Understanding Privacy Laws When Advertising

First we should examine the types of data that can be recorded about a user, because not all of them are the same. Now the type of data is normally defined by the law, and how the law defines it can change from region to country. The below are general types that are most used:

De-identified Data

De-identified data is information that has been stripped of personal identifiers to the point where it can no longer be connected back to a specific person.

• Cannot be reasonably linked to an individual or device: The information cannot reasonably be used to infer information about, or be linked to, a specific person or a device associated with that person.
• Reasonable measures are taken: The entity holding the data (the "controller") must take reasonable steps to ensure the data cannot be associated with an individual.
• Public commitment to non-re-identification: The controller must publicly promise to handle the data only in its de-identified state and not attempt to re-identify it.
• Contractual obligations for recipients: Any third party that receives the data must be contractually bound to the same standards of not attempting to re-identify the data.

For example, let’s see you get a report that 27% of the people that engage with your ad are males, that data is de-identified because there is no way of linking that back to a specific user.

Personal Data

In simple terms, personal data is any information that is linked or can be reasonably linked to a specific person. This can be:

• Direct Identifiers: Name, address, social security number, passport number, etc.
• Online Identifiers: IP address, email address, device IDs, cookies, and other tracking technologies.
• Inferred Data: Information derived from other data points to create a profile about a person's preferences, behaviors, or characteristics.

Certain laws require the user to opt-in to collect personal data, while other laws auto opt-in the user but the user has the right to opt-out.

Sensitive Data

The final category is "sensitive data," which is a specific category of personal information that receives a higher level of protection, requiring your explicit "opt-in" consent before it can be processed. Here is a short and concise summary of what is considered sensitive data:

• Racial or ethnic origin
• Religious beliefs
• Mental or physical health condition or diagnosis
• Sex life or sexual orientation
• Citizenship or immigration status
• Genetic or biometric data used for the purpose of uniquely identifying you
• Personal data collected from a known child (under the age of 13)
• Precise geolocation data (your specific location within a radius of 1,750 feet)

Almost all laws require that the user explicitly give consent when utilizing sensitive data. 

Laws Currently Affecting Data Collection

There are laws already in place that place restrictions on the data that can be collected. Below are various examples that set both country-wide and state-specific laws. These are brief descriptions as covering the full laws are out of scope of this article and require a lot more analysis.