• by Wendy Davis  @wendyndavis, June 17, 2024

Rhode Island lawmakers have passed a privacy bill that's drawing opposition from the ad industry and consumer advocates alike, with industry groups arguing that the terms are confusing, and advocacy organizations contending that the provisions are too weak.

The bill “does not make clear what kind of data would be subject to regulation under its provisions,” the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, American Advertising Federation and Digital Advertising Alliance say in a letter sent Friday to Governor Dan McKee.

The ad groups are urging McKee to veto the bill, arguing that it “contains unclear and confusing provisions and requirements that are significantly out-of-step with other state privacy laws that have been enacted to date.”

Consumer Reports, the Electronic Privacy Information Center and Restore the Fourth also oppose the bill -- though for different reasons. Those groups said in a letter sent to lawmakers last week that the measure “would do little to protect Rhode Island consumers’ personal information, or to rein in major tech companies like Google and Facebook.”

The bill itself (HB 7787/SB 2500) has provisions that would require companies to allow consumers to opt out of the processing of “personal data” for targeted advertising and profiling -- but that requirement appears to apply only to data that's not pseudonymous. Much of the data that fuels online ad targeting, however, is pseudonymous, such as device identifiers or tracking cookies.

Among other objections to the bill, the privacy advocates flagged the apparent carve-out for pseudonymous data, arguing that it “represents a major loophole that would essentially exempt the majority of the online advertising ecosystem from the most substantive aspects of this bill’s coverage.”

Ad industry organizations take issue with other portions of the proposed privacy law -- including a requirement that data controllers “identify all third parties to whom the controller has sold or may sell customers’ personally identifiable information.”

The ad organizations say this requirement “is extraordinarily burdensome, as controllers change business partners frequently, and companies regularly merge with others and change names.”

What's more, the groups say, the bill doesn't define the term “personally identifiable information.”

The ad groups also note that some provisions of the bill reference consumers' right to opt out of data collection -- even though the bill doesn't explicitly give consumers that right.

“A right to opt out of data collection would starkly diverge from every other state that has passed privacy legislation to date,” the ad groups write.

The ad organizations want lawmakers to revise the bill by deleting references to “personally identifiable information” and to a right to opt out of data collection.