← The Monopoly Report
Loading summary
Transcript93 lines
- [00:00]
A
I'll be there. Will you?
- [00:02]
B
This is Ari and I'm talking about our upcoming Market Live conference in New York on March 10th and 11th. We've got an amazing two day agenda filled with top tier speakers and insights you can use right away. Some of the speakers we've announced already include Sophia Koluchi, the CMO at Molson Coors Lance Armstrong, the General Partner at Next Ventures Neil Vogel, the CEO of People Joanna o', Connell, the Chief Intelligence Officer at Omnicom Media Group Jeremiah Olang, a General Partner of Blitzscaling Ventures. Of course we'll have the Startup Showcase like we always do. I'll be giving my keynote and we'll have special guests. For a live podcast you should definitely look at buying a ticket. It's@marketlive.com and we have special arrangements for qualified brands, agencies and publishers. So go to marketlive.com this podcast is brought to you by Audiohook, the leading independent audio dsp. Audiohook has direct publisher integrations into all major podcast and streaming radio platforms, providing 40% more inventory than what could be accessed in omnichannel DSPs. What's more, audiobook has full transcripts on more than 90% of all podcast inventory, enabling advanced contextual targeting and brand suitability. Audio Hook is so confident that in addition to CPM buys, they offer the industry's only pay for performance option, where brands can scale audio and podcasting with peace of mind knowing they are only paying for outcomes. Visit audiohook.com to learn more. That's audiohook.com.
- [01:41]
A
Welcome to the Monopoly Report the Monopoly Report is dedicated to chronicling and analyzing the impact of antitrust and other regulations on the global advertising economy. I'm Alan Chappell. I'm a privacy and regulatory attorney who has worked with hundreds of digital media and ad tech companies over the years. I also publish a monthly regulatory outlook for digital media worldwide called the Chappelle Regulatory Insider. You can find a link to a sample copy of the Chappelle Regulatory Insider in the show Notes. I also write the biweekly Monopoly Report newsletter, which focuses on regulatory in the ad space, and you can find that@monopoly-report.com this week my guest is David Leduc, the VP of Public Policy for the Network Advertising Initiative. The NAI is a trade association that was formed 25 years ago to create privacy standards for the digital advertising community. David has been with the NAI for seven plus years and has previously worked on public policy and legislative issues in the software industry. I consider David a friend and one of the most knowledgeable people out there when it comes to privacy and regulation and in the ad space. I should also disclose that I've been on the board of the NAI since it was formed and am currently the board chair. I should also put it out there that David Cohen at the iab, Tony Katzer at the Tech Lab and the folks at Pre BID and the Digital Advertising alliance have a standing invite to join me on pod. I love having David leduc on because he is as on top of the regulatory issues impacting the third party adtech community as just about anyone. David's also a great guest to have on at the beginning of the year as he can speak to the 2026 legislative and regulatory priorities for the ad space. I have one additional show note. David refers to Ashkan a few times in our discussion. I think many of my listeners know, but just in case David's referring to Ashkan Sultani who is a well known privacy technologist and and was the inaugural Executive Director of the California Privacy Protection Agency. Note to self, I've got to get Ashkan on the POD too, but today it's David leduc, so let's get to it. Hey David, thanks for coming on the pod. How are you?
- [04:00]
C
I'm good, I'm good. Thanks for having me. Alan. I'm excited to be on your pod and as a repeat guest because I was on, I think it was around last year you had me on and I'm a huge fan.
- [04:09]
A
You are part of a very small and distinguished group of people which includes Megan Gray and Peter Craddock. I think that's it. Who are two time guests of the pod. So congratulations.
- [04:21]
C
Wow, thanks.
- [04:22]
A
People must have really dug your first one for sure. So where are we finding you today?
- [04:28]
C
Finding me, well, working from home today in Alexandria, but I spend, you know, half my time in D.C. doing a lot of policy work on the Hill lately as a VP for Policy at the nai, increasingly spending time on the Hill. There's a lot going on at the federal level in terms of tech policy, privacy, data protection.
- [04:47]
A
So I think many of my listeners are at least familiar with the network advertising initiative. But I also think the NAI is in a bit of a transition period. So as of today, what is the NAI and what's your role?
- [05:00]
C
Well, the NAI we've been around for 25 years. A lot of people probably don't realize that how long we've been around, that's quite a while. Quarter century. So we are today as we have been first and foremost a self regulatory organization, association for ad tech companies. And so that's our key focus, our sweet spot. We're in a transitionary period as you mentioned, we maintained a code of conduct as you know, for most of our existence and a couple years ago we moved away from that and we developed a set of principles and, and the long and short of where we're at today and how we've changed is that we are focused on helping companies comply with myriad state and federal laws and regulations rather than writing our own rules of the road as industry did for so long when most of data collection and use for advertising was unregulated. So now we're heavily regulated as you know and it's in a really evolving environment. And what we heard from companies was, you know, what we need help with is all these different laws, understanding them and trying to develop consistent compliance strategies. So that's what we do and it's a really exciting time. It's been well received by companies and by regulators. The folks we talk to on that side seem to understand too and get it and appreciate our role much more. So I think than any old fashioned association or I should say self reg. Org that would say like oh, we don't need any more regulations, like we got this, you know, I don't think there's any sense of like the we got this on our own. We don't need you guys. That's the transition we've made is you know, you guys are the backstop. You've got all these new laws and regs, they're complex and our industry is complex and we're going to help you guys understand that regulators and we're going to help you companies understand and comply as best we can.
- [06:49]
A
So we can talk a little bit more in a bit about the delta between state law and self regulatory groups. But for now what is your core role within the nai?
- [06:59]
C
Well, my core role is as the head of policy is really complementary to that and it puts us in, in a different position slightly and it puts me in a different position I think and hope that it gives more credibility coming from an organization that I feel is more progressive on the side of many policymakers in terms of trying to get companies to be privacy forward, privacy first. That's been our role all along, that remains our role today. So it puts us in a different place. I spend a lot of time, more time than probably most folks in similar roles dealing with engaging with regulators at both the federal and state level helping them explain, explain our industry how it works, highlighting best practices that we're promoting and things like that. So it's a little bit more detailed. You know, I'm not a conventional, you know, I don't spend a lot of time doing conventional lobbying. It's more educational work and kind of deep in the weeds in terms of how, how we operate, educational stuff. So I think it's really helpful for policymakers. And the other part of it is I spend a lot of time talking with our members in a time when policies, the legal framework is so rapidly evolving and so complex, members get a lot of value out of the close attention that we pay to these new laws, what new proposals are and to gauge for their future planning. Where's the ball going? What can we expect the laws to look like tomorrow? So that's really important too. That's a big part of what we do for industry, is to help them understand the environment, not just today, but the way it's evolving because it's constantly evolving, as you know. And so it's really exciting and fast paced. I love it.
- [08:46]
A
So regular listeners to the podcast know that I've had a bunch of different legislators and privacy advocates on as guests over the past few months. And one of the regular themes I've heard from advocates and legislators, they focused a bunch on industry lobbyists. And the narrative is, is that there's a direct link between the lobbyists and everything that is wrong with the legislative process. So I appreciate that you don't view yourself as a, I'm going to use air quotes here like a traditional lobbyists, but I wanted to have you on and, and just ask directly like, what's, what's your response as somebody who's, you know, closer to that world, like, and I don't want to say like the, the, the, the tongue in cheek, like, why are you hurting America? But that seems to be the narrative that I've heard a bunch from, you know, from the advocacy side. And I would really love it if you would sort of share what I would imagine is the other side of the coin there.
- [09:42]
C
Yeah, yeah, that's a, that's an interesting one. And I'm glad you didn't, you know, didn't, didn't accuse me of hurting America because I was going to say, well, that's messed up. No. So we all hurt America in our own unique ways and hopefully we help America more in our own unique ways than we heard it. I appreciate the question and it's interesting. It's a little bit different than something I've engaged on and could spend a lot of time talking about. But I think I understand concern among many about lobbyists, about political influence. I mean, that's a thing. It's not just in our industry, it's a thing. Right. I mean, I think what is underappreciated is the valuable role of interest groups and the role that they play in terms of the kind of stuff that I do. I think most people, when they think of lobbyists or interest groups, they think of really large corporations that are spending excessive dollars and paying politicians. And so I think, and that's not to say that doesn't go on, that's not us. So I get that. But I think the role that we play is a lot more valuable and it's the role that I've always been in throughout my career, really more of a kind of issue oriented, specific, deep in the weeds, policy input as opposed to kind of political influence. But I will, I will recognize because you ra. And you clearly raise this because it's something that you hear a lot and I appreciate that. I think it reflects the reality that big companies probably do have a disproportionate sway. Right? I mean, and in our industry, I mean you've got big companies across the whole swath of US industry, but in our industry you've got the kind of big tech. And these are enormous companies that have had outside influence. They continue to. I mean, they've got more dollars, they've got more people. And frankly, I think that reflects pretty significantly the public policies that we have today in America. In fact, if you look at the state laws across 19 states, at least if you're just looking at the big comprehensive ones, those are laws that substantially are not aimed at the biggest companies. And you hear politicians on both sides, the left and the right, they agree on almost nothing these days other than these companies, these big ones being the biggest concern yet their laws address selling and sharing and practices that these companies don't.
- [12:05]
A
Name one big tech company who is a California registered data broker.
- [12:11]
C
Yeah, I don't know. I don't. Yeah, I don't know. There probably are none.
- [12:14]
A
Right? I don't think so. And that's fine. But that does speak to what the rule set in a lot of the state laws is trying to get at. And it isn't necessarily big tech.
- [12:28]
C
That's right. It's changing a little bit maybe today, I think with this heavy focus we're seeing and it's not brand new, but it's picking up and it's shifting the focus on kids data and teens. And I would say now more than ever, you know, that those discussions are evolving, and I think in a good way, to the extent that they're focused on what I view as the biggest concern we have in America, which is the engagement of youth in online media. And I'm not blaming anyone or pointing fingers at these platforms or anything, but those of us that have young kids and kids that have grown up with tech, it's a huge challenge. And so I appreciate that.
- [13:09]
A
And then the only solution appears to be some flavor of age verification, which is completely dead in the water on First Amendment grounds. And so I'm sort of curious, by the way, to see how age verification works in places like Australia, just from a curiosity standpoint, because I think that's going to have its own set of challenges anyway. But I don't know the answer to how you protect kids without doing something a little bit different. And maybe it's better monitoring. You know, I know some of the social platforms are, have, have gotten a lot better, at least flagging problematic behaviors. But all due respect, you got to want to flag that stuff. And I'm not sure that's always the case.
- [13:53]
C
That's right. That's right. And we could, we could go on, if you want, on this topic.
- [13:57]
A
Well, you know, I just want, I just have one more observation, though, and, and I'm sort of surprised you didn't say it. The perspective coming from the advocates and sometimes the legislators and even sometimes the regulators is one where they say proudly, we are representing consumers. We are here to protect consumers. And, and by the way, that may sort of be true, but that belies the reality that different consumers have different opinions on a lot of these types of issues. And so anybody that says they represent consumers, I say, well, which one? Because there's, you know, going back 50 years, from some of the early privacy studies, you know, there's a percentage of people really care about this stuff. There's a percentage of people who will, you know, sell their mother's Social Security number for, you know, 25 cents off a Big Mac. And then there's a whole big middle of varying interests. And so I don't really have a question there. I'm just, I'm on my soapbox here.
- [14:54]
C
No, it's a great point. And I, and I think I touched on this last time I was on, you know, and I'm glad you raised it, because I think there's a fundamental difference of opinion. And I'm not, I, I don't consider it to be opinion, but I think a lot of those people that are protecting consumers, we appreciate what they're doing and I agree with their objectives.
- [15:14]
A
But I think this was not meant to disparage.
- [15:16]
C
Yeah, no, I know you don't. But I, I, I think, I just think there's just fundamental disagreement in terms of the recognition of the value proposition and, and the role that that data driven advertising plays. You know, and I think, I just think there are some out there who just, they've gotten so frustrated with, you know, not being able to rein in the bad actors that they're willing to just say screw it, you know, and that's what's driving some of these policies that added. And you know, I don't begrudge them for it because it's frustrating. I understand their frustration. We share their frustration as a self regular trying to get rid of the bad actors, trying to promote the value in valuable uses. And you know, so I get that, you know, there's a disconnect, there's, yeah.
- [15:55]
A
And not to get overly political, but I think we've reached a point on so many issues where it's sort of like, well, this is horribly and fundamentally broken, so let's just blow up the whole darn thing. And that has consequences too.
- [16:08]
C
Absolutely.
- [16:09]
A
So who are your primary stakeholders that you engage with on these types of topics? I mean, is it legislators, the ftc, state attorneys general? And then what are their, you know, if you had to pick three to five primary concerns about their, the ad space.
- [16:27]
C
Well, as I mentioned earlier, it's, it's both legislators and regulators. But I would say as I mentioned earlier, more, more regulators in terms of the kind of deep engagement, I mean, also legislators. But, but, and you may know this a little bit since you talk to so many of these policymakers lately, the regulators are smart. You know, they're really smart and frankly most of them are really quite pragmatic and they're a great audience, they're a great set of people to work with. The legislators just don't know as much. And that's not a criticism. It's not like, oh well, they're dumb. That's not the case at all. They just have a lot to focus on. This is complex stuff. They don't have the ability to engage as deeply. They don't know as much as the regulators know. They don't know as much as we know. So that's again, that's where my role is really important in being able to explain know the role of our industry, how it works, what is data driven Advertising, you know, why, why do you want to keep it? You know, why does it benefit competition? Why does it benefit consumers? So I spend my time, you know, providing those messages to legislators who don't understand that and regulators. It's more of the engaging on the ins and outs of, you know, how we can do, how data flows can work and how we can help companies manage data responsibly. So there are kind of two different types of conversations with two different types of audiences.
- [17:48]
A
And just to echo your point, the Cal privacy folks have been really pragmatic and to their credit because one of the things that I've always thought would be the thing that will force a functioning Congress and we'll get one of those functioning congresses one of these days. But a functioning Congress would look at the states and if they're operating in a way that is pragmatic and operating in a way that is in good faith trying to engage with the business community to try to root out bad actors and to try to push the rest of the marketplace towards better practices, the chances of having federal preemption, I think goes down exponentially. So how do you convey the technical complexities of ad tech to, you know, what is admittedly not always technical? Policymakers or do you think the regulators at this point are, have, have caught up and, and do you feel like they're, they're kind of on the same level with you?
- [18:45]
C
I think the regulators, as I said, are definitely further along. They have individuals who spend day in and day out following, understanding data flows and business practices. So as I said, it's different messages for different audiences, different conversations entirely. So in terms of the complexities, I think I find myself trying to spend a lot of time talking about the, I mean the role of our, of our industry. And as you know, you know, the NAI's members are third party ad tech companies. I mean some of our companies, you know, are also in the first party business. But, but by and large, for the most part and our focus is on these companies that are managing third party data. And I think it's one of the most misunderstood industries in the world in terms of like, and when I say that, I mean people just, they don't know who the companies are. They don't really know a lot of what they're doing and how it works. So being able to explain that and when, when, when I can explain that and take the time and go through and kind of highlight how the alternative to the ability to utilize third party data, the alternative is even more dominance by, by you know, large tech companies who have tons and tons of data, you know, being able to explain that the small blogger or a small advertiser, how they can benefit from utilizing data that they don't have, you know, and how, how they can compete by getting data, leveraging data that's gathered more broadly across the, the web or across different ecosystems from third party partners. It makes tons of sense. And people are like, gee, yeah, that's right, I get that, that makes sense. But otherwise for, for policymakers that don't know anything, they're just like, oh God, these freaking data brokers, you know, like they just gobble up data and then they sell it. And sure, there's bad actors out there, sure there's companies that are gobbling up data, I guess, and technically just selling it. And that's problematic. And to be fair, those companies are out there. But being able to explain the benefits and the role that third party companies have played for so long in helping so many businesses monetize customers, get new customers, it's just so fundamentally misunderstood. It's just not, there's not enough attention. I mean, I Wish There were 10 of me out there that we could do a lot better job.
- [21:01]
A
I've made that point a bunch as I'm out there speaking in industry conferences. And I'm saying big tech has hundreds, hundreds of people who are out there educating the regulatory or the enforcement communities and we, the third party ad tech company, have the nai and that's it. And that's unfortunate. Another thing that's sort of unfortunate just while we're talking about this, it's like the fact that the ad tech community has now been lumped in with the data broker community I think is problematic because for the most part the ad tech community is standing in the pseudonymous world and for the most part their data broker community is in the identifiable world. And so they're really serving different functions. And I'm not here to disparage the data brokers. I got a lot of friends who are data brokers, as they say, but I do think that they're different constituencies, they've got some similarities, but it's unfortunate that they've sort of been lumped into the same bucket.
- [22:02]
C
Yeah, I've got a handful of reactions on that and I hear you and I know that's a huge focus of yours and I think you're right to focus on identifiability on that, on that concept of data brokers and categorization. I had a really interesting conversation with Ashkan A couple of years ago, he came to one of our events and he not only came to our event to talk and was great, but he hung out all day and talked and I spent a ton of time.
- [22:31]
A
I was really happy with how much he engaged through the course of the day.
- [22:34]
C
Yeah. And one of the things he said, and they further kind of unpacked this, is that what they're trying to achieve with their drop their deletion request and opt out platform is really seeking to address three different types of companies. You could splice it even more. But as, as he identified it, you know, back. And this is the day when they're kind of just forming this. You know, you've got your people search data brokers that are, that are, I think, well known, more well known now for some of the nefarious activities and you know, under the microscope as well perhaps they should be. And then you've got the fraud, the big fraud data brokers, right. You know, those that have been around those, the traditional quote unquote data brokers that, you know, the FTC wrote a report about over 10 years ago. And then you've got ad tech. You know, there are other entities and there are some that kind of cross over those lines, but those are the three. And he recognized that and he very clearly said, you know, hey, you know, we recognize that we're seeking to address these three different types of businesses that have different types of data. I think it to some extent, you know, it's fair, I suppose, to consider some ad tech companies, data brokers, you know, but I think you're right to identify that as a, as a big challenge in a gray area. And it's not, it's not the way we think about ourselves and it's not the way we want to be characterized. And I wish we could draw more clear lines.
- [23:53]
A
So I've asked a bunch of other guests to describe their perfect privacy law. And I thought it might be fun to ask you the same question and compare notes. So in a perfect regulatory world, what would an effective and balanced framework for digital advertising privacy look like to you?
- [24:10]
C
Wow. Do you get many good responses to this?
- [24:14]
A
Well, it really runs the gamut. So I had no, I mean, I had my friend Travis from the CDT who you were kind enough to introduce to me to. So thank you for that. But you know, he was very focused on data minimization, which I actually agree with. I had Cory Doctorow on who said, no, no, no, no, data minimization is impossible to administer. And so therefore it just should be completely off the table and we should just prevent a whole bunch of data collection. And so I pick those two out sort of at random, but they're kind of an interesting bookends because I think you really does run the gamut. And that's one of the problems is, you know, if you get 10 people in a room and you have 10 different definitions of what a perfect privacy law looks like, it's difficult to build a consensus.
- [25:00]
C
Yeah, no, I'm giving you a hard time. I love the question. I just, it was kind of poking at the perfect thing, you know, that aspect. But, but I'll take a crack at it. You know, I'll take a crack at perfection.
- [25:10]
A
And then on a future episode, I can make fun of you too.
- [25:13]
C
Right, right. And I've heard some of the, you know, most, most of those pods, but so I mean, I can probably react to, to some of that. And, and frankly, I think there's, there's, there's substantial agreement and I can, I can kind of pull some of that in too, I think. I mean, I would start with the state frameworks and, and, and talk about what, what they all have in common that they do well. And, and in that regard I would say, you know, transparency and choice, we all agree those are necessary and you know, and I think yay, state laws for doing that, for improving that, but they're not dispositive, they don't solve all the problems. You know, so that's a key component. The next component that I think is really important and that the state laws get right is about in terms of, you know, requiring risk assessments and focusing on data governance. And you know, I think that's still in the early stages, but, but that, that's something that's brand new and under, under recognized in my opinion is the requiring companies to, to really focus on this and, and document their work.
- [26:14]
A
And also, I mean the ad tech community generally speaking has been pulled kicking and screaming into the data governance world over the last decade. Yes, yes, some of them are, some of them are better than others, but just as a general group and by the way, you are dealing mostly with the self selectors, the people who are legit trying to get to really address these types of issues. There is an entire other community out there. Most of them are very small and they're hoping to get to be the size where they can eventually be maybe contributing members of a group like the nai, but there's a lot of folks out there who now who are just kind of hiding, keeping their heads down and hoping nobody notices. And I think that is going to be a very difficult strategy going forward.
- [26:55]
C
Yes, exactly. And so you know that being in industry, where you sit, but I think most policymakers don't kind of realize that they're like, hey, you found an industry that didn't do this, this necessary practice, data governance, the NAI has been doing. NAI members have been focused on it. That's been our sweet spot. So that's kind of table stakes, I guess, right, Those two aspects. And I just want to highlight them because I think they're fully agreed upon, they're core to any measure. They're not enough. I wouldn't stop there and say that's what you need. Right. So those are the basic foundation. But I think the tough nut that everyone is trying to crack is preventing abusive practices. And you touched on this a little bit, and I'll give my take on it. I think it's similar to yours. That's also kind of what I've seen in terms of the evolution. So the goal is to get rid of these bad actors. And as you said, certain, I would say advocates or certain policymakers have gotten to this point where they've just said kind of like, fix this. We're willing to say, don't even collect the data or don't use the data for any other purposes. So that's kind of where we are today with some of these policies that we in industry think are just too egregious, too, too broad. So that's their solution. And it's important for us to understand why they're saying that. We look at Maryland style data minimization and we all look at that from the industry side and say, well, that's not practical at all. You know, that's not the way the world works. But we have to be mindful of why they're saying that. And so this third prong, the key prong of an effective law and the perfect law, I think if it's not, we all agree, I don't like to the term data minimization, just putting that aside. And we just kind of identified what that means today for the people that are really, really pushing it. A couple other approaches that are really that run parallel but are different but very similar that I would highlight and I think are very important. One I would say is.
- [29:00]
A
Well, you.
- [29:01]
C
Could look at the FTC's unfairness approach and we proposed something similar to that, gosh, I guess five years ago or so when working with Privacy for America Coalition, where we promoted in our model, an unreasonableness standard. And the other approach has been labeled a duties approach.
- [29:21]
A
Right.
- [29:21]
C
And Senator Schatz made that famous, I think, in Congress anyway, years back, promoting that. And I think none of those things gain traction. So I think there's a lot of intellectual agreement around being able to do that, being able to identify unreasonable practices or create a regulatory regime that can go after those unreasonable practices and let the other good stuff go on, because you've got that transparency and control foundation, you've got the data governance component. And now the tough nut to crack is this stopping the really bad stuff and the sneaky stuff. So it's got to be some version of a data minimization or an unfairness or an unreasonableness standard that's applied effectively and fairly and consistently. But as you know, companies don't like duties that are, that are overly broad and you know, that's a lawyer's nightmare. And companies are worried about and don't know. And I think regulators may even struggle with providing or enforcing around an ambiguous unfairness type of concept. So there we have it, and that's why we're having these conversations. But I think we're all in agreement with what we want. And if we could get it, if we could stop the bad uses of data and allow the good ones, I think there'd be, you know, I think everybody would be happy.
- [30:41]
A
So I, I think that the EU would have saved themselves a lot of heartache had they adopted something closer to a data minimization standard instead of a consent for anything and everything standard. However, in the US I start to get a little nervous around when, when people start throwing out the term data minimization because often that is becoming a, you know, you need to collect the minimal amount of data in the opinion of the reasonable consumer, and then you're done. Because, because once we're debating what a reasonable consumer thinks, I think we're, we're off to the races a little bit. I think there's, you know, because, because I, I don't think that my dad wants anybody collecting ad serving data. I'm not sure he really cares. But, but if, if asked, he'd say no, but I don't know that he would want to deal with the implications of that, which is like, well, okay, then how is, you know, in his case, foxnews.com, how are those guys going to monetize? And those are questions that I think are still constituencies that are just unwilling to engage in that type of a discussion.
- [31:51]
C
Unsurprisingly, I Mean, I agree with that. I think, yeah. I mean, that's fundamentally the crux of it.
- [31:59]
A
Well, okay, I'm going to shift gears here. We want to talk a little bit about California and the delete request and opt out platform, also known as the drop. It went live January 1st and seems to be getting a ton of attention within regulatory circles. And you know, incidentally, I'm hearing a bunch of noise from individual consumers, friends who live in California who aren't necessarily ad tech or data privacy geeks. It seems like they've made a lot of noise with this thing. And so I guess my question is, is the launch of the drop the biggest story in the digital media regulatory circles for 2026?
- [32:38]
C
I think it is. I think it really is, at least in our circles.
- [32:43]
A
For sure.
- [32:44]
C
It's a big deal. It's the first time this has ever been done. As you mentioned, we talked a little bit about it before. I mean, they're approaching this very thoroughly with a lot of resources and I think frankly they're doing a good job, I would say, and being very responsive. And they're thinking a lot about businesses and consumers. And we appreciate that.
- [33:04]
A
It's been live for two weeks and it hasn't blown up. So it's already beaten the Affordable Care act website. And so to their credit, because this stuff is not necessarily easy, we're going to have Tom Kemp on in a couple of weeks and I'm looking forward to, to really dig in deep about what he's planning on doing with the, with the drop and how he sees that playing out. But from your perspective, do you see other states building their own drop mechanisms?
- [33:33]
C
No, I don't see other states building their own drops. I think it's going to be hard enough for California and I think they're just way beyond other states. I mean, let's be honest. I mean, they've got a whole agency that's rivaling 10A's FTC. But what I do see, and this was highlighted on one of your pods last year, I guess when you had Senator Moroney on and he mentioned so I mean, it's been made clear to me that a number of other states are reaching out to California. Like, hey, can we talk about what you guys are doing? So I think that's definitely out there. There are conversations going on. I think the notion of individual states building individual drops sounds to be a bit of a nightmare to me. I've thought for a long time that this is the type of thing that starts in California. And will you Know, will spread and grow. And I think that's, you know, that makes sense frankly. You know, we don't want to have a bunch of different systems. It wouldn't work for anybody. It wouldn't work for consumers or those states or. So that's why I think this is so important to see how well it works. You know, I mean, as I highlighted earlier, there are different types of companies that the drop is intending to apply to and there are different types of data, different types of identifiers. And I think the CPPA is a great agency to be sussing this out, you know, and to be testing it and building it and, and we will see where it'll take a little while. It's not like, it's not like we're going to be able to look at year end and you can have me back next January and say like, well.
- [34:55]
A
How did that go?
- [34:56]
C
You know, it'll still be, it'll be ongoing for a while. But as they've said at the, at the. Which called Cal Privacy by the way, not, not CPPA as they've said, you know, they're gonna, they're gonna keep kind of tweaking it and evolving it and, and you know, working to adjust. That's something that we appreciate. And I would also highlight something else that we appreciate. The work that they are doing to authenticate users. That's really important. That's one of the biggest rubs we have with authorized agents and the whole notion of an authorized agent is that consumers just can't manage their own data. There are so many entities out there. The drop mitigates that. You know, the drop, the drop is, that's the whole point of it is to give. Consumers recognizes that and it doesn't, It's a much better approach in my opinion because it doesn't turn consumers into the hands of for profit companies and a whole smattering of them, you know, seeking to apply various different laws and you know, exercise your rights. Like that's. I think that whole regime is bananas.
- [35:57]
A
As you probably, I mean I kind of point the figure it's California who sort of unleashes unleashed this concept or at least codified it. So you've got a whole bunch of companies out there making requests. Some of them I think are legit, trying to do a good job and make the world a better place. And some of them are just more interested in getting their 15 or $20 a month from as many unsuspecting consumers as they can. So it will be interesting to see how that model Jibes with the drop because I would argue if the drop is as successful as the Cal Privacy team hopes that it is, query whether you need authorized agents anymore.
- [36:33]
C
Well, I don't think agents have any role in the drop realistically knowing about it. What I know from the briefings from Cal Privacy staff, it's designed to be a direct interface and then you need to authenticate yourself. And I think it makes tons of sense. Give consumers an ability to go to a place where they can do that, make sure it's authenticated. Because if businesses had to each authenticate the user on their own, it would be a disaster. Right. Like that would be so much friction and wouldn't work for consumers or businesses. So there's a lot of good about their approach and what they're doing. And I think we've been talking with them a lot and we're eager to see how this works out and to help make it work because we view this as essential and I think you know that about us. If we can't make choice work better as effectively as it can, that's why we're in this boat in my opinion. It's just that it's been hard as technology has evolved so quickly in our industry and choice and transparency hasn't always kept up with technology and practices. So anything that helps deliver that is actually a step forward.
- [37:41]
A
You raise a great question. So in what is it? January 2027 California law will require all of the browsers to support the global privacy control signal. At this point you almost have. You either have to download a plugin for Chrome or you have to use a certain browser like Brave or. And I think DuckDuckGo offers it. But how does that hard requirement change the ads space?
- [38:09]
C
Well, it's hard to say. I mean I think that requirement, not so much. I think how it's implemented a lot and how much uptake it gets a lot. You know those are the really forcing though, David.
- [38:22]
A
It's forcing Google and Apple, you know, the two biggest and I guess Microsoft as well, the three biggest companies in the world that is forcing them to take a position on global privacy control. So like just. It's hard to see that not having a huge impact.
- [38:39]
C
No, well, I agree. Yeah, I mean, I agree. I mean I guess it's already available in some places. So. No, yeah, I don't think we, we necessarily disagree on this. I mean I think. But my point being that, you know, I think it really just depends on how, how it's implemented and that's what we've said all along, you know, we, we certainly haven't been opposed to that. We're appreciative of, of the GPC and a system like that to the extent it can work. And we do think it can work and we've supported it and pro promoted. We have our own GPC extension that we put in the marketplace this year as you know. But you know, the point that we raised to policymakers and you know, in California specifically was, you know, okay, this is, you know, we can be okay with this, but you all just need to make sure that it's administered fairly. And I think that's what you're getting at. When you, you know, you mentioned it's a handful of big companies that control these browsers and you know, we need to make sure that it's implemented and even some smaller companies like you know, Mozilla and you know, so it's important that it's implemented in the right way.
- [39:34]
A
If you have a business sending search queries to a third party, it would seem to me that those search queries are just as likely as not to be deemed sales or shares of personal data. And as such, if you turn on the global privacy control by default and stop everybody else's sale or share while your sale or share continues, that seems impolite. And there's a couple of states who I think are starting to have launched some anti preferencing measures and hopefully that assuming that that continues to develop, I think this is a huge win for the ad space because right now the choice mechanisms are few far between reliant on a whole bunch of entities who are sometimes hostile to us. And if there's now a legally mandated choice mechanism out there, I actually think that's going to be helpful.
- [40:32]
C
Yeah, I mean, I think you're right. And you know, obviously you, you would know as someone who spent so much time in the do not track trenches, you know, ultimately all comes back, you know, a huge part of it is that on by default aspect, you know, and it ought not be on by default. And most of the laws, as you point out, say that, you know, so it's in there. So it's just a matter of getting it right, I think. And I don't know, I'm more optimist than pessimist on this.
- [40:56]
A
I.
- [40:58]
C
That doesn't mean I'm just sitting back and resting. We're making it a point to highlight this for policymakers across the states who have these laws that like, hey, this is a good thing, but let's just make sure it's done the right way, let's make sure it's implemented right.
- [41:11]
A
So I want to jump into the legislative space a little bit. So we all know the federal government has tried to impose a moratorium on AI laws and regulations. And nonetheless we're seeing states regulate on AI and it's sometimes regulating indirectly via privacy and consumer protection laws. You can take a look at Kentucky went after an AI chatbot company mostly on consumer protection grounds, I believe, and as did Texas, has included their consumer protection law to. To regulate what I would argue is often AI related activities. So I guess my question to you, is it even possible to bifurcate as between privacy, AI and consumer protection at this point from a legislative standpoint?
- [41:55]
C
I do, I do think it's possible and I wish it would happen more. I mean, I just think some of these policies are so far off and they're, they're way overly broad. And what I would point to is, you know, looking at AI and AI policy, right, you could be a lot more effective trying to address the various different elements or components or aspects of harm independently and not even calling them AI, Whether it's civil rights violations, which are incredibly important and agreed upon. Write a civil rights law, and it doesn't matter whether the discrimination is coming at the hands of a machine, this automated intelligent machine, or an old biased set of men, write the law around the discrimination and prohibit that and enforce that. And the same thing, a lot of AI stuff is copyright scraping, you know, and it's like it becomes, it's, it's an AI debate, scraping and you know, like scraping technology and copyrighted material is, is an AI fight. Like, let's make that a good.
- [42:56]
A
That allows them to say, well, this is new. Yeah, I mean, that allows them to say new and then not subject to these, you know, like pesky copyright laws. And that's, I mean, that's a problem.
- [43:06]
C
Let's fix our. I mean, I mean, I'm not a copyright guy. I've spent a good amount of time working on this stuff over the years, but I'm not a copyright guy, you know, by far. But like, let's decide what kind of rights incompetent, you know. So I don't know. I, I think, I think these policies, AI writ large in some policies are just overly broad in that they try to tackle so many different things. And like, if you look at this from a legislative perspective, you know, federally, these are things that would all land in different committees. And you know, like, I would love to. I, like, I'm an incrementalist, you know, in my life and in my work, like, I love to split things up. If you want to do civil rights, let's do civil rights. You want to do copyright, you know, do copyright, intellectual property, do that. If you want to do data protection, do data protection. But, but rolling them all together, putting a huge AI label on them and acting like we need to do them all at once together is bananas. And I wish we could get away from it. But to your, to your question about the moratorium and kind of what's happening, like, I don't, I'm just not so sure the moratorium is going to have the impact that the administration wants it to have. And, you know, I'm very appreciative, as I know many in industry are about having support for wanting to drive innovation, but we're also very cognizant of, you know, wanting to prevent harms, you know, because again, that's kind of our sweet spot.
- [44:29]
A
The point I'm making is that the federal government seems intent on stopping any regulation of AI. And the energy is going to go somewhere. And the energy, if you restrict states from regulating on AI, they are just going to pull out privacy or consumer protection or some other law as a way to address what they see as a consumer concern. And so the federal government seems to think that by abdicating the responsibility that they can also ensure that the states do so as well. And I, I just don't think that. I don't think that strategy is going to work.
- [45:12]
C
Yeah, it doesn't seem like it's going to in this current environment where states are quite emboldened and empowered.
- [45:17]
A
Okay, I've got one more question for you, David. It's January, so it's prediction time. So what are the top four to five things that you think will happen at the state level and the federal level when it comes to the ad space?
- [45:31]
C
Well, we, you know, I love a good prediction, as you probably know. I love, I love making guesses and pontificating. And I have my opinions.
- [45:41]
A
I make a couple every week. And I figure if you make a couple of hundred every week, some of them are going to turn out right.
- [45:46]
C
And you got to be willing to be wrong. You know, we talked about a handful of them already. And so I think in kind of in the issues you've been raising, I think you're on track. I mean, I would say the drop in data brokers, I have at number one in terms of having an impact on our industry being a significant change agent. That's not to say that we're going to end the year and everything's going to be totally clear here, but I think it's going to be a milestone year in terms of figuring out how well this works, the system works and how many other states, you know, what they're thinking and at least laying the groundwork as to whether or not we have a thing that's going to be replicated. So I think this is the first year, a key year and this will go into the next year. But, so I've got that at number one. At number two, I've got kids policy. And again, this isn't super stepping outside the box, but I think some people may not feel it as much outside the kind of policy world, just how focused policymakers are at the state and federal levels. And what I'm seeing is a bit of a shift. We talked earlier a bit about age recognition, age verification, and you're right, that's really challenging with respect to First Amendment and the ability to require that stuff. But I think we're edging more in that direction and I think that's a good thing. I think we're beginning down the road of having more knowledge of kids and their data and doing it in a responsible way, whether it's estimation or verification or, you know, so, so I, I think we're, we're going to head further down that path. I, I don't want to get too detailed and say that a Congress is going to pass this bill or a state's going to pass, you know, but I, I think, but yeah, but I.
- [47:38]
A
Will say where it's, where it's really bleeding into the ad space. And I don't think anybody's talking about this yet is like for years we had this COPPA standard under 13 child directed site. I didn't always agree with the assessments, but I kind of got what they were getting at. But now as that age is now 15, 16, 17, even 18 in some places, the idea that you have, you know, no, or should have known that a user is a kid in an ad setting is going to be really, really messy. And the ads people are very used to saying, ha ha, we have no idea. And I'm just not sure that that response is, is going to be satisfying enough to policymakers and regulators at the state level.
- [48:26]
C
Right. And if you want a specific point on that, New York, I think a lot of people don't have their eyes. New York is in, they're looking to wrap up a rulemaking on their, their children's Safety, but they've got a parallel privacy measure that, that is broader than any in the nation. And they put out an anprm, you know, years ago. And so this year will. But that's going to be a huge development in terms of when they start moving that forward.
- [48:49]
A
Couldn't agree more. So we've got two. Any more predictions.
- [48:55]
C
On the enforcement side? Again, this isn't necessarily outside the box. I think everybody that's paying attention has been watching see this uptick in enforcement. Beyond the uptick in enforcement, the sophistication and the collaboration, maybe not everybody is seeing that, appreciates how significant it is, the increase in resources. Again, New York building, you know, the attorney general just announced a new office. A lot of other AG offices are really staffing up in these areas. Texas is obviously the leading red state. So the resources are growing and growing. And you know, this is another thing where I'm optimistic on. Part of the reason advocates and others are pushing for a private right of action is because of the inability to enforce laws. And to the extent we can have regulators and pragmatic ones that are enforcing laws in reasonable ways rather than going to the courts against extortionists, that's a good thing, right? So I don't think industry should be so negative on this development. I mean, it might be scary for some companies, but hey, if you're a good actor, it's a great opportunity and it's a good development.
- [50:05]
A
I'm of two minds with that. So the first thing is like, I don't think you can point to what's happening in SIPA and the VPPA and go, yes, we need more private right of action. And you can certainly make an argument that at the state level, enforcement is ramping up and it's getting more and more robust. But equally at the state level, you've got states who are engaging private law firms to do their bidding for them. Which isn't that different than how the private right of action is ultimately working, where if a state just says, you know, I can get a billion dollars from this company and you'll get a cut of that, you start making different enforcement decisions that are based more on how big a splash that I can make and less about actually protecting consumers.
- [50:51]
C
That's a really good point, Alan. That's something that I'm not. I'm not as close to. I'm not seeing as much from where I sit. But I couldn't agree more. More in terms of. That's not an ideal approach.
- [51:02]
A
Yeah, couldn't agree more, David. This has been an absolutely wonderful discussion. Where can people find you and the nai?
- [51:11]
C
It's kind of a dumb question for.
- [51:12]
A
Me to ask, isn't it?
- [51:15]
C
Yeah, come to the NAI website, the NAI.org I think hopefully a lot of your listeners know me already. If not, I, you can find me here in D.C. and as you know, and I hope others know, we're very open minded and collaborative and we're willing and wanting to work with stakeholders from across the spectrum, you know, civil society, industry, our industry, other industries. And you know, we're really wanting to extend the net as much as possible in terms of our engagement. So happy to talk to anyone interested in and engaging more with the ad tech industry.
- [51:54]
A
And also, let me just put it out there. I've seen David speak at any number of events, even some private events where there's maybe 30 or 40 people in a room over a dinner. And you were one of the more eloquent and interesting and exciting speakers. So you were just such a fantastic ambassador for the larger ad space. And so I would really encourage private companies to reach out to you and see if you'd be willing to speak because I think that you speak to these issues in a way that is balanced and articulate.
- [52:27]
C
Well, thanks, Alan, I appreciate that. And it sounds to me like maybe I'll get invited back next year again for the third year. Neuron third installment of look at 2027.
- [52:38]
A
Yeah, two dudes from Connecticut talking privacy.
- [52:41]
C
Nice. Nice.
- [52:42]
A
David, thank you so much for coming on. This has been fun.
- [52:44]
C
Thanks for having me, Alan. I always love it.
- [52:48]
A
That was a great discussion. I've been pretty vocal that too many small to mid sized players in the ad space are not focusing on the regulatory or legislative environment outside of some of the big antitrust trials that have taken place over the past year or two. There's a culture within the ad space that focuses on keeping your head down and staying within the herd as being the keys to success. I think that approach has not served the greater ads community very well over the past decade as it allows big tech to set the agenda even more so than they do. But also I think that that approach will be increasingly more difficult to sustain on an individual company basis in 2026 as state enforcement really ramps up. On a related note, if you haven't read it yet, I'd encourage you to take a look at my latest piece on the Monopoly report newsletter@monopolyreport.com where I talk about the Texas Attorney General Ken Paxton's recent enforcement against a number of smart TV manufacturers, as I think that case is as good example as any for describing what the larger ad space is going to be up against in 2026. Please check it out. We've got a bunch of other fantastic guests coming up on the Monopoly Report podcast over the next few weeks. We have Tom Kemp from the Cal Privacy Team on in a few weeks, and I'm hoping we'll have a senior person from one of the browser companies on as well. Please subscribe to the show@monopolyreportpod.com or on Spotify, Apple, YouTube, or wherever you listen to your podcasts. And thanks for listening.