The growing number of states implementing data privacy laws is giving digital consultants headaches and has the potential to increase legal fees for campaigns and groups going into 2024.
Colorado, Connecticut and Utah all have data privacy laws going into effect over the course of 2023. California in January implemented the California Privacy Rights Act (CPRA), which updated the California Consumer Privacy Act (CCPA), while Virginia brought online its own Consumer Data Protection Act (VCDPA).
Four other states have passed data privacy bills that’ll get implemented in the near future, according to the AAPC. This patchwork of regulation, which also includes Washington and Maryland’s campaign finance transparency laws, is raising the stakes for campaigns and groups who have the potential to incur financial penalties — and potential political fallout — if they’re not following the new regulations.
The question is, with these online regulations crossing so many silos on a campaign, who’s responsible for keeping the candidate or group in compliance?
“The GCs, [those] executive director level, usually lean on their in-house digital person to be the expert on this,” said Ashley O’Rourke, director of analytics and audience insights at Majority Strategies. “But that’s not necessarily their expertise, so they lean on us: do you guys have existing language? We say, ‘We can give you a template, but you have to consult your own attorney for legal reasons.’”
O’Rourke added: “There are really two things that are evolving. It’s these data privacy laws that are changing. But then also the platforms are responding to those changes.”
She recalled working for clients in Washington state last year on state and local races where they couldn’t run ads through Meta or Alphabet. The firm adapted its strategy, she explained: “Focus on the audience first, then we can talk to them on the various platforms that are still allowed.”
But even the attorneys can get confused by these laws, according to Paul Westcott, an EVP at data vendor L2. He recalled seeking guidance from Perkins Coie LLP after California first passed the CCPA five years ago.
“Our attorneys, they looked at it and they said, ‘Well, we don’t know exactly how to interpret this initially’ — and they had people on staff who helped draft it,” Westcott said May 4 at C&E’s CampaignTech East conference. “You’re wondering who the heck does understand it? Lawyers are obviously doing very well with this.”
While Westcott encourages clients to get legal advice to navigate the laws, he also believes that vendors have a role to play.
“You want to work with providers that you can trust, that you can verify they’re doing all the right things. Look at the language that they have in their privacy policy,” he said. “Because working with those kinds of vendors, you’re going to make sure that they’re going to be removing people who have requested to be removed.”
Mike Adams of National Media Insights said he’s already getting questions from clients about these laws and does feel responsible for helping them navigate the landscape.
“Our clients are looking to us to be the experts of everything on their campaign,” he said. “That’s not always possible, but it’s incumbent on all of us to be responsible as far as keeping up with the latest evolution of laws being passed as it applies to what we’re doing.”
Henri Makembe, CEO of Do Big Things, believes lawyers can help political marketers use the right entity to get their messages out in states with online privacy laws.
“What we’re seeing is, yes, you can’t do something on the [candidate] side, you can’t do something on the IE side, but you can do something on the C3 side with the right words and the right variables,” Makembe said. “It’s not just being creative about the law, but the entities doing the advertising and telling the story and driving the action.”
