A little privacy: week of July 5

Julie Rubash, Chief Privacy Counsel
July 9, 2021



The Colorado Privacy Act was officially signed into law this week, making Colorado the third U.S. state to enact comprehensive privacy legislation, just following Virginia. The law will take effect July 1, 2023. One notable provision for the advertising industry (effective July 1, 2024) obligates those who process personal data for targeted advertising or the sale of personal data to allow consumers to opt out through a “user-selected universal opt out mechanism” but allows consumer consent through a controller’s web page or app to take precedence over any universal opt out.


U.S. President Biden signed an Executive Order, which, among other things, encourages the FTC to establish rules on surveillance and the accumulation of data, citing that “many of the large platforms’ business models have depended on the accumulation of extraordinary amounts of sensitive personal information and related data. The order also announces an administrative policy of greater scrutiny of mergers by dominant internet platforms “with particular attention to the acquisition of nascent competitors, serial mergers, the accumulation of data, competition by ‘free’ products, and the effect on user privacy”. 



Italy became the 12th state to ratify the Amending Protocol (Treaty No. 223) to the Council of Europe’s Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data (Treaty No. 108), a multilateral treaty that promotes data protection policies among member countries. The Amended Protocol includes (among other things) enhanced requirements regarding transparency, data breach notification, data subject rights (particularly in an algorithmic decision making context), processing of sensitive personal data, accountability measures, restrictions on transborder flows of personal data and obligations concerning impact assessments and privacy by design and privacy by default. The Amending Protocol will come into force on October 2023 if at least 28 Parties have ratified it as of such date, or earlier if all Parties ratify it.  


The UK ICO announced this week that it is creating the first drafts of guidance to help designers comply with its Age Appropriate Design Code, which will be enforceable as of September 2, 2021 and covers data collection practices, among other things. They will be running workshops and seeking feedback over the next few weeks to test the draft guidance. According to the ICO, “If your online service is likely to be accessed by children under the age of 18, even if it’s not aimed at them, then you are probably covered by the code.”


Meanwhile, the UK Department for Digital, Culture, Media & Sport published a policy paper on its “Plan for Digital Regulation” and invited comments by September 28, 2021. The Plan includes an online advertising consultation in the next 6 months and an intention to legislate in the area of “Online Safety” (among others). With respect to the Online Advertising Programme, the paper says “The regulation of online advertising needs to reflect the evolving market and the expectations of consumers and businesses that platforms will take their own actions to stop misleading or harmful adverts. It should incentivise compliance, companies proactively reducing harm, and rapid remedial action when rules are breached.” The paper also stresses the importance of non-regulatory tools, such as industry-led technical standards, to complement or provide alternatives to traditional regulation.


Ad spending has shifted from Apple to Android since Apple started requiring apps to obtain user consent for tracking, according to research reported by the Wall Street Journal. The Journal reports that less than 33% of iOS users opt in to tracking and, as a result, prices for mobile ads directed at iOS users have declined, while prices for ads targeting Android users have risen. 

Latest Blog Posts

Vermont Data Privacy Bill Is Vetoed

June 17, 2024

Vermont Governor announced his veto of a bill that...

You Are Who You Work With: Cookie Consent and Data Privacy

June 11, 2024

Who you work with for consent management and data...

Texas AG Prepares for “Aggressive Enforcement” of Privacy Laws

June 10, 2024

Texas Attorney General announced a data privacy and security...

Latest White Papers

Benchmark Report: US Privacy Compliance

August 19, 2022

The current state of publisher compliance with CCPA, and...

Ebook: A Publisher’s Guide to Vendor List Curation

December 16, 2021

How to review your vendor list to mitigate compliance...

Keep in touch

Sign up for our newsletter to keep up with privacy news for adtech and martech,
plus occasional company news.

Let's explore what we can do together.

We'll be in touch within 48 hours

[contact-form-7 id="593" title="Schedule a Demo"]