• by Wendy Davis , Staff Writer @wendyndavis, April 8, 2024

This much is certain: On Sunday afternoon, bipartisan lawmakers released a discussion draft of a broad national privacy bill that would override many state laws. 

What's less clear is how the draft version of the American Privacy Rights Act would affect online advertising -- including whether it creates an opt-in or opt-out system for data-driven advertising, or whether it would completely prohibit companies from drawing on consumers' web browsing data for ad targeting purposes. 

Critically, some sections of the draft bill give consumers the right to opt out of targeted advertising -- defined in the draft as ads based on known or inferred interests -- when based on non-sensitive data. But the draft's broad definition of “sensitive” information includes data collected across sites and over time -- in other words, the type of web browsing data that fuels online behavioral advertising.

Other language in the draft would require companies to obtain consumers' explicit consent to “transfer” their web browsing data for ad targeting purposes. While the word “transfer” is fuzzy, that provision arguably creates an opt-in regime for online behavioral advertising.

Yet another provision could be interpreted as completely prohibiting companies from harnessing web browsing data for targeted advertising, according to David LeDuc, vice president of public policy at the self-regulatory group Network Advertising Initiative. That provision -- which appears in a section outlining permitted uses of consumers' data -- seemingly allows companies to process only non-sensitive data for ad purposes.

"There's a good deal of ambiguity in this initial draft that needs to be sorted out," LeDuc says.

He isn't the only one to note the bill's apparent inconsistencies.

“It seems like we could have an opt-in, opt-out and flat ban on the same types of advertising processes all at once,” Keir Lamont, legislative expert with the think tank Future of Privacy Forum, said Monday at an online discussion convened by the International Association of Privacy Professionals.

The ad industry can be expected to oppose either an opt-in requirement for behavioral advertising or a ban.

Chris Oswald, executive vice president at the Association of National Advertisers, said through a spokesperson that while the group supports national privacy legislation, it has some “notable concerns around some of the language.”

Attorney Stuart Ingis, who is chairman of the law firm Venable and represents ad industry organizations, told MediaPost that either an opt-in mandate or an outright ban “would be very harmful to consumers and businesses and unnecessary.”

He also notes either restriction would also go beyond any current state privacy law. Most states that have passed comprehensive privacy laws generally allow companies to engage in online behavioral advertising on an opt-out basis.

Ingis adds that the self-regulatory organization Digital Advertising Alliance -- which requires companies to inform consumers about online behavioral advertising and allow them to opt out of receiving targeted ads -- “provides effective choice to consumers and allows for responsible use of data.”