• by Wendy Davis  @wendyndavis, July 17, 2023

New privacy rules for data brokers should come from federal lawmakers, not the Consumer Financial Protection Bureau, ad organizations argue in new filings with the agency.

“Congress is the sole body vested with the authority to enact comprehensive federal privacy legislation that would ensure ethical and responsible data practices continue to flourish, while barring misuses of personal data that put consumers at risk of harm,” the Association of National Advertisers says in comments submitted Friday.

“We strongly believe a federal privacy standard must be enacted by the democratically accountable representatives in Congress,” the umbrella group Privacy for America adds.

The filings come in response to the bureau's request for input regarding data brokers -- broadly defined as firms that “collect, aggregate, sell, resell, license, or otherwise share consumers’ personal information with other parties.”

The agency sought comments about topics including what type of information is collected, whether that data may influence “consumer purchasing patterns or levels of indebtedness,” what benefits data brokers provide, and whether consumers can wield control over data collection about them.

The bureau largely pegged its request to authority to issue regulations under the Fair Credit Reporting Act -- a law from the 1970s that regulates “consumer reporting agencies.”

Among other provisions, that law restricts consumer reporting agencies from sharing consumer information with anyone that lacks a legitimate need for it, and requires credit reporting agencies to investigate information consumers say isn't accurate.

The Association of National Advertisers says the Consumer Financial Protection Bureau's authority regarding data is limited to companies that are subject to the Fair Credit Reporting Act, or other specific laws; in general, those companies include consumer reporting agencies, businesses that provide information to consumer reporting agencies and financial institutions.

Privacy for America -- whose members include the American Association of Advertising Agencies, Association of National Advertisers, Digital Advertising Alliance, Interactive Advertising Bureau and Network Advertising Initiative -- likewise argues that the Consumer Financial Protection Bureau lacks authority to broadly regulate data brokers.

The laws setting out the agency's authority “do not explicitly or implicitly give the agency the power to issue sweeping and encompassing regulations impacting the collection, use, and disclosure of data about consumers by data services companies,” Privacy for America writes.

But the advocacy group Electronic Privacy Information Center, which supports privacy regulations, argues that data brokers “can and should be regulated” under the Fair Credit Reporting Act and related financial protection laws.

The organization writes that data brokers harm consumers in several ways, including by fueling ads that influence consumer's purchases.

“The data broker ecosystem limits consumer autonomy by shaping purchasing preferences and patterns,” the privacy organization writes.

The group adds that data can also be used to prevent ads from being shown to people based on demographics, depriving people of opportunities.

“The profiles that data brokers amass, share, and sell to advertisers enable advertisers to precisely specify and target which categories of users to include or exclude from their marketing campaigns,” the organization writes. “Moreover, the inclusion of automated tools in ad delivery can reinforce discriminatory prejudices and biases related to race, gender and socioeconomic status.”

The privacy watchdog also says companies “offer lead-generation products seemingly based on credit report information,” even though the Fair Credit Reporting Act prohibits the use of consumer reports for targeted marketing (except for prescreened credit offers).

Privacy for America and the Association of National Advertisers both say in their comments that data brokers offer benefits.

“In the digital age, all sizes and types of enterprises engage in ethical and responsible data practices to identify potentially interested consumers, reach these consumers with personalized messaging, and avoid waste in marketing spending,” the Association of National Advertisers writes. “Data brokers help companies leverage and optimize data they may hold to distribute important messaging and expand their reach.”

That group adds that the “ethical and responsible” use of data enables companies “to engage in proactive outreach to consumers in historically underserved and marginalized communities.”

For instance, the organization writes, “ethical and responsible data practices, facilitated in part by data brokers, help inform a grocer to place a location in a food desert, and a transportation network to expand its services into previously underserved markets.”