What would a federal privacy act mean for brands?

Matt Voda: There has been a renaissance in that space with more modern techniques. And as brands look for more privacy-forward ways or safe future-proof options, they're embracing some more traditional techniques that have gotten a new look.

Dave Bittner: Hello, everyone, and welcome to "Caveat," the CyberWire's privacy, surveillance law and policy podcast. I'm Dave Bittner, and joining me is my co-host, Ben Yelin from the University of Maryland Center for Health and Homeland Security. Hello, Ben. 

Ben Yelin: Hello, Dave. 

Dave Bittner: Today, Ben discusses the FTC's bold new legal strategy against big tech. I've got the story of data brokers selling information on pregnancies. And later in the show, Matt Voda from OptiMine on what a federal privacy act may mean for brands. 

Dave Bittner: While this show covers legal topics and Ben is a lawyer, the views expressed do not constitute legal advice. For official legal advice on any of the topics we cover, please contact your attorney. 

Dave Bittner: All right, Ben, we've got a full show this week. Why don't you start things off for us with some stories? 

Ben Yelin: Sure. So I'm discussing big tech and their dominance over smaller markets again this week - common theme for us. 

Dave Bittner: (Laughter). 

Ben Yelin: But this story really caught my eye. It's from The New York Times and is entitled "FTC Chair Upends Antitrust Standards With Meta Lawsuit." So Lina Khan was just confirmed to be the new chair of the FTC. She's new in her position. I guess it's been about a year now. 

Dave Bittner: Yeah. 

Ben Yelin: And she is taking aggressive action in trying to break up the market share or the monopoly power of big tech companies, and she's doing so in a rather innovative way. So Meta, the company formerly known as Facebook... 

Dave Bittner: Right. 

Ben Yelin: ...Purchased a VR fitness startup called Within. Having never used VR fitness technology and barely knowing what that would even look like, I can imagine it's a great product. 

Dave Bittner: (Laughter). 

Ben Yelin: Not necessarily something I would use. 

Dave Bittner: Yeah. 

Ben Yelin: This is part of Meta's effort to create the so-called metaverse. 

Dave Bittner: Right. They want to corner the market on the metaverse or at least get a jumpstart on other competitors, right? 

Ben Yelin: Exactly. 

Dave Bittner: Yeah. 

Ben Yelin: So we're all rolling our eyes. 

Dave Bittner: (Laughter). 

Ben Yelin: For most of the past 100 years, this is not something that regulators would challenge. A large company purchasing a small company in a developing market, one where you can't really tell who the big players are; you don't know how the market is going to develop - that means that the issue is not ripe for legal challenges, at least that's been the traditional understanding. 

Dave Bittner: OK. 

Ben Yelin: The FTC is filing a lawsuit to challenge this acquisition. And this is upending decades of antitrust standards. What The New York Times is saying is that this could be a wholesale shift in the way Washington enforces competition across corporate America. And basically, the notion is you can apply antitrust law prospectively, before you wait for the market to mature, to the point where you know which companies hold all the power. Big tech companies are obviously terrified of this new development. 

Dave Bittner: (Laughter). 

Ben Yelin: And to be honest - you know, I always try and understand both sides to every issue - their claim about stifling innovation, I think, has a lot of merit to it. If you don't let a market develop naturally, without the involvement of regulators, you might stop an industry from bubbling up that otherwise would have happened, absent the regulatory action. So Meta purchasing this small VR fitness company could really develop the market for the fitness company. It would allow the startup that came up with this idea to make money, which would encourage other startups to create innovative, interesting products that Meta or any other big tech company would want to buy. So that's one side of it. 

Ben Yelin: But the other side of it is, if we are really going to change the way we look at big tech and focus on protecting the interests of the consumer, then I think it is important for our regulators to act prospectively and try and stop big tech monopolization before it happens 'cause what's happened traditionally in the past is Facebook - or as it existed prior to its Meta days - would buy up some small startup company, maybe something like an Instagram or a - you know, you have Google purchasing a young startup called YouTube. 

Dave Bittner: Right. 

Ben Yelin: And it may seem like a small acquisition at the time, but it puts them, these big tech companies, on the path to acquiring monopoly power. So I think there is certainly a justification for this type of pre-enforcement. The legal challenge here is not likely to succeed. Obviously, you have to go to court. 

Dave Bittner: (Laughter) OK. Right. 

Ben Yelin: And the FTC isn't a dictatorship. 

Dave Bittner: Yeah. 

Ben Yelin: So they can't just make these decisions. And I think most legal scholars see this strategy as probably doomed toward failure. And not to get too much into the legal weeds, but basically, the Constitution says that courts can hear, quote, "cases and controversies." And one element of that is that the case has to be ripe in order for a court to hear it, meaning the issues have to be developed and presented in a way that there is an actual live controversy, not something that's anticipated that might happen in the future. The general standard is you have to challenge something that's either already happened or that is certainly impending. And since we don't know whether there is actually going to be a monopoly or some kind of antitrust violation, I think courts are likely to say that this case is not yet ripe, according to our jurisprudence, and they'll probably throw the lawsuit out. 

Ben Yelin: But the strategy itself is interesting and, I think, reflects the FTC's newfound or, I guess, rediscovered commitment to protecting the consumer by cutting down on the market share of big tech companies. 

Dave Bittner: So is this - I mean, do we view this as being kind of a shot across the bow from the FTC of just putting the industry on notice? 

Ben Yelin: Yeah, and that's how some of these legal theories develop. Sometimes you file a lawsuit that's doomed to fail. But you are getting the theory out there, and maybe eventually enough judges will be appointed that are amenable to this position. So even if it's not going to succeed the first time, it might succeed down the line when the legal theory has been developed. You have law review articles written about it. The academic world, its interest is piqued. I think sometimes that's how new legal theories develop. You can't just write about them theoretically; you kind of have to try your hand at an actual case, to get it into court, to get a judge to actually consider it. And that's what's happening here. It is a real break from tradition. Regulators generally rubber-stamp these types of purchases. 

Dave Bittner: Right. But... 

Ben Yelin: 2006 - Google buys YouTube, bam, rubber stamp. 

Dave Bittner: Yeah. 

Ben Yelin: Facebook, 2012, buys Instagram - rubber Stamp. So this really is a new frontier in the FTC's philosophy on this. 

Dave Bittner: And, I mean, it's the FTC kind of saying to these companies, hey, we got our eye on you. Just so you know, you know, as you're doing this, as you're trying to gobble up any potential competition or get ahead of the competition, we're going to have - you're going to be under scrutiny from us. 

Ben Yelin: Right. Exactly. So perhaps Meta is now going to have to think twice before acquiring smaller companies. It's still to their monetary advantage at this point. I think they could hedge and realize that the legal landscape isn't going to change drastically overnight. And from Meta's perspective, the FTC and its leadership hasn't answered the basic question here, which is how could Meta acquiring a single small fitness app in an incredibly dynamic market space... 

Dave Bittner: Right. 

Ben Yelin: ...Possibly harm competition? And I understand it theoretically. I understand what the FTC is saying about having to take action prospectively, before we have a situation where the market is completely cornered. But that's going to be a really hard case to make in court. You can't argue that something is harming competition, which is the accepted prevailing legal standard, without seeing how the market itself actually develops. So I think Meta, while they see this as a potential warning, a shot across the bow, they're certainly pushing back on it. Their legal department is on it. They are criticizing the FTC for making this decision. I don't think they're necessarily panicked yet. I think they see this as something they have to head off before it gains additional steam. 

Dave Bittner: What if you're one of Meta's competitors who's interested in this market? Like, you know, there's a lot of rumors that Apple is working on this kind of thing. This would have your attention as well, certainly. 

Ben Yelin: Oh, yeah. I mean, I don't think they're going after Meta out of some sort of personal vendetta, although if they did, you know, maybe that's understandable to some people who just don't like Mark Zuckerberg. 

Dave Bittner: (Laughter) Right. 

Ben Yelin: I think this applies to any company. I think this philosophy is going to apply to the big four - so Apple, Meta, Amazon and Google, the four companies that this really would apply to, the ones who are the real titans in the industry. 

Dave Bittner: Yeah. 

Ben Yelin: So I don't think this is specific to Meta. If Apple tried to take an action like this and the FTC saw the potential for the market to be limited, the market to be cornered, I think they would take the same action. So I think it's a warning to all of the big titans in the industry. 

Dave Bittner: Yeah. It's interesting to me because I wonder - as you say, you know, you've got the big four. Is this as much a signal that the FTC thinks that the big four might be a little too big - if not too big, maybe too big for their britches? 

Ben Yelin: Yeah. I think this is certainly a signal of that. And the FTC is not alone in believing that. We've seen and we've talked about bipartisan proposals in Congress to break up the big tech companies. 

Dave Bittner: Right. 

Ben Yelin: Some bills are stronger than others. The ones that pass might not actually curtail the power of these four big companies. But there is certainly a belief that these companies have just become too powerful. And we've had this situation in the country before, prior to the existence of our digital universe. There's a reason trust-busting became relevant in the early 1900s. It's because there was this sort of concentration of power in some of the major - three or four major companies that just controlled vast amounts of our economy and our industry, and it was really hurting the consumer. We had this Gilded Age where very few people were getting exorbitantly rich, and the rest of us were suffering the consequences. 

Dave Bittner: Sounds familiar (laughter). 

Ben Yelin: Yeah. I don't know if our regulators... 

Dave Bittner: What's that saying - history doesn't necessarily repeat itself, but it sure does rhyme? 

Ben Yelin: History certainly does rhyme. 

Dave Bittner: (Laughter) Right, right. 

Ben Yelin: And it's only been a century. I mean, this is not ancient history. 

Dave Bittner: Yeah. 

Ben Yelin: And I think the political tides kind of ebb and flow. And you can have kind of a period of let's let the market do what it wants to do, let's not stifle innovation by limiting these types of acquisitions. 

Dave Bittner: The government shouldn't be picking winners and losers. 

Ben Yelin: Exactly. 

Dave Bittner: Right. 

Ben Yelin: But if it goes too far in the other direction, which I think you could certainly make the argument that's happening now, where you have these four power players who - it's not just that they control this industry, but because of how ubiquitous devices and some of these products are in our lives, they really control our lives. I mean, how much of your day is spent interfacing with one of these four companies? 

Dave Bittner: Yeah. 

Ben Yelin: I mean, when I leave here, I'm probably going to check my Facebook page, purchase something on Amazon and, you know, check my Gmail and do a Google search. So it's so ubiquitous in our lives. I think it's natural that we're seeing this sort of backlash. I don't think we would have seen it at the FTC if it were not for this new slate of more antitrust - or I'd say these more trust-busting-minded commissioners, and that's a result of the Biden administration's priorities. And that certainly could be reversed under a future presidential administration. 

Dave Bittner: Right, right. OK. Yeah. As you say, these things can swing back and forth. 

Ben Yelin: Absolutely. So I just think the FTC doesn't expect to win this case. But as part of this process of swinging the pendulum back in the other direction, I think they see having a lot to gain from bringing the case, even if they lose it... 

Dave Bittner: Yeah. 

Ben Yelin: ...Just to get this theory out there and just to put these big companies on notice that perhaps the landscape is changing. You should think twice before purchasing a small application if that's going to lead to monopolization. 

Dave Bittner: All right. Well, we will have a link to that story in the show notes. My story this week comes from Gizmodo. This is an article titled "These Companies Know When You're Pregnant - and They're Not Keeping It Secret." This is written by Shoshana Wodinsky and Kyle Barr. You know, Ben, there's that famous story we've talked about many times about, oh, there was the woman who was pregnant, and Target figured out she was pregnant before she was pregnant. It was a teenage girl. 

Ben Yelin: Ah yes, that story that may or may not be true, but sounds true. 

Dave Bittner: Right. It sounds true. And this story actually points out - that there is controversy as to whether or not it actually happened. But this story does say that Target had indeed tasked someone on their team of figuring out if shoppers were indeed pregnant, you know, using the - what are they? - the loyalty cards... 

Ben Yelin: Right. 

Dave Bittner: ...You know, those sorts of things that they use to collect your information. In exchange for discounts they collect your shopping information, and then they sell that information to retailers and others. 

Ben Yelin: This person bought anti-nausea medication and etc., etc. Yeah. 

Dave Bittner: And a crib, and diapers, and car seat and... 

Ben Yelin: Yeah. I think we know where this is going. Yeah. 

Dave Bittner: Right, right. So, you know, I've been thinking about this article, and we're going to dig into some of the details here. But, you know, you have kids. I have kids. So you and I have both been through the experience of being a young, excited, expectant couple. You know, your first child is coming along, and you're just - you know, the anticipation is wonderful, and you're excited about growing your family. And as part of that, I remember - and it's been a while since my kids were little, but I remember you do start getting things in the mail. 

Ben Yelin: Oh, yeah. 

Dave Bittner: Right? And - but that's - like, for me that was part of the fun... 

Ben Yelin: Right. 

Dave Bittner: ...And for my wife as well. You know, oh, look, it's a coupon for diapers. 

Ben Yelin: Discount on the diaper pail - all right. 

Dave Bittner: Right, right. 

Ben Yelin: Yeah. 

Dave Bittner: It's - you know, and little packages would come, and it was just part of the journey. And so I think there's a side of this that says, well, OK, that's great. You know, it'll help us with our joyful journey to becoming new parents. 

Ben Yelin: Right. But there's always a dark side. 

Dave Bittner: (Laughter) That's right. And we wouldn't be talking about this if there weren't. Things have changed recently. And the Supreme Court overthrew Roe v. Wade, and that really puts the knowledge of someone expecting in a different light. It might not be - the need for someone to keep that information private has a different weight on it than it used to. 

Ben Yelin: Absolutely. 

Dave Bittner: Yeah. So let me check in with you on this, Ben. I mean, what's your take so far? 

Ben Yelin: So, I mean, we've talked about this a little in the past couple of months since the Dobbs decision came down. 

Dave Bittner: Right. 

Ben Yelin: But many states either already have or are in the process of criminalizing any abortion services. The next frontier of laws is going to center around how that is enforced. And things like the right to travel to other states are going to come under the microscope. And states attorney - state attorneys general. I finally said that right. 

Dave Bittner: It's so hard (laughter). 

Ben Yelin: I know. They're going to start investigating individuals in kind of the either-or cases where we're not sure if somebody has actually obtained an abortion. And because of the little crumbs of data that all of us leave in our wake by having a smartphone or using the internet, there's going to be a lot of information out there that could be used to prosecute us under some of these new statutes. So it's not just things like period-tracking apps, which I think have gotten a disproportionate amount of the attention. It's also things like collecting location information - cell site location information... 

Dave Bittner: Right. 

Ben Yelin: ...Or doing - reviewing somebody's Google search history or doing certain types of email surveillance. All of those things are going to be areas of vulnerability for people who aren't proactive in protecting their data. And most of us are not proactive in protecting our data. Most of us are proactive in clicking the accept button so that we can enjoy the conveniences of these applications. 

Dave Bittner: Right. 

Ben Yelin: I think what this article is getting at is there's money in it for a lot of players to keep a close track on people who are pregnant, either as expectant mothers or people who are pregnant and may not want to keep that pregnancy. 

Dave Bittner: Right. 

Ben Yelin: So there is a strong incentive, at least in the private sector, to sell that data, purchase that data and use it to make some of these companies really rich. You have - you can find your market pretty easily by collecting this data. 

Dave Bittner: Yeah. This article points out that the price per user - you know, for individual reached - ranges between 49 cents and $2.25 to get the information on someone who might be expecting. And you can understand why. Like, if I'm someone selling formula or diapers and I want to get some brand loyalty, that might be a worthwhile investment for me. But again, you know, this article points out how easy it is to buy this information, how easy it is to access this information. And on the one side, you have the marketing side, which I think, you know, as per our previous part of this conversation, I think we can understand. We can see the value in that. But then there's the law enforcement side. 

Ben Yelin: Right. 

Dave Bittner: And this article points out that there has been a case where there's a woman who, according to the woman, had a miscarriage. But it sounds like law enforcement wasn't necessarily convinced that it was a miscarriage, that it might have been an illegal abortion. And so they used her Google search - they acquired her Google search information. And this type of information is readily available as well. And so I think the - we talk here about the end-around of users' Fourth Amendment protections. This is an example of that, right? 

Ben Yelin: Yeah. So obviously, the primary concern is law enforcement getting hold of this information through some type of lawful subpoena. Even if it's not a warrant, you can usually obtain this information without a warrant. But law enforcement getting its hands on it - that's our primary concern. 

Dave Bittner: Yeah. 

Ben Yelin: There are some secondary concerns that I think are underappreciated. One is several states, starting with Texas, have these so-called bounty hunter laws, meaning you can sue in court against somebody who either had an abortion or aided and abetted an abortion. And any person can sue under that statute. 

Dave Bittner: Yeah. 

Ben Yelin: So if a group - an individual or a group of bounty hunters wanted to purchase information - some type of, say, geofence data on who was in a particular area that has an abortion clinic at a particular time - it's very possible for them to purchase it. There's no oversight, since they are not any type of government entity purchasing this data. And they could make the data available to everybody who's interested in being a abortion bounty hunter in Texas. So that's certainly one concern. And then targeting women themselves - purchasing this data to dox people, to attack people online, even to find out where individuals live, go to their property, intimidate them. I think that there's certainly a risk there. 

Ben Yelin: So it's not just limited to law enforcement getting its hands on the data. Again, most of the data is anonymized. We've talked about how it can be easily deanonymized. But even if the government never gets its hands on it, there are just these attendant risks of having so much data out there on this relatively unregulated marketplace. And I think that's certainly raising the concern of both some of the pro-choice activist groups and people who just care generally about electronic privacy. 

Dave Bittner: Can I ask a dumb question or one that reveals my own ignorance on the topic? Which is... 

Ben Yelin: Yes. I love dumb questions. Sometimes they're easy to answer. 

Dave Bittner: (Laughter) Well, I just find myself a bit gobsmacked at the notion that there may be attempts to restrict interstate travel. I mean, has that - like, since slavery, has that been a thing? 

Ben Yelin: So because of what's called the Privileges and Immunities Clause in the 14th Amendment, how that's been interpreted, including in a landmark case in the '90s, there is a generally recognized constitutional right to travel from state to state. In his concurring opinion in the Dobbs case, Justice Kavanaugh, who was part of the five-justice majority, said that he sees no reason to challenge that generalized right to travel as it applies to people seeking abortions. But that was what we call dicta. It wasn't binding. Nobody else joined his concurrence, and he could always change his mind if there's another case that presents itself that relates to somebody traveling across state lines. I think the concern is states themselves being emboldened by this series of anti-abortion judicial decisions... 

Dave Bittner: Right. 

Ben Yelin: ...Are going to try and push the envelope. So they could try to ban interstate travel for this particular purpose. They could do things as drastic as setting up checkpoints at - across major interstates to make sure people aren't traveling for the wrong reasons. 

Dave Bittner: Would that hold up? 

Ben Yelin: At this point, I would say no, simply because of what Justice Kavanaugh said in his concurring opinion. If you combine that with the three liberals on the court and Chief Justice Roberts, who didn't want Roe v. Wade to be overturned in the Dobbs decision, that gives you a pretty confident five-justice majority that would preserve this constitutional right to travel. Majorities are nimble. Justice Kavanaugh himself could change his mind. We could have a new president in 2025. One of the liberal justices could drop dead one day, and we get a replacement that would feel differently. And then that right to interstate travel is at risk. I mean, the law is only as strong as the justices willing to uphold it. And I think it remains to be seen how this question of interstate travel to obtain abortions is going to play out in the long run. 

Dave Bittner: Yeah. Again, I mean, am I off base here just thinking that this is a wacky thing to even be considering? 

Ben Yelin: No, you're not off base. I mean, I don't think many people thought we would get to this point in our lifetimes. But we - something that seemed off base 10 years ago, which was a wholesale overturning of Roe v. Wade - that did happen. 

Dave Bittner: Right. 

Ben Yelin: It was overturned lock, stock and barrel. So I think we have to at least be on guard about some of these other threats. People have focused on Justice Thomas's concurrence when he mentioned some of these other rights that could be in jeopardy - the right to marriage equality, the right to contraceptives. So I think these are things we have to be on guard for. And the right to interstate travel, I think is certainly one of them, even though it doesn't appear at the moment that it has five justices willing to change jurisprudence on that. 

Dave Bittner: Yeah. All right. Well, it's fascinating and, as they say, interesting times. 

Ben Yelin: Sure is. 

Dave Bittner: OK. We will have a link to that story from Gizmodo. Again, we would love to hear from you. If you have a story you'd like us to consider for the show, you can email us. It's caveat@thecyberwire.com. 

Dave Bittner: Ben, I recently had the pleasure of speaking with Matt Voda. He is the CEO of a company called OptiMine. Matt is a consumer privacy advocate and also an expert in marketing. And so our conversation centers on how some of these laws that are potentially coming through, specifically a Federal Privacy Act, may impact the advertising tech industry and ultimately consumers. Here's my conversation with Matt Voda. 

Matt Voda: It's one of only a handful of issues that has bipartisan support. There was a Morning Consult survey done in 2021 that indicated that about 86% of Democrats and 81% of Republicans said Congress should make privacy a top priority. So, you know, from a regulatory standpoint, there's good alignment across the parties. But despite that, we're still in this situation where there's relatively little movement on a specific regulation. There have been many proposals, many bipartisan proposals made, but really nothing that's made any traction of late. And, you know, there are several reasons for that. But, you know, the current state today is that, you know, we've got states filling the vacuum of, you know, lack of federal action on consumer privacy - very little movement happening at a national level. 

Dave Bittner: And where do we stand with the states? I mean, I think California is generally considered to be leading the way with these things. Yes? 

Matt Voda: Absolutely. California was the first with the California Consumer Privacy Act, CCPA, and that was amended with something called CPRA, which strengthened the original regulation and also created an enforcement function within the state of California. But we have four other states that have rolled out similar privacy regulations. We have Colorado, Connecticut, Virginia and Utah. And then there are about eight additional states that have active bills in their regulatory pipelines, really covering every corner of the U.S. So the states are moving. There's also bipartisan support at the state level, which is why we see this patchwork quilt kind of emerging state by state. You know, consumers care about it. We've got good alignment from a regulatory standpoint across parties. But again, very little action at the federal level. 

Dave Bittner: Now, I know one of your areas of expertise is marketing. How is all this affecting brands and their ability to do the things they want to do in terms of customer engagement? 

Matt Voda: It's becoming more difficult. And, you know, brands are impacted in a lot of different ways when a new privacy regulation comes into play. Many brands are using PII - or personally identifiable information - for advertising targeting, for personalization on their digital properties. And also, brands are using identity for advertising measurement as well for marketing attribution. And so as each state comes online with their own form of privacy regulation and the right for consumers to be forgotten or to have their data not be sold or traded, those introduce gaps and missing data for the brands in performing these functions. And so as more and more people opt out, it becomes harder for brands to conduct these types of activities. 

Dave Bittner: Are there brands out there who are being successful without these types of tools? I mean, I suppose, you know, as an old-timer, I could say that, you know, there was a time before they had these available. And it seemed like the big brands did just fine. Is this a matter of, they've become accustomed to these and don't want to let them go? 

Matt Voda: (Laughter) Yeah. You know, what's old is new again. Many brands, from a measurement perspective, used a technique called marketing mix modeling. And that has been around for a good 40 or 50 years. And it was developed to help large consumer brands measure the impact of very large TV campaign and the incremental effects of those TV ads on sales of their products. And with the advance of AI and machine learning and high-speed computing, there has been a renaissance in that space with more modern techniques. And as brands look for more privacy forward ways or safe, future-proof options, they're embracing some more traditional techniques that have gotten a new look. 

Dave Bittner: How much of what we're seeing in terms of, you know, this not being able to make its way through Congress - is that a result of some of the big tech companies and their own lobbying, you know, the Googles of the world, the Facebooks of the world, who a large part of their income is dependent on this? 

Matt Voda: Yeah, for sure. I think that, you know, Facebook - the entire business model of Facebook is predicated on consumer tracking and collecting an enormous amount of information about the consumers that use their services. And to some degree, I think that their lobbying has an effect. Although, I think the big walled gardens are probably on the wrong side of this from a regulation standpoint. And one of the reasons why there has been, you know, slowing momentum on the privacy front is that regulators are taking aim at Meta and others from an antitrust standpoint. And so those efforts have taken priority over consumer data privacy regulations. So ironically, you know, they've kind of moved up to the front of the line from a regulatory standpoint. But it's really been focused on antitrust. 

Dave Bittner: That's interesting. You know, I think, when we were on the verge of having GDPR come into effect, there was a thought that perhaps that would become the global lowest common denominator, you know, that it would be easiest for companies who are doing global business to adhere to that. And then, I think we saw a similar thing with CCPA, where perhaps that could become the common denominator. Has that happened? Are the brands out there - the marketers, those companies - are they trying to weave together this patchwork and come up with something that kind of fits everywhere? 

Matt Voda: Yeah, I think so. You know, you can trace a pretty clear line from GDPR all the way through to CCPA. And even other states that have passed their own privacy regulations, there's a great degree of overlap in approach. And I think it's smart for brands who are trying to get out ahead of this to try to take a common denominator approach in terms of their own compliance and in terms of their own marketing operations. There's a whole chain of custody issue here from a marketing technology standpoint that most brands have to think about. And it relates to something as simple as a consumer asking a brand to wipe out their data or to stop tracking them. The brand has to prove that they've honored that request, and that's not a simple act. It typically will touch many different source systems, even third-party vendors and outside applications that may have a slice of the view, that consumer. 

Matt Voda: And so there's a lot of work in terms of complying to this. And brands, I think, would prefer to take a singular approach that assures compliance across, you know, the variety of regulations that are emerging state by state. And that's part of the problem with the lack of federal regulation. We have, you know, state-by-state regs that are all slightly different, and that creates a lot of complexity for brands who do want to comply. And, you know, you've got even small differences that create these issues for compliance teams at brands that are going to get worse, you know, as more and more states take matters into their own hands, you know, lacking federal action. 

Dave Bittner: Where do you suppose we're headed? You know, for the organizations that want to try to come out - be on the other side of this with some sort of competitive advantage, what sort of guidance are you providing? 

Matt Voda: Well, we do believe that this is going to get more complicated. I'm of the belief that there won't be any near-term federal action. Part of that is due to a disagreement about the role the FTC would play in enforcement. There's disagreement, you know, despite the broader agreement around the need for consumer privacy, that the parties aren't aligned in terms of what the FTC will do or not do. And there's also disagreement across the parties in terms of private right of action. And we see some of that, you know, state by state. California has a limited private right of action. Colorado, Connecticut, Virginia do not. And those are complicating factors, and they create complex issues for brands who want to comply as well. Smart brands and, typically, larger brands that probably already have a compliance function are well suited - have the resources to tackle this, will get out ahead of this because - not only as a reputational risk, but now some of these state regulations have real financial teeth. 

Matt Voda: So smart, you know, planful brands are already moving out ahead of this, and I think that they'll be monitoring the state-by-state activities and building in processes and teams that will work with the marketing and CRM groups within the brands to keep the safeguards in place. There may also, interestingly, be an emerging technology market opportunity for compliance tools to make this easier for brands. It's kind of a white space in the market right now. And brands need a singular solution. You know, there's a vacuum there in terms of technical capabilities as well. 

Matt Voda: But as I said, there are larger brands who have regulatory functions, who have compliance functions already in place, and they'll tend to do better because they have the wherewithal to get out ahead of this. For brands that don't, I think there's a lesson to be learned, that there's investment that's needed. And it isn't just, you know, a privacy officer that deals with privacy policies; there's real technology implications here as well in terms of how data is handled. As I said, the chain-of-custody questions have come into play that prove compliance, you know, back to regulators. 

Dave Bittner: Ben, what do you think here? 

Ben Yelin: Yeah. I mean, I think tech companies have gotten somewhat comfortable in the past couple of years. They've learned how to comply with GDPR and then certain state level laws relating to data privacy, specifically CCPA. 

Dave Bittner: Right. 

Ben Yelin: So I think they're kind of in a comfort zone there. That could change overnight if a federal data privacy law is enacted. And so brands are going to have to reconsider how they do advertising, depending on how legislation is written. I think the open question, of course, is can a federal data privacy law actually pass Congress? 

Dave Bittner: Yeah. 

Ben Yelin: And what exactly would it look like? How watered down would it be? How broad would its application be? And would it preempt stronger state regulations that currently exist to protect data privacy? And I just think we don't know the answer to that question. So I - it's another one of those - let's wait and see. I think companies are going to be watching with the same interest we are to see what - how many new compliance officers they need to hire to sort through... 

Dave Bittner: (Laughter) That's right. Right. 

Ben Yelin: ...Whatever mess Congress decides to enact. 

Dave Bittner: That's right. All right. Well, again, our thanks to Matt Voda from OptiMine for joining us. We do appreciate him taking the time. 

Dave Bittner: That is our show. We want to thank all of you for listening. The "Caveat" podcast is proudly produced in Maryland at the startup studios of DataTribe, where they're co-building the next generation of cybersecurity teams and technologies. Our senior producer is Jennifer Eiben. Our executive editor is Peter Kilpe. I'm Dave Bittner. 

Ben Yelin: And I'm Ben Yelin. 

Dave Bittner: Thanks for listening.