**Jonathan:** Hey, Alyssa.
**Alysa:** Hey.
**Jonathan:** So you were at IAB ALM this week. Can you give us a rundown?
**Alysa:** I was. So for those who do not know, it's their annual leadership meeting where all things relevant to the digital advertising industry are presented in a variety of ways. And it was — I mean, it was really good. I like to hear what the business community is saying. I usually talk with lawyers and privacy practitioners, so to hear where the marketers are really focusing this year, I thought it was absolutely interesting and helpful. You wouldn't be shocked. Measurement is still such a big factor. Social media, advertising within social media, influencers. Of course, my brain is going thinking of all the privacy issues that are particular to the different channels. So that was really interesting. Dave Cohen released a report that I thought was fascinating. That was a study with consumers on perspectives around privacy. And there are a lot of interesting data points that I think are worth having a look at by any privacy practitioner, particularly those who are trying to support their budgets for more compliance resources. I think not just doing things because compliance requires you to do them, but really consumer attitudes towards privacy and how they look at a company depending on their privacy posture — as these laws have been on the books now for several years, consumers have a view on a company's posture. And so I think that was pretty notable.
**Jonathan:** What were some of those highlights of what consumers think?
**Alysa:** Well, I think we're in an opt out state in the US, but for sensitive data, you need consent. And that can actually be a very positive experience where a consumer wants to provide consent. I think marketers are really afraid of ever having to be in the bucket where they have to get consent because you think of cookie banners and opt in rates, not super great. But what was the value proposition to the consumer? And so some of the survey really got into just-in-time and context can matter to the consumer and build trust, and not sound like they're having a conversation with a lawyer. So I thought there's some things to work with there. I thought the awareness that their data is collected when they're online, and that's part of what a free internet is — there was more awareness than I think regulators give consumers credit for. And the kinds of things that the consumers were really actually concerned about — identity theft and government surveillance of them — as opposed to interest based advertising was much lower down on the list as something that was concerning. So all in all, it's worth reading.
**Jonathan:** I got you on the harms. Like, one of the things I thought interesting about the Texas AG lawsuit against Allstate was it pointed to a more direct harm to consumers from their point of view because it wasn't just you got a targeted ad you weren't supposed to. It was, well, this raises my premiums. And where'd you get the data from? It was from my car, it's from my phone. And it's like, maybe they understood it at some level, but it just made it super clear. Now I'm sort of broadening the concept of harms. Right. And how bad that can be for your brand if you have a privacy issue that hits the front pages that really looks like you are causing consumers harm, whether you're charging them more in a way that's using their data. And so I think as companies look at their compliance and prioritize what they're doing, what would it look like if there was a front page headline about x y z business practice and how can certain privacy measures really mitigate the risk for that? Maybe it was ordinary course of business. We've always done this. And now it's like, well, the game's changed a little bit with all this.
**Alysa:** Yes. I think that's one of the biggest issues — it's a cultural shift, and you have privacy lawyers trying to educate business folks who are setting revenue projections. And they've got a very customized way that they do things, and it cannot be the case that they have to do something markedly different. And those are so many conversations I think lots of people are having right now. Yes. That was before. We are now in a new world, and we have to take that into account or we could be a target and then we'd have to answer for that.
**Jonathan:** Yeah. And can consumers set a date for when they're gonna rise up, or is it just a gradual — so what else did you find at IAB?
**Alysa:** So there was an enforcement panel, which I found really, really interesting, with the head of CPPA's enforcement where we talked about different priorities. And I think some of the things that I'm on the lookout for — obviously, data brokers. We've seen so much enforcement of that, so that will continue to be a hot topic on whether data brokers have in fact registered under California's law. We've talked in the past about that expanded definition. So I think that's a really important area. He emphasized, yes, they are enforcing complaints that they get about consumers not having their rights honored in the way that the law requires. And I've now heard him reference this three different times at different conferences on deletion. And, well, I think a lot of people have heard that. If you imagine that you were the recipient of a subpoena and it said, tell me — show me how your policies and procedures address when you get this consumer rights request in. What are the steps from a to z that you do in compliance with the law to address that deletion request? And I think a lot of companies, a, don't memorialize what the steps are. They may have a process, but nothing written up on it. But, b, I don't know that everybody has a perfect story to tell on that front, and I would approach it as if you had to answer or will have to answer to a regulator. What is your story? Do you feel like it is comprehensive? If not, they are telegraphing that you should focus on that issue.
**Jonathan:** You know, what I've caught from you is it needs to be practical. It should be practical. So it doesn't have to be perfect. Just have some kind of story about how you thought about harms and you've documented them and you're kinda doing the right thing.
**Alysa:** Exactly. Exactly. And for the privacy practitioner who says, lovely, I have a list of action items that is five feet high, and that is somewhere down there. And I will get to it, but I have to do all these other things. I hear you on that. What I would say is there's a top list of issues that are being enforced. And, yes, you're gonna make your way down your list, but think about where you are spending your time — there's the urgent and the important. And at least on what we've heard as important, do you have something that is reasonable in response to those things? On that front, we also heard about how Californians are affected by certain practices. And so vulnerable groups — are they affected in certain ways? And so thinking about your product and services, are there vulnerable groups that are affected in some ways? And think about your privacy compliance. Sensitive data was probably another thing. Right? If you think about potential harms that might motivate a regulator, that's gonna be an important issue to prioritize. And I think what I got out of the presentation was there's not only gonna be a lot of enforcement, but that the agency is looking for really focused enforcements on particular issues. So we've seen a lot of data broker enforcement headlines. I'm looking to see what other issues come up in the headlines. And so I anticipate we're gonna see more of those in the near term.
**Jonathan:** Gotcha. Thanks, Alysa. You know, I've always been a big fan of Commissioner Bedoya at the FTC, and I saw IAPP talking about ChatGPT and some of those images that he was talking about. But he's got a really great statement coming out of Rite Aid where he outlined the things you need to do to avoid bias, or else think about how you're assessing risk and testing and all that. So we will post that through here. I thought that was a really good summary. But thanks. Thanks for keeping us in the loop on what's going on.
**Alysa:** Absolutely. See you soon.
