What FTC Sticks Are Telling Adtech

Companies operating in the US have long contended with the Federal Trade Commission as their principal privacy regulator and effective policy maker, especially given the inability of the US Congress to agree on a comprehensive privacy law.  The CPPA in California has begun to step up their activity over the

Let’s Talk About Authorized Agents

This blog continues the discussion we started in an earlier post, which unpacks The Role of 'AAs' Under Key U.S. State Privacy Laws. Background If your company receives consumer privacy requests (aka data subject requests), you’ve probably received requests from third parties who claim they are

Privacy in the Age of New ID Solutions

This op-ed is a companion to our July 30 post, which you can read here.  Despite Google’s recent delay in phasing out Third-Party Cookies (3PC), the writing is on the wall: online publishers must explore new identity (ID) and first-party data solutions to maintain their targeted advertising capabilities. In

De-Deprecated: Cookies Live to Crumble Another Way

This blog originally appeared in abridged form in the July 23 issue of Lucid Privacy Bulletin, here. Five years, hundreds of ad industry engineering hours and millions of dollars spent testing Google Privacy Sandbox – all for nought? Perhaps not, but Google’s announcement they will not be nixing third-party cookies

The Tigers at the Gate: Moving Privacy Forward Through Proactive Transparency

US privacy regulators don’t want a cyberpunk future, let alone a grimdark one. They are genuinely trying to understand new technologies and ways of doing business online. A little proactive transparency and courage to cooperate goes a long way.

‘Know Your Customer’ Law Comes For Ad Data Licensors

While you were reading about the recent ‘TikTok sale’ law, you may have missed an accompanying ban on companies licensing data to ‘foreign adversaries’. Before you dismiss this new law as inapplicable, you might be surprised at the broad scope and potential inadvertent applicability to everyday data licensors, especially those

The Elephants in the Room: On Advertising Privacy and Competition

For an industry that over the years has benefitted from spotty enforcement and a relative ease of tracking and profiling users online, the CMA (and the ICO) refereeing Google's Chrome privacy changes represents a new normal.

CA ‘Delete Act’ and Inadvertent Brokers: 5 Key Takeaways

This blog was originally published here and has since been updated to include further observations. On February 9, 2024, I had the pleasure of participating in a panel at the California Lawyers Association (CLA) Privacy Summit with Delete Act Author Tom Kemp and Lothar Determan from Baker McKenzie to discuss

Cookies and Dark Patterns: UK ICO Warns Top Publishers of Coming Enforcement

Disclaimer: The information and examples provided here are for informational purposes only and are not meant as legal advice.  On 21 November 2023 the UK’s Information Commissioner’s Office (ICO) publicized that it had issued a final warning to Britain’s top websites about coming into compliance with the

White House to AI Companies: We're Watching Closely and Will Act

President Biden's landmark Executive Order concerning AI technologies sends a strong signal to Big AI Tech and federal agencies that fostering the technology's potential for the greater good… while mitigating its great potential harms is a key White House priority.    Wide-ranging motivators On the one hand,

2000s Called and Want Their Ad Farms Back

According to a recent programmatic advertising transparency study by the ANA nearly a quarter of all ad views are from websites made solely to sell ads. This is problematic for industry and users.

California’s ‘Delete Act’: The Loopholes Swallow The Law

[Disclaimer: The below contents are the personal opinion of the author, and should not be interpreted as legal advice.] California’s attempt to regulate data brokers through SB 362, aka the CA ‘Delete Act’,  is unlikely to have the effect of dramatically reducing third party marketing offers, at least the

Life in the Sandbox

If you work in digital advertising, then you will have heard the dramatic exclamations of “Cookie-geddon” and “Cookie-pocalypse,” both referring to Google’s plans to depreciate all third-party cookies in Chrome in the second half of 2024. The deprecation of the cookies on Chrome, and the development of Google'

Rejecting Harm: UK Regulators Crack Down on Design Dark Patterns

It might be expected that a joint announcement in the depths of August from the ‘UK's independent body set up to uphold information rights’ and the UK Government authority ‘set up to make markets work well for consumers, businesses and the economy’ might fly under the radar. And

Lucid releases China Personal Information Protection Law (PIPL) Readiness Record

China's Personal Information Protection Law (PIPL) is part of a complex legal framework aimed at safeguarding the personal information of Chinese citizens. Enacted on November 1, 2021, the PIPL reflects China's growing concern over data privacy and geopolitical issues, and shares many similarities with the EU

Unveiling Connections: A Comparative Analysis of EU GDPR and India’s DPDP

India’s Digital Personal Data Protection Act (DPDP) became law as of August 11, 2023 focusing on personal data management, consent, cross-border transfers, and establishing the Data Protection Board. While clearly inspired by the GDPR, India's DPDP Act deviates from the European model in a number of important

The Role of 'Authorized Agents' Under Key U.S. State Privacy Laws

A number of U.S. state privacy laws starting with the California Consumer Privacy Act (CCPA) permit third parties authorized by the consumer to submit privacy requests on behalf of the consumer. These third parties are often referred to as “authorized agents”, or AAs to be brief.  Navigating which state

Lucid releases EU-US Data Privacy Framework Readiness Record

On July 10, 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework (DPF), administered by the U.S.  Department of Commerce’s (DoC) International International Trade Administration (ITA). As of July 17, 2023 the DPF Program began accepting new participating businesses. To help you

AI Regulation: US, UK and other approaches

We continue our four-part deep dive into the future of AI regulation, by examining some contrasting regulatory approaches that are rapidly developing in other global jurisdictions, including the UK, the US, China and India.

TCF V2.2 offers panacea for publishers, if they want it

Over the last few weeks, the IAB Europe (IAB EU) have been running rather dry, but wholly necessary and informative webinars explaining what the changes within the Transparency Consent Framework Version 2.2 (TCFv2.2), due in September 2023, will mean for vendors, consent management platforms (CMPs) and publishers. Some

Through Orange Haze: Recapping IAB Tech Lab’s Summit in NYC

Earlier this month I had the pleasure of attending IAB Tech Lab’s IMPACT conference in midtown Manhattan. Digital advertising professionals gathered together to discuss pressing issues and learn from industry specialists, catch up with friends and clients, and fret about the Blade Runner-esque air conditions outside. The irony of

US Health Data Privacy Landscape and its Ripple Effect

In 2023, the privacy race has expanded to include healthcare data, with states like Washington, Connecticut, and Nevada introducing data-specific bills to protect consumers of wellness services beyond the traditional confines of America’s healthcare system. This is in parallel to states like Illinois’ interest in biometric data privacy, with

Journey to the West: China SCCs and the Transfer Impact Assessment (PIPIA)

As of 1st June 2023, data exports from China can (in some cases) be facilitated using SCCs and PIPIAs (Chinese TIAs). Lucid Privacy Group provides the details and a PIPIA template.

Artificial Intelligence, Regulation, Privacy

In this four-part deep dive into the future of AI regulation, Lucid Privacy Group explores the detail of the new approaches to AI regulation.

First Apple, Now Android to Devs: “Delete!”

It’s all too easy for us to download an app, speed through registration with our Google accounts, use the service for a month and then put it in the smartphone equivalent of a junk drawer. Rifling through on a whim, we may decide to throw the app away to,