New House privacy proposal would curb data collection by Google and Facebook

Alphabet Inc.’s Google and Facebook Inc. would face limits on the online tracking and data sharing that power their advertising businesses under a bipartisan House proposal to establish the nation’s first federal privacy law.

The draft legislation from the House Energy & Commerce Committee, which oversees online privacy issues, could diminish companies’ ability to monitor users across the web and require them to get permission to share their customers’ data with others. It would also allow consumers to opt out of receiving advertising from companies with which they already have relationships.

The measure comes as giant technology companies are coming under pressure in Washington on multiple fronts, including antitrust scrutiny, outrage over their lack of control over content on their platforms and allegations that they are biased against conservative ideas.

If passed, the measure could become one of the biggest challenges to their crown jewels — in-depth knowledge about their users — and a test of whether their lobbying clout can fend off the threat.

The prohibitions could gum up the gears of the vast ad-technology machinery that Google and Facebook have built. Taken together, those new responsibilities and others would make the proposal stronger than a strict new California law, said Rep. Cathy McMorris Rodgers (R-Wash.), who helped develop the text.

Companies are moving to comply with the California statute, which goes into effect Jan. 1., but won’t be enforced until next July.

The limits in the proposal, which is the product of a year’s worth of discussion by lawmakers in both parties, could dent the profitability of practices that helped Google and Facebook establish their dominant position in the $330-billion digital ad market.

The companies not only monitor users on their own platforms, but also track consumers on millions of third-party sites. The practice often explains why people see ads for products they’ve looked at elsewhere, often within seconds.

The text of the House bill calls for requiring “express, affirmative consent” for such tracking, meaning that consumers can say no and block the companies’ ability to follow their online behavior and collect data on their interests and activities.

“Facebook knows every other site I go to, and Google knows every other app I use,” said Justin Brookman, director of consumer privacy and technology policy for Consumer Reports. “I think it’s appropriate to explicitly call that out.”

In addition, the proposal’s requirement that companies get consent to share data may limit brands’ ability to transfer information to Google and Facebook to buy advertising. That measure has similarities with a provision of California’s law, which will be enforced after July 1 under rules drafted by the state attorney general, Xavier Becerra.

Finally, the congressional bill would allow consumers to prevent brands from sending them advertisements even if they’ve already allowed the company to use their information for another reason — such as a mailing address when shopping online.

Depending on how these restrictions on first-party advertising are defined, they could also limit how Facebook and Google target users by using large stores of data they hold internally but don’t share with outside parties.

Google declined to comment on the House’s proposal. Facebook spokesman Andy Stone said the company looked forward to reviewing it.

The obligations in the text could also affect brands and companies in the digital advertising market beyond Facebook and Google, according to Stu Ingis, a lawyer who is advising Privacy for America, a coalition that counts several advertising industry trade groups as members.

Ingis welcomed the bill but said it would hurt small business and entrench larger players.

“On marketing and advertising, they just got it completely wrong,” said Ingis, who also chairs the law firm Venable LLP. He argues that marketing is the lifeblood of small businesses that are seeking new customers and media companies that want help paying for content — all of which would become harder if the draft becomes law.

The law may offer stepped-up consumer protections, but that doesn’t mean it will wipe out Google and Facebook’s advertising revenues. Europe’s privacy rule, known as the General Data Protection Regulation, requires companies to secure affirmative consent to use data, but some analyses say it has hurt small rivals more than Google and ultimately helped entrench its dominance because compliance is easier for big firms.

Facebook has extended the European protections worldwide, and both companies emphasize that they seek consent for their activities when users sign up for personalized services.

The House proposal would likely undergo significant changes before it becomes law. The committee staff has asked stakeholders to file comments by Jan. 24.

Despite the potential effect on advertising, industry groups haven’t taken a hard-line approach to the draft, particularly because it’s bipartisan and follows progress in the Senate.

“The internet industry is optimistic that Congress can reach a bipartisan solution to ensure all Americans have meaningful privacy protections and controls across industries and state lines,” said Michael Bloom, senior vice president for global government affairs at the Internet Assn., a lobbying group that counts Facebook and Google as members.

Business groups are hoping a federal law can overrule state statutes such as California’s, which give consumers the right to sue for some data breaches. Companies also want to avoid having to comply with a patchwork of state laws.

One privacy advocate panned the draft because it doesn’t give consumers the right to sue companies that fail to comply with the law.

“The staff discussion draft scores poorly when measured against the basic elements of a modern privacy law,” said Marc Rotenberg, president of the Washington-based Electronic Privacy Information Center. He also criticized it because it relies on the U.S. Federal Trade Commission for enforcement, rather than creating a new agency to regulate data practices, and it doesn’t create guardrails to address decisions made by algorithms.

With the impeachment of President Trump fueling a sharply divided political climate before the 2020 presidential election, many observers see the opportunities to pass a privacy law before 2021 narrowing.

Still, Rep. Jan Schakowsky (D-Ill.), chairwoman of the subcommittee that developed the draft, said that she has shared it with House Speaker Nancy Pelosi and that the goal is to finish a bill in 2020 despite political headwinds.

“We’ll move as quickly as we can,” she said in an interview Wednesday. Sen. Roger Wicker (R-Miss.), who is leading that chamber’s efforts, has also called privacy “a top priority” for next year.

“There is a consumer demand out there,” Schakowsky said. “And I think all the companies know it’s coming.”

— With assistance from Daniel Stoller and Rebecca Kern.