A First Look at the Banning Surveillance Advertising Act of 2022

On January 18, 2022, House representatives Anna G. Eshoo (D-CA) and Jan Schakowsky (D-IL), along with Senator Cory Booker (D-NJ), introduced the “Banning Surveillance Advertising Act” (“BSAA”), available here. Representative Eshoo’s press release describes the bill as “legislation that prohibits advertising networks and facilitators from using personal data to target advertisements, with the exception of broad location targeting to a recognized place, such as a municipality”.

Overview

Key provisions of the BSAA have been summarized below under separate headings.

General Terms:

•       Prohibits the dissemination of advertisements directed at a specific individual, connected device, or group of individuals or connected devices, based on personal information pertaining to those individuals or devices (referenced in this article as “targeted dissemination”);
•       Both common carriers and non-profit organizations are subject to the restrictions of the BSAA for targeted dissemination;
•       Creates a private right of action to individuals for violations of the BSAA, with awards of no less than $100 and no greater than $1,000 per violation in cases of negligent violation, and awards of not less than $500 and no greater than $5,000 per reckless, knowing, willful, or intentional violation, as well as other costs (including reasonable attorney’s fees and litigation costs);
•       Explicitly negates the enforceability of any pre-dispute arbitration agreements regarding targeted dissemination; and
•       Confirms that restrictions apply not only to “advertisers” (the party paying for the advertising activities) and “advertising facilitators” (the party undertaking the advertising activities), but to their respective subsidiaries, corporate affiliates, and other related parties.

Restrictions on “Advertisers”:

•       Prohibits the dissemination of advertisements where the dissemination is based on personal information that the advertiser has purchased or otherwise obtained from any party other than the subject of that personal information; and
•       Prohibits the dissemination of advertisements where the dissemination is based on personal information that identifies the subject as a member of a protected class, or that “is known or should be reasonably known” by the advertiser as information that serves as a “reasonable proxy” for identifying the subject as a member of a protected class.

Notably, because the two restrictions are established separately (at subsections (b)(1) and (b)(2) of Section 2 of the BSAA, respectively), an advertiser is not permitted to target its dissemination of advertisements based on personal information that identifies (or should be reasonably known to identify) the subject as a member of a protected class. This holds true even if the advertiser collects that personal information directly from the subject.

Restrictions on Advertising Facilitators:

•       Prohibits advertising facilitators from providing a list of individuals or connected devices, an individual’s contact information, or any unique identifier or other personal information that can be used to identify an individual or a connected device, to an advertiser or a related party/affiliate/subsidiary for targeted dissemination.

Note, however, that the BSAA exempts advertising facilitators for activities that might otherwise be deemed targeted dissemination, so long as the advertising facilitator obtains a written attestation that the advertiser is not in violation of the BSAA by providing that personal information for those activities. Notably, the advertising facilitator is not held to a good-faith standard in relying on the attestation and the text of the BSAA does not provide penalties for any attestation that is later proven to be untrue.

Personal Information under the BSAA

Under the BSAA, the term “personal information”—as defined in Section 4 of the BSAA at subparagraph 13—means “data linked or reasonably linkable to an individual or connected device, including—(A) data inferred or derived about the individual or connected device from other collected data, if such data is still linked or reasonably linkable to the individual or connected device; (B) contents of communications; (C) internet browsing history and online activity; and (D) a unique identifier used for the purposes of targeting the dissemination of an advertisement.”

This treatment of personal information differs significantly from the treatment of ‘personal information’ and ‘personal data’ currently used in state-level privacy and security breach laws. For example, both the Colorado Privacy Act and the California Privacy Rights Act, which take effect in 2023, exempt publicly available information from the definition of ‘personal information’; the BSAA does not.

Practices and Persons Exempt from the BSAA

Certain categories of persons and common advertising practices also seem likely to be largely safe from the present iteration of the BSAA. A few of the prominent exemptions are discussed below:

•       Mailed advertisements: The BSAA’s definition of “dissemination” excludes advertisements that are not made electronically or through communication by wire or radio. As such, advertisers that only send advertisements by physical mail are unlikely to come under scrutiny under the BSAA.
•       Contextual advertisements: The BSAA permits advertising facilitators to disseminate “contextual advertisements”—specifically, advertisements disseminated based on (i) information that an individual is viewing, (ii) information for which an individual searched, or (iii) information with which an individual “is otherwise engaging”, as long as the advertisement is disseminated in “close proximity” to such information.

o   Note: The BSAA still prohibits targeted dissemination using any information that is collected in connection with such contextual advertisements.

•       Advertisements targeted to specific regional categories: Dissemination of advertisements based on a recognized place that is associated with an individual, connected device, or group of individuals or connected devices will not qualify as ‘targeted dissemination’.

o   Note: The BSAA’s definition of ‘recognized place’ is restricted to the following regional categories: states; Indian lands; counties, municipalities, cities, towns, townships, villages, boroughs, or similar units of general government (whether incorporated according to state law or as defined in the most recent glossary of the Bureau of the Census); census designated places; designated media markets (as defined by Nielsen Media Research); and congressional districts.

o   The BSAA specifically excludes targeted advertisements based on zip codes and all regional categories not named on the list above.

•       Data brokerage: The BSAA only governs advertising practices where (i) information is provided by an advertiser to an advertising facilitator, (ii) the advertising facilitator disseminates that information to an individual, connected device, or group of individuals or connected devices, and (iii) the advertising facilitator is compensated for its services with money or some other thing(s) of value. While this does not strictly prohibit the sale or licensing of personal information, it curbs a significant number of the current uses for personal information within the adtech industry.
•       Practices undertaken by natural persons: A natural person who is not otherwise engaging in a commercial activity that is more than de minimis will not be deemed an advertiser or an advertising facilitator.

o   Note: This would not necessarily prevent the natural person from qualifying as a ‘third party’ under the BSAA if the natural person is (a) an executive officer or director for the relevant advertiser or advertisement facilitator, (b) a shareholder who owns more than five percent of any class of voting securities in the relevant advertiser or advertisement facilitator, or (c) an immediate family member of a person who qualifies as (a) or (b).

Open Questions for the BSAA

The present draft of the BSAA leaves a few significant questions open for purposes of compliance. These include:

1.     Whether a company with an internal marketing team, which creates advertisements for the company and directs them to specific individuals, connected devices, or groups of individuals or connected devices, could be deemed to be in violation of the BSAA as both an advertiser and an advertising facilitator.
2.     The type(s) of information that would constitute a ‘reasonable proxy’ for identifying the subject as a member of a protected class.
3.     Whether an advertisement related to information that an individual is viewing, information for which an individual searched, or information with which an individual is otherwise engaging must be placed in physically close proximity to that information in order to qualify as a “contextual advertisement”, or whether an advertisement which follows shortly after that information (e.g. temporally close proximity) would also qualify as a contextual advertisement.

In light of its potential effect, what ultimately becomes of the BSAA should be of great interest to companies throughout a range of industries through upcoming months.