Lawmakers Plan Legislation to ‘Ban Surveillance Advertising’

Lawmakers have proposed new legislation that they say would ban surveillance-based advertising. The legislation would target the underlying practice of targeted or personalized ads that facilitates surveillance-based advertising itself.

“The Banning Surveillance Advertising Act does what its title suggests. The legislation prohibits advertising facilitators (e.g., Facebook, Google DoubleClick, data brokers) from targeting ads with the exception of broad location targeting to a recognized place (e.g., municipality),” a press release announcing the proposed legislation reads. “The bill also prohibits advertisers from targeting ads based on protected class information and any information they purchase. Violations can be enforced by the Federal Trade Commission, state attorneys general, or private lawsuits,” it adds. The legislation would also prohibit targeted advertisements based on protected class attributes such as race, gender, and religion.

Reps. Anna G. Eshoo of California and Jan Schakowsky of Illinois, and Sen. Cory Booker of New Jersey are the Democratic lawmakers behind the proposed legislation.

Do you know anything else about a specific case of data abuse? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, or email joseph.cox@vice.com.

“The ‘surveillance advertising’ business model is premised on the unseemly collection and hoarding of personal data to enable ad targeting. This pernicious practice allows online platforms to chase user engagement at great cost to our society, and it fuels disinformation, discrimination, voter suppression, privacy abuses, and so many other harms. The surveillance advertising business model is broken,” Rep. Eshoo said in a statement.

The legislation is supported by a spread of organizations such as the Anti-Defamation League (ADL) and the Electronic Privacy Information Center (EPIC); companies such as search engine DuckDuckGo and privacy-focused services provider Proton; and academics including Shoshana Zuboff, author of The Age of Surveillance Capitalism, Joan Donovan, research director at the Harvard Kennedy School’s Shorenstein Center on Media, Politics and Public Policy; and Woodrow Hartzog, professor of law and computer science at Northeastern University and author of Privacy’s Blueprint.

Generally, tech companies such as Facebook argue that targeted advertising is a positive thing, as it means that the adverts users of their platforms face are more relevant to their interests. But to facilitate that targeting, Facebook and others collect large amounts of data on users’ preferences, location, characteristics, and more, putting that data at risk. Third parties can also leverage that data for their own malicious purposes, or target specific groups of people with misinformation using the companies’ ad platforms.

Nathalie Maréchal, Ph.D., senior policy & partnerships manager at Ranking Digital Rights, an organization that works to promote freedom of expression and privacy on the internet, said in a statement accompanying that announcement that “Surveillance advertising's main economic function is to enrich ad tech companies at the expense  of publishers, consumers and advertisers themselves, and it is high time for Congress to step in. Banning surveillance advertising will protect individual privacy, reduce corporate incentives to maximize invasive data collection, and spur innovation by unleashing the potential of the digital  contextual advertising sector that has been held back by the dominant surveillance advertising  platforms.”

Zach Edwards, a security researcher who closely follows the supply chains of data, told Motherboard in an online chat that "The 'Ban Surveillance Advertising' legislation empowers the FTC with important new definitions of an 'unfair and deceptive act' related to sharing personal data with online advertising companies and data brokers—a crucial shift that will create new levers for accountability within existing federal frameworks. This new legislation also reiterates how a State Attorney General can also bring civil action against an ad tech company violating the new standards, which is an important addition to ensure that multiple legal entities (FTC + State AG's) are able to investigate these data brokers in order to hold them accountable." He also pointed out that it includes a private right of action, with fines ranging from $100 to $5,000 per violation.

He also said that the legislation may be effective against bidstream data specifically; the flow of sensitive data parties can obtain by participating in the ad bidding process. As Motherboard has shown, surveillance companies have leveraged this data in products they sell to the government. The legislation also seems to have a particular focus on location data, meaning it could be the "death nail for dangerous data brokers like Safegraph, who have built data supply chains across the world, with dozens if not hundreds of advertising vendors providing mobile location for resale to anyone with a credit card."

However, "Legislation that attempts to ban a dangerous yet complex business model, can't rely on rhetoric to fill the technical data supply chain loopholes. It's unfortunate that the 'Ban Surveillance Advertising' legislation appears to make no effort to mirror Europe's GDPR language which describes the entities within a data supply chain as either a 'controller' or a 'processor.'

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.