities, they would be difficult to follow for both users and industry, making compliance costly. Without action at the federal level, the situation will only worsen for tech companies and the IAB alike. And these state laws, while useful for those that are lucky to be using the internet in those states, are not a panacea for the country as a whole. Now that the country is coming to understand the dire need to protect privacy, all of us will be better off with a strong, uniform federal standard.

If Democrats, Republicans, civil society activists, and tech companies all agree on the need for comprehensive national privacy legislation, what do you call a fringe group that says they're all crazy? Sometimes, it's defenders of the status quo who are the most extreme.