Technology
Services
Resources
How will the latest legislation out of Europe and the United States impact digital advertising in 2024 and beyond?
It’s been a busy couple of years for digital advertising industry regulators, with new regulations taking effect around the US and new legislation popping up across the globe. What’s the latest, and how will it impact advertising and marketing professionals? Let’s dig in and find out:
While the United States has taken its time determining how to handle Big Tech regulation, the European Union has embraced its reputation as the world’s fiercest tech regulator.
Unrestrained by free speech rules like America’s First Amendment, the EU has taken the lead on matters like consumer privacy (with GDPR), walled gardens like Apple’s App Store and the Google Play Store (with the Digital Markets Act), and misinformation and hyper-personal ad targeting on social media (with the Digital Services Act).
Though some requirements of the Digital Services Act (DSA) came into effect in 2023, with “Very Large Online Platforms” and “Very Large Online Search Engines” being subject to the law’s stipulations, it wasn’t until February 2024 that all platforms became subject to its broader implementation and enforcement. The law compels social platforms like Facebook, Instagram, and YouTube to dedicate more resources to stomping out misinformation and hate speech on their platforms, and bans any targeted online ads that are based on an individual’s ethnicity, religion, or sexual orientation. Google and Meta are also now subject to annual audits to uncover “systemic risks” related to their social assets, search engines required to suppress misleading search results, and even Amazon will have to comply with new rules aimed at curbing the sale of illegal products.
As for the Digital Markets Act, in September 2023 the EU designated six companies—Alphabet, Amazon, Apple, ByteDance, Meta, and Microsoft—as “gatekeepers” under this regulation. Though TikTok and Meta appealed this designation and Apple filed a legal challenge to the DMA itself, these tech giants have been forced to make changes to meet the rules and requirements outlined in the DMA, such as allowing users to choose different default browsers and search engines, download iPhone apps outside of Apple’s App store, and control how their personal online data is used.
Altogether, social media platforms face strict regulation in the EU—and serious consequences when they breach the bloc's privacy laws. Meta learned this the hard way, incurring a nearly $1.3 billion penalty for transferring user data between the United States and countries in the EU and the European Economic Area. It’s the biggest penalty an EU regulator has levied on a tech company since 2021 and a clear signal that privacy compliance is non-negotiable. (That said, the EU-US Data Privacy Framework should hopefully help prevent similar data flow-related fines and confusion going forward.)
Back stateside, industry regulation is a bit more decentralized—at least, for now. While federal-level legislation has mostly lingered in congressional purgatory (more on that in a bit), five new state-level data privacy acts took effect in 2023—with new regulations coming to Virginia, Colorado, Connecticut, Utah, and California. And in 2024, new rules are arriving in Texas, Oregon and Montana, with several other states to follow suit in 2025 and beyond. Notably, in May of this year, the Vermont Legislature passed one of the strongest data privacy measures in the country, which includes a provision that would allow individuals to sue companies that violate their privacy rights. Though it is unclear whether the state governor will sign the final bill into law, if enacted in its current form, it would make the state the first to allow individuals to sue not only for data breaches but also for violations of their digital privacy rights.
At present, the broadest and most impactful of these enacted state-level regulations is the California Privacy Rights Act, aka CPRA. Building off the foundation of 2018’s California Consumer Privacy Act (CCPA), the act created a California Privacy Protection Agency that’s dedicated to (and responsible for) enforcing the law—indicative of increased enforcement—while also reducing ambiguity around how to interpret some of the data-related aspects of the law. The CPRA now requires companies to give consumers the opportunity to not only opt out of the sale of their personal information, but also of giving or sharing that data with someone else, including a third party that might use it for cross-context behavioral advertising.
As Basis Technologies General Counsel Derek Zolner put it: “Essentially, the CCPA, CPRA, and the other data privacy acts that are popping up around the US are establishing legal enforcement mechanisms around personal control of one’s personal data and codifying many of the core principals of our industry—namely, transparency, notice, and the right to opt out. Only now, instead of the industry self-regulating these matters, state governments are intervening to take control of that enforcement.”
Meanwhile, at the federal level, a bipartisan group of lawmakers released a draft piece of legislation in April 2024 that would establish a comprehensive federal consumer privacy framework, called the American Privacy Rights Act of 2024 (APRA). Though Congress has attempted to pass such legislation for many years, the APRA could be a major step forward given that it is both bipartisan and bicameral and has garnered the support of key House and Senate members.
Draft legislation of the APRA establishes clear national data privacy rights and protections, gives individuals the right to sue those who violate these rights, establishes strong data security standards, and gives the FTC authority to enforce any violations of the bill. It also could have significant impacts on targeted advertising, potentially requiring consumer opt-in for online tracking for advertising purposes. Regardless, if signed into law, the APRA would have serious implications for players in the digital advertising ecosystem.
But the APRA isn’t the only legislation that could fundamentally alter the entire digital advertising landscape: Congress is also considering additional legislation that, if passed, would potentially end the Big Four era of Big Tech.
A bipartisan group of lawmakers led by Utah Senator Mike Lee introduced a bill that would prohibit companies that take in $20 billion or more in digital ad revenue—think Google, Meta, and Amazon—from owning all of the tech and marketplaces involved in both the buying and selling of those ads. The legislation, titled the Competition and Transparency in Digital Advertising Act, would also bring new levels of transparency to the industry, requiring companies with more than $5 billion in digital advertising revenue to “act in customers’ best interests and provide greater transparency on data collection, the terms of winning bids and the fees they charge.”
In essence, the law would force ad behemoths like Google to sell or spin off parts of its $210 billion global ad business while delivering new levels of programmatic advertising transparency for advertisers and publishers alike.
Now, whether or not the Lee-drafted legislation ever makes it to the President’s desk is far from certain. However, the fact that it has finally reached the Senate floor after months of rumor—and that it even has bipartisan cosponsorship in a very fractured Washington—shows just how real the desire is among many Americans for a digital advertising industry that’s less of a black box and more of a sunlit building with lots of South-facing windows.
As if pending legislative action wasn’t enough, Google and Meta are also facing both consumer scrutiny and federal lawsuits around alleged anticompetitive practices, ad auction manipulation, and monopolistic market shares in the US.
Google, in particular, has caught the eye of the Justice Department and several states. It faces not one but two lawsuits alleging violation of US antitrust laws. The first case, brought by the Department of Justice and 11 state Attorneys General, is an attempt to prevent Google from “unlawfully maintaining monopolies through anticompetitive and exclusionary practices in the search and search advertising markets.” This suit comes at a time when Google owns a whopping 90% market share in search, though the company maintains that its supremacy in the landscape is because they “simply provided a superior product.” The 10-week trial for this case concluded in early May 2024, though it will likely be several months before a ruling is made.
Additionally, Google is the subject of a second suit accusing the company of “monopolizing digital advertising technologies” in violation of the Sherman Antitrust Act and is set to go to trial in September. While the first case addressed its monopolization of the search landscape, this second case relates to Google’s overall presence within the digital advertising landscape. If successful, this lawsuit would not just bar Google from engaging in anticompetitive practices, but force it to divest of some (or all) of its ad business, such as its ad server, ad exchange, ad networks, or DSP.
Together, Google, Meta, and Amazon account for nearly two-thirds of the $300+ billion US digital ad market. Between those antitrust concerns and accusations of political meddling against big tech from both side of the aisle, the possibility of major regulatory changes in the digital advertising industry is all too real.
This antitrust regulatory action isn’t limited to the US. Across the pond, Google faces similar antitrust charges for its digital advertising practices, with the European Commission citing Google’s heavy involvement at “almost all levels of the so-called adtech supply chain” and noting concerns that the world’s fourth-most valuable company “may have used its market position to favor its own intermediation services.” This marks the fourth time Google has run afoul of EU antitrust regulations in the last few years, and with the bloc’s history of action against US-based tech giants, the case is unlikely to go away anytime soon.
Since its public release in 2022, generative AI has garnered a lot of hype—and for good reason. From AI chatbots like ChatGPT and Bard, to AI image and art generators like DALL-E 2 and Midjourney, to Microsoft and Google both embracing new AI-powered search capabilities, this emerging tech is making some serious waves in the marketing and advertising world (and beyond). But for all the excitement around generative AI, its boom has also been accompanied by fierce warnings and concerns from experts across the globe.
Amidst these mixed emotions, it’s no surprise that AI regulation has become a hot topic. After briefly banning ChatGPT in March 2023, Italy’s data protection authority has since further solidified its plans to closely scrutinize and evaluate generative AI tools their compliance with data protection and privacy laws. And last summer, the EU came out with the world’s first comprehensive AI law: The EU AI Act, which was finalized in December 2023 and was approved by the European Parliament in March 2024. In the act, they outline the many potential benefits of AI, as well as “establish obligations for providers and users depending on the level of risk from artificial intelligence.”
The US, meanwhile, has yet to take action quite as deliberate as the EU’s, but that doesn’t mean Washington has been ignoring AI’s emergence. In May 2023, OpenAI CEO Sam Altman appeared before Congress and directly encouraged lawmakers to regulate artificial intelligence, and shortly after, a bipartisan collection of congresspeople introduced a new House bill for an AI-focused oversight commission.
Additionally, President Joe Biden signed an executive order in late October 2023 that aimed to address the “safe, secure, and trustworthy development and use of Artificial Intelligence”. Though this order touches on many of the challenges that have arisen with AI and outlines tangible guidelines and action steps, it’s worth noting that these are merely voluntary guidelines, not enforceable regulatory standards. To become law (and enforceable as such), this order will almost certainly need to be accompanied by congressional action. All of that said, tech leaders appear largely divided on how AI should be regulated—with some even questioning if it should be regulated at all. As this disruptive technology continues to evolve, so too will governments’ regulatory approaches, and we are likely to see more concrete activity on this front in the months ahead.
Last but not least, while much of the focus of recent regulation has had an eye toward American-based companies, there is one notable exception to the trend: TikTok.
Many no doubt remember the TikTok regulation sagas of 2020, when then-President Trump attempted to remove the app from Apple and Google app stores over data privacy and national security concerns and even worked to force the company to sell its US operations to an American firm such as Oracle or Microsoft.
While these more immediate federal-level threats seemed to taper off following the election of President Joe Biden, the lull proved to be short-lived. In March 2023, the Biden administration demanded that TikTok be sold or risk facing a nationwide ban. Since then, lawmakers in Washington have indicated bipartisan support for regulation of the app, pointing to ongoing concerns around TikTok’s data practices and its ties to Chinese-owned parent company ByteDance. And in April 2024, Congress tucked a measure into a foreign aid bill that stipulated that ByteDance must sell its stake in TikTok within 12 months, or the app would be banned in the US. Since President Biden signed that bill into law, the backlash has been both swift and severe: TikTok content creators are suing the US government, a battle which could end up before the Supreme Court.
In response to this attempted TikTok ban, TikTok CEO Shou Chew shared, “Rest assured, we aren’t going anywhere...The facts and the Constitution are on our side, and we expect to prevail again.”
The app has also faced harsh scrutiny at the state level. In May 2023, Montana became the first state to ban TikTok, but a federal judge temporarily blocked that law before it could take effect. Additionally, TikTok has been banned from government devices in more than half of all US states, numerous universities have blocked the platform from campus Wi-Fi networks, and a group of 15 state attorneys general have called on Apple and Google to change TikTok’s app store age ratings.
As TikTok continues to soar in popularity, gobble up market share, influence global culture, and embrace advertising opportunities, it will no doubt attract increased legislative and regulatory scrutiny from governments around the globe. So while it has thus far escaped initial regulatory attempts relatively unscathed, the clock is ti(c)king...
On to the big question: what does this all mean for digital advertisers?
For one thing, the Digital Services Act will potentially lead to safer advertising environments—particularly on social media—helping both brands and users enjoy a more hospitable digital ecosystem. With brand safety an increasingly-meaningful aspect of the brand-customer relationship, an internet with less misinformation and more trust would be more than welcome across the globe, let alone in Europe. The EU legislation will also mean some aspects of targeted digital advertisements in the region are slightly less personalized, at least on the basis of ethnicity, religion or sexual orientation.
When it comes to TikTok, the app's booming growth and rising ad revenues do not appear at risk with any new agreements surrounding US user data, and advertisers will likely remain until a ban actually comes into effect (if it can surpass the legal hurdles ahead).
As for Google, the biggest threats to its digital ad dominance (other than an AI-fueled search revolution) are the 2023 antitrust suits. The US-based suit—an “ambitious swing” from the Justice Department—nevertheless has a very real potential to succeed. Google, for its part, has said the US suit “ignored the enormous competition in the online advertising industry” and that the EU charges “focus on a narrow aspect of our advertising business.” Regardless, the suits could cloud Alphabet’s forecasts and bring further uncertainty to a company that in the last 12 months has conducted several rounds of layoffs, including its largest ever, while facing new search competition from an AI-powered Bing.
In regard to the other US bill, Google, Meta, and Amazon—not to mention their lobbyists—will no doubt have plenty to say about its contents. Google's immediate reaction was to say that the bill will "hurt publishers and advertisers, lower ad quality, and create new privacy risks" and pointed to "low-quality data brokers" as the true problem. And in the years since it was first introduced, the bill’s progress has (like so many others) predictably stalled. But whatever the outcome, it’s clear that Washington is hearing the rising calls for digital advertising transparency from brands, publishers, and consumers alike.
Finally, when it comes to data privacy regulation, state-based US legislation such as the CPRA should lead to increased transparency and control over personal data for consumers—or, at least, for consumers from those states that have enacted new privacy laws. And the APRA is likely Congress’ best chance yet at passing a federal consumer data privacy law, given its bipartisan support across both the House and Senate. The months ahead should see more action on this legislation, given that high-level lawmakers have indicated it is among their top priorities.
As much as people want a unified, omnichannel consumer experience, they’ve also made it clear that they want more control over who can—and who cannot—access their personal data as part of the advertising process. Private companies like Apple (with iPhone’s App Tracking Transparency and lack of third-party cookies on its Safari browser) and even Google (which is famously deprecating third-party cookies in Chrome) have shown a willingness to slowly but surely give consumers more control over their data, but the rest of the advertising industry has at times seemed reticent to accept the realities of a cookieless future.
One way or another, though, the digital advertising industry is going to have to prioritize privacy. Third-party cookie deprecation is happening, even if there’s no single, perfect “replacement” solution quite yet. And if Big Tech—and the advertising industry—don’t want to make the difficult choices involved in regulating themselves when it comes to consumer privacy, then world governments will likely be all too happy to do it for them.
If all this regulatory activity out of the EU and the US tells us anything, it’s this: Regulators have their eye on the digital advertising industry. Advertising leaders looking to balance innovation with compliance must take regulators’ concerns seriously by prioritizing consumer privacy, approaching AI with caution and intentionality, and keeping an eye on regulatory developments across the board.
—
Curious about the state of identity in 2024 as advertising heads into the cookieless future? In our report, Identity vs. Privacy: Digital Advertising in a Cookieless World, we share insights from more than 200 marketing and advertising professionals and explore how they’re navigating signal loss, third-party cookie deprecation, and the shift towards privacy-first digital advertising.
Post updated May 28, 2024