The Daily: Privacy legislation patchwork explained, the toughest content law in the West, and Gannett sues Google

On today's episode, we discuss what the current patchwork of privacy legislation looks like in the US, what the most protective state privacy laws include, and whether a federal privacy law is on the horizon. "In Other News," we talk about the countdown to comply with the West's toughest content law and the significance of Gannett suing Google. Tune in to the discussion with our analyst Evelyn Mitchell-Wolf.

Subscribe to the “Behind the Numbers” podcast on Apple Podcasts, Spotify, Pandora, Stitcher, Podbean or wherever you listen to podcasts. Follow us on Instagram

Verisk Marketing Solutions, a business unit of Verisk formed through the integration of Infutor and Jornaya, empowers marketers and platform partners with deep consumer insights to power precise and personalized omnichannel interactions. Verisk Marketing Solutions provides a unique combination of identity resolution, consumer attributes and behavioral data that integrates with marketers’ existing technology and evolves with consumers’ ever-changing behavior—all while maintaining the highest data security and privacy standards. To learn more about the consumer intelligence solutions available through Verisk Marketing Solutions, visit marketing.verisk.com.

Episode Transcript:

Marcus Johnson:

This episode is sponsored by Verisk Marketing Solutions. As a marketer, there's too much at stake to ever have to guess at the who, what, and when. Verisk Marketing Solutions enriches the consumer data for many of the top insurance carriers, mortgage lenders, banks, and media and ad tech platforms in the US, With the latest identities, attributes, permissions, and market behaviors, you can confidently acquire, retain, and grow your ideal customers. Visit marketing.verisk.com for more information.

Evelyn Mitchell-Wolf:

And preemption is the key to solving that business challenge presented by the patchwork of state level legislation, and while the ADPPA has bipartisan support in backing from advertising stakeholders and privacy advocates alike, which is no easy feat.

Marcus Johnson:

Hey, gang. It's Thursday, July 13th, Evelyn and listeners, welcome to the Behind the Numbers Daily: an eMarketer Podcast made possible by Verisk Marketing Solutions. I'm Marcus. Today I'm joined by one of our senior analysts on the digital advertising and media team based in Virginia. It's Evelyn Mitchell-Wolf.

Evelyn Mitchell-Wolf:

Hello, Marcus. Hello, everyone.

Marcus Johnson:

Hello, hello. Today's fact is picked specifically for you. So Evelyn is a theater person.

Evelyn Mitchell-Wolf:

I sure am.

Marcus Johnson:

Yep. I've got a question for you about the theater. Well, it'd be weird if I had a question about Tigers. It wouldn't be relevant at all. So what else would it ... Of course, it was going to be about theater. What are the top three highest grossing Broadway shows of all time?

Evelyn Mitchell-Wolf:

All time?

Marcus Johnson:

All time ever.

Evelyn Mitchell-Wolf:

Well, definitely Phantom of the Opera is one of them.

Marcus Johnson:

Oh, number three? Yep. 1.3 billion. That's third.

Evelyn Mitchell-Wolf:

This is hard. Wicked?

Marcus Johnson:

If you don't get it right ... Yes, Wicked is second, 1.4 billion. If you don't get this next one right, I'm doing the show myself. I'll just make up the answers, and it's just me and the listeners. I'm going to do this monologue. Actually, I'll probably just talk about the Lakers for 20 minutes, actually. So for the love of God, save the listeners-

Evelyn Mitchell-Wolf:

Should I sabotage?

Marcus Johnson:

No, no. The listeners don't want that. They couldn't care less, and I don't blame them. So you've got full love of the listeners.

Evelyn Mitchell-Wolf:

Les Mis.

Marcus Johnson:

Okay, bye. It's been fun having you on, Evelyn. We'll see you tomorrow for the Week of Listen, where you'll be joining us-

Evelyn Mitchell-Wolf:

What is it?

Marcus Johnson:

But for now, you're out of here.

Evelyn Mitchell-Wolf:

Is it the Fantastics? Wait.

Marcus Johnson:

Nope. Come on.

Evelyn Mitchell-Wolf:

Okay.

Marcus Johnson:

This is going to kill you when I give it to you. You ready?

Evelyn Mitchell-Wolf:

Yeah.

Marcus Johnson:

You're not ready. Let me give you a clue.

Evelyn Mitchell-Wolf:

Lion King.

Marcus Johnson:

Yeah, there she is.

Evelyn Mitchell-Wolf:

Ah. Okay. Third time's the charm. There you go.

Marcus Johnson:

God, you guys are lucky, man. You nearly were going to have me ranting about the off season and how bad we'll be next year. But luckily, Evelyn saved the day. Lion King is first, according to a Go Banking Rate study 2022. The Lion King, 1.7 billion, then it's Wicked, and then Phantom of the Opera. Second place, Wicked, has half the number of performances as third place, Phantom, but it's still second, which is amazing. So Phantom has a lot more performances, but Wicked's ahead, Lion King's about the middle in terms of performances.

Hamilton, in case, you're wondering, that's 730 million. So it's half as many as a second place, Wicked. But Wicked's 12 years older than Hamilton. So Hamilton is younger, had less time to make money, and Chicago is fifth, rounds out the top five. That's all we've got time for. No, it's all we have time for. What the hell have we got time for the fact of the day, but there's still plenty to show. Today's real topic, privacy explained.

In today's episode, first in the lead, we'll cover privacy, not the Lakers. And then we'll move into another news where we'll be talking about the countdown to comply with the West's toughest content law. Big deal. And then we'll talk about Gannet and why they're filing a suit against Google. We start with the lead, privacy. Evelyn, you've just recently written a piece about privacy and it's talking about some of the most important things you need to know today related to what's going on in the world of privacy, but it's also an explainer as well. So as you take listeners through, you're walking side by side with them and explaining things, pointing things out, like a tour, if you will.

Evelyn Mitchell-Wolf:

A tour to privacy.

Marcus Johnson:

Exactly, exactly, exactly. When explaining things as you go through the report. And so we'll start with this map that you have in the report, and it really does, when we talk about our patchwork quilt of privacy legislation and what that looks like throughout the US, that's the image that you conjure up in your head. It's this map of the US and where the colors are, which ones have past legislations, which ones are working on it. And so what does that look like currently? What does that patchwork quilt of privacy legislation look like in the US as of mid-July?

Evelyn Mitchell-Wolf:

So as of July 1st, there are a couple of new privacy laws in the United States that are in effect, but as of this recording, 10 states total have passed comprehensive consumer data protection laws. And I think we've officially passed the point where it makes sense to name every state, but I will name the ones that have gone into effect at this point. So California, of course.

Marcus Johnson:

Yep.

Evelyn Mitchell-Wolf:

Virginia. And then as of July 1st, Colorado and Connecticut. Utah, also important to know, its law will go into effect on December 31st. So that's five laws that are in effect now, or will be by the end of the year.

Marcus Johnson:

Okay.

Evelyn Mitchell-Wolf:

There are five more laws that are officially on the books. And then beyond that, six states have active bills on the subject of privacy, and 15 have inactive bills. So the overall trend is that the legislative tide here in the US increasingly favors privacy, and these are laws that apply to a broad range of data generated by consumers. There has also been legislative action that specifically applies to health data, like My Health My Data Act passed in Washington State in April. And that's another frontier in privacy legislation that we expect to pick up steam in the next few years, given the fallout surrounding the Supreme Court's decision to strike down Roe v. Wade.

Marcus Johnson:

So quick math, about half of the states have something going on privacy related, whether it's passed, in process, or in inactive bill. And as you point out in your research, it started with California, right? The first US state to pass comprehensive privacy legislation five years ago started with the California Privacy Act, the CCPA, California Consumer Privacy Act, right?

Evelyn Mitchell-Wolf:

Yes.

Marcus Johnson:

The California Consumer Privacy Act, CCPA, and then the CPRA, the California Privacy Rights Act, which strengthened it afterwards.

Evelyn Mitchell-Wolf:

Yep.

Marcus Johnson:

Okay, so that's the rough patchwork quote.

Evelyn Mitchell-Wolf:

Yeah, and it's definitely also an alphabet soup. I mean, all these laws with all the letters.

Marcus Johnson:

Yes.

Evelyn Mitchell-Wolf:

Especially California-

Marcus Johnson:

It's [inaudible 00:06:41].

Evelyn Mitchell-Wolf:

... uses some combination of CP and A in most of the laws and in the enforcement bodies, it's a whole mess. So-

Marcus Johnson:

That's why we're here.

Evelyn Mitchell-Wolf:

If you get confused about it, don't worry. You're not alone. It's a lot.

Marcus Johnson:

Yep. Read the report.

Evelyn Mitchell-Wolf:

Yeah.

Marcus Johnson:

You can read the report.

Evelyn Mitchell-Wolf:

The report will help.

Marcus Johnson:

Good plug. So lots of different things going on around the country, but what are a couple of major similarities between state laws?

Evelyn Mitchell-Wolf:

So all 10 enacted state laws ensuring consumers' right to opt out of certain processing or sales of personal data, which means that adult consumers are opted into those practices by default, and this differs from the EU's approach of requiring businesses to obtain consent from consumers before processing or selling their personal data under the GDPR. All US state privacy laws also require businesses to notify consumers about data collection practices and privacy policies, which makes sense because how can consumers exercise the right to opt out if they have no information about what they're opted into?

Marcus Johnson:

I didn't know I could opt out. I don't think so. And what about the differences? Two major differences between these state laws?

Evelyn Mitchell-Wolf:

Couple major differences between current state laws, and as with anything, the devil is in the details, so I'm just highlighting a few. So some states require businesses to conduct formal risk or impact assessments of data collection and privacy practices. Some states don't require that, and then some states grant businesses the opportunity to remedy privacy violations before being penalized. It's known as a cure period. And if a state has a cure period, it can be anywhere from 30 to 90 days, and some states will sunset the cure period provision after the privacy law has been in effect for a certain amount of time.

Marcus Johnson:

Okay.

Evelyn Mitchell-Wolf:

So it varies drastically by state to state, I would say.

Marcus Johnson:

Great. That's perfect. That's just exactly what the listeners reported to hear. So in the report, you lay out a couple of the things that the most protective state privacy laws would include. So if you were laying out the most protective state privacy laws, what would they include? Hit us with two of those things.

Evelyn Mitchell-Wolf:

All right. So first one would be that they are more broadly applicable. So they protect more consumer data and they have lower thresholds for businesses to fall under purview of the law, which means more businesses fall under purview of the law. So they're more broadly applicable, and then the more protective state privacy laws also have what's known as a private right of action, which means consumers can seek compensation from a business for certain violations of the law.

Marcus Johnson:

Okay. And so what would the least protective state privacy laws lack?

Evelyn Mitchell-Wolf:

Lots, but two that come to mind-

Marcus Johnson:

Okay, good. Moving on.

Evelyn Mitchell-Wolf:

Two big ones are the right to revoke consent at any time for any reason, which is a biggie, obviously. And then another one, least protective state laws lack required risk assessments for businesses.

Marcus Johnson:

Okay.

Evelyn Mitchell-Wolf:

Yeah.

Marcus Johnson:

So outside of California, I'm assuming California is the most comprehensive still.

Evelyn Mitchell-Wolf:

It is.

Marcus Johnson:

Right?

Evelyn Mitchell-Wolf:

Yes.

Marcus Johnson:

Okay. So you've just explained to us how much of a nightmare this sounds like for basically everyone involved, and everyone's quietly thinking to themselves, and I guess more loudly as time goes on, "For the love of God, please just put together a piece of legislation privacy related that covers the entire country." Is a federal privacy law on the horizon? If so, when? If not, why?

Evelyn Mitchell-Wolf:

Well, it depends on who you ask. My humble, if optimistic, opinion is yes, there is a federal privacy law on the horizon because most US consumers support federal regulation of data privacy, and that majority has grown stronger every year since 2020, according to 451 Research. And then, like you mentioned, businesses are loudly advocating for a federal privacy law as well because each state having its own privacy law is a major headache. So having one set of compliance standards at the federal level would simplify things.

Legislators are working on it. In 2022, Congress introduced a bill called the American Data Privacy and Protection Act, the ADPPA. Some people call it ADPPA. I'm going to call it the ADPPA. And the bill made it farther than any of its predecessors, but stalled after being approved by the Committee on Energy and Commerce. So it's restarting the legislative process with the new Congress.

Marcus Johnson:

Okay. Why did it stall?

Evelyn Mitchell-Wolf:

So there are two big hurdles that the ADPPA faces here. The first is preemption. Typically, when state and federal laws conflict, federal law preempts or supersedes state law, and preemption is the key to solving that business challenge presented by the patchwork of state level legislation. And while the ADPPA has bipartisan support and backing from advertising stakeholders and privacy advocates alike, which is no easy feat, California delegates have expressed concern that it would lead to less comprehensive protection than the CCPA and CPRA do.

Case in point, the ADPPA lacks that private right of action that we discussed earlier. Californians do have that right undercurrent state law. So that's the first hurdle is preemption and the conundrum there. The second hurdle is innovation. The ADPPA takes a data minimization approach to privacy, which just means that businesses are required to limit the data they collect to what is strictly necessary as defined under the law. And then the ADPPA proposes 17 permissible purposes for collecting and using consumer data. And there are concerns that the scope of the bill is too narrow to enable tech innovation. So those are big problems, obviously, but the chorus of voices asking for this legislation continues to grow. So I think it'll get harder for Congress to remain waffling on it.

Marcus Johnson:

I mean, you mentioned the chorus of voices and the number that you've cited at the top of your answer, I just want to come back to that for a second because I thought that was really interesting. So in 2020, 70%, today, 80% of US consumers are more likely to support federal regulation of data privacy. This is 451 Research Who said this? What's interesting here, though, Evelyn, is the share of people who were not likely to support it went up as well. So it went from nine to 11. So it went up a tiny bit. It's a tiny share, but it went up a tiny bit.

So what's changed is that folks who back in 2020 replied, "I don't know to the survey," are now likely to say, "I support federal regulation of data privacy." They're more likely to be in that camp. So the folks who are unsure are now sure, but they're sure that they want it, not sure that they don't. We'll see, though. There are a lot of things that most people in the country agree on and want to see that don't come to fruition, normally because some folks are making too much money to change the status quo. But we'll see with this one. Let's wrap up the lead by talking about what advertisers need to be doing, thinking about right now when it comes to privacy. Give us one thing, Evelyn.

Evelyn Mitchell-Wolf:

So I think advertisers need to remember that this is about consumers. These days, privacy can get wrapped up in legal technicalities and is often seen as a drain on resources that provides little positive value to a brand. But consumers are getting savvier about their data. Like you mentioned, we see consumers deciding whether or not they support federal regulation of data privacy. So consumers understand that they are generating heaps of data every time they go on the internet, and they feel like there should be a little bit more oversight into how that data is used. And it's getting harder to pretend that a consumer clicking on "Accept all cookies," is actually informed consent, and privacy can be a differentiator for brands. It's not just about legal compliance, although that is important. It's also about maintaining a good relationship and building trust with consumers.

Marcus Johnson:

Excellent. That's all we've got time for, for the lead. No halftime report because that was a perfect thing that was worth repeating from the first half to summarize what we talked about in the lead. Evelyn's full report is called Privacy Legislation and Regulation Explainer: What Marketers Need to Know to Brace Themselves for Tighter Consumer Data Protection. Link is in the show notes, of course. So you can click that or you can head to insider intelligence.com to read the whole thing. We move, of course, to the second half of the show today. In other news, the countdown to comply with the West's toughest content law and Gannett files a suit against Google.

Story one: TikTok, Twitter, and Meta face a countdown to comply with the West's toughest content law. Arise Sam Schechner and Kim Mackrael of the Wall Street Journal, they explain that the world's most far-reaching digital content law, the EU's new digital services at DSA will oblige 19 social media search and e-commerce services to comply with strict new data rules by late August. Under the DSA, as it's called, these internet giants must maintain systems for taking down content that violates their terms or that European national governments consider illegal whilst providing users with tools to appeal. The journal article notes the law also requires regular outside audits and sharing details of their content algorithms with regulators. But, Evelyn, the most interesting sentence in this article about the countdown to comply with the DSA is what and why?

Evelyn Mitchell-Wolf:

That violators face fines of up to six percent of their global annual revenue. And I find that interesting in relation to GDPR, which has maximum fines of four percent of a company's global annual revenue, or 20 million Euros, whichever is higher. So the DSA is serious business if they're willing to subject businesses to higher fines for violations than they are for even GDPR.

Marcus Johnson:

Yeah, GDPR, General Data Protection Regulation, Europe's privacy law, six percent of their worldwide annual revenue, as Evelyn said, so it could get fined six percent and/or have their platform services blocked in the case of certain repeated infringements. The article was also noting these internet giants are in the crosshairs because, in February, they said that they had over 45 million monthly active users in the EU. The journal article was pointing out that means they can touch at least 10% of the EU's population. So that's why these folks are being talked about in this piece, those internet giants. The UK nearing the final stretch of a parallel law, the online safety bill, which creates tough new requirements for social media companies with a particular focus on protecting kids, the piece notes.

Story two: "Gannett, America's largest newspaper chain says Google's power over ad tech has contributed to the decline of local news," writes Katie Robertson of the New York Times. Gannett, who publish USA Today, as well as over 200 daily newspapers across the country, has filed a suit against Google accusing them of violating federal antitrust laws. Ms. Robertson of the New York Times notes that while the online ad market is worth 200 billion a year, the complaint said news publishers have seen a nearly 70%, seven-zero percent drop in ad revenue since 2009, which has diminished journalism jobs and put many newspapers out of business. But Evelyn, the most interesting sentence in this article about Gannett filing a suit against Google is what and why?

Evelyn Mitchell-Wolf:

It's a quote from Mike Reed, chief executive of Gannet. He said, "News publishers depend on digital ad revenue to provide timely cutting edge reporting and essential content communities rely on, yet Google's practices have had negative implications that depress not only revenue, but also force the reduction and footprint of local news." And Google is, of course, refuting those claims. But in keeping with today's theme of privacy, Google is also facing scrutiny for its decisions in the privacy realm.

Privacy moves like the deprecation of third-party cookies in Chrome have elevated the importance of first-party data in advertising, which publishers have first-party data as well, but Google has one of the most robust repositories of first-party data across its many consumer facing products. So it is poised to take on even more importance in the advertising ecosystem, which puts publishers in an even tighter bind.

Marcus Johnson:

Our very own senior director of briefing, Jeremy Goldman, pointing out that in an attempt to write the narrative, Google announced it will release its Google Showcase news platform in the US this summer. After multiple delays, over 150 digital publishers are scheduled to receive a payment for their content being featured on the platform. That's all we've got time for this episode. Thank you so much to Evelyn for hanging out today.

Evelyn Mitchell-Wolf:

Thanks, Marcus. Thanks, everyone.

Marcus Johnson:

Yes, indeed. We'll see you tomorrow for the Weekly Listen.

Evelyn Mitchell-Wolf:

Oh yeah.

Marcus Johnson:

Thanks to Victoria who edits the show. James ... You said that like you're just learning about that right now.

Evelyn Mitchell-Wolf:

No, I forgot. But-

Marcus Johnson:

Oh, okay. Good, all right. [inaudible 00:19:18]

Evelyn Mitchell-Wolf:

But I will be there. Don't worry.

Marcus Johnson:

All right. Just, yeah, Victoria, we'll have to find someone else, apparently, because Evelyn did not mark it down at all. Evelyn will not be there. Maybe she will. We'll see. Victoria, thank you to you because you edit the show. James, you copy edit it. And Stuart, you run the team. Thank you to you folks. Thanks to everyone for listening in. We'll see you tomorrow, hopefully for the Behind the Numbers Weekly Listen, not starring Evelyn. Maybe it will, maybe it won't. An eMarketer Podcast made possible by Verisk Marketing Solutions.