The Banning Surveillance Advertising Act: What the Clampdown on Targeted Advertising Means for the Internet Economy

By Vasundhara Majithia, LL.M. 2022

On January 18, 2022, Senator Cory Booker (D-NJ), Congresswomen Anna Eshoo (D-CA), and Jan Schakowsky (D-IL)¹ introduced the Banning Surveillance Advertising Act of 2022 (BSAA) to Congress.² The bill seeks to prohibit targeted advertising based on users’ personal information, such as their contact details or unique identifiers. Currently, advertisers often place third-party cookies on websites to collect personal information about users, including their location, age, gender, and interests.³ This information is then used to target users with customized advertisements.⁴

Currently, the United States does not have a comprehensive federal privacy law, and its privacy regime consists of a confusing patchwork of state and sectoral federal privacy laws.⁵ Against this background, the BSAA is yet another bill that seeks to regulate privacy in a particular sector—in this case, digital advertising.

The BSAA seeks to overhaul the $350 billion digital advertising industry⁶ by limiting their access to and use of users’ personal information. The bill specifically prohibits targeting based on (1) protected class information (such as race, gender, ethnicity, religion, sex, familial status or disability)⁷ and (2) third-party data purchased or obtained by the advertiser from another person.⁸ However, advertisers are permitted to advertise based on information the user is viewing or searching for, a practice called “contextual advertising.”⁹ Broad location advertising, based on the general area of the user such as a city or district, is also permitted.¹⁰

The bill empowers the Federal Trade Commission (FTC)¹¹ and state attorneys general¹² to enforce the law. It also provides users a private right of action to bring lawsuits and obtain statutory damages ranging from $100 for negligence to $5,000 for willful violations.¹³ In an apparent departure from earlier privacy legislation such as the California Consumer Privacy Act (CCPA), the bill does not provide the user the choice to opt-in to such tracking, even with consent or in exchange for monetary benefits.¹⁴

The BSAA is supported by several public interest organizations, including the Anti-Defamation League and the Center for Digital Democracy, as well as prominent privacy-oriented companies such as DuckDuckGo.¹⁵ However, it is not without its critics. Experts say it does not go far enough, as it relies on mere attestations that advertisers are compliant.¹⁶ The ad industry itself claims that if passed, the bill will jeopardize 17 million jobs, primarily at small and medium-sized businesses.¹⁷ But proponents claim that targeted ads yield only a 4% bump in efficacy over contextual ads,¹⁸ and therefore the BSAA will not have any impact on the digital economy.

This bill has come on the heels of a similar law recently approved by the European Union called the Digital Services Act, which prevents platforms from using “sensitive information” such as race, religion, or sexual orientation for targeted advertisements.¹⁹ It also requires that users be given the choice for easy opt-out from tracking.²⁰

While the chances of the BSAA passing appear to be low, its introduction in Congress indicates that the tide is turning for targeted advertising.²¹ As technology companies become more privacy conscious, online tracking of users is also becoming less invasive. Apple has consistently been reducing the use of third-party cookies since 2017,²² and has now eliminated third-party cookies on its web browser, Safari.²³ Google recently announced that it will abandon third-party cookies in favor of Federated Learning of Cohorts (FLoC), where companies would target specific demographics, while theoretically allowing users to remain anonymous.²⁴ After major backlash from privacy activists even to FLoC,²⁵ Google announced that it will instead will use “Topics,” which assigns users five interests per week based on their activity, signaling a huge shift in digital advertising practices.²⁶ To that end, President Biden has also recently called for an end to targeted advertising to children.²⁷

Considering such initiatives by several industry leaders,²⁸ the requirement of the BSAA is debatable. The third-party cookie is already set to retire.²⁹ Advertisers are quickly adapting to targeting with first-party data instead of demographic information and investing in improving contextual targeting techniques.³⁰ Given the multiplicity of existing laws and the staggering costs associated with their compliance,³¹ a comprehensive federal privacy law may be more effective in enhancing user privacy over “action specific” privacy laws such as the BSAA.