Congress Needs to Understand How Online Ads Work to Pass Data Privacy Legislation

When Facebook (now Meta) CEO Mark Zuckerberg appeared before Congress in 2018, many members appeared befuddled about the basics of the Internet economy. In one particularly memorable exchange, one senator asked Zuckerberg how exactly his company made money when users don’t pay for the service. “Senator, we run ads,” Zuckerberg replied, seemly bemused. Yet five years later, many in Congress still seem uncertain about the basics of how online ads work.

During a recent hearing on federal data privacy legislation, Rep. Jan Schakowsky (D-IL) complained that “Big Tech is collecting ever more information about us…They know our finances, where we are, where we live, where we’re going, and when you browse the web…[and] they sell the data to the highest bidder.” And Rep. Earl Carter (R-GA) remarked on his surprise when after searching online for a product, “all of a sudden, I started getting all these ads for this, and I thought, ‘how in the world?’” Indeed, their remarks are neither unexpected nor uncommon, especially given what members regularly hear from privacy advocates. Even at the hearing, one of the witnesses, Alexandra Reeves Givens, president and CEO of the Center for Democracy and Technology, stated “with every click and scroll, companies collect information about your activities, typically using, sharing or selling that information to make inferences about you or so you can be targeted with ads.” The implication of these statements (and similar ones) is that there is something inherently nefarious and harmful about the online ads consumers regularly encounter online—the same ads that pay for the vast amount of free content and services consumers use on the Internet.

One reason for this hostility to online ads is that many people do not understand how online advertising works. Many people likely assume that if they see an ad for a product they were just searching for, it must be because the company they were searching about sold their personal data to advertisers. But that’s not how it works.

Targeted online advertising allows companies to deliver ads to consumers who are more likely to be interested in their products and services. Some of this advertising is straightforward. For example, contextual ads show users ads based on specific keywords. A company selling fishing gear might pay for ads on webpages with information about boats. But some of this advertising is much more complex. Personalized ads target users based on characteristics such as their online behavior, physical location, or demographics. Behavioral targeting shows ads to users based on their online activity, such as past searches or browsing history. Location-based ads target users based on where they live or when they visit a specific location, such as a stadium or shopping center. Demographic targeting shows ads to users based on specific social categories like race, gender, income, or age. Some ad networks also allow advertisers to target ads to custom audiences, such as previous customers.

Ad networks collect data about users to enable these personalized ads, as well as to measure their efficacy, but they generally do not share personal information with advertisers. Many ad networks collect this information using cookies—small text files that are stored on a user's device when they visit a website. These cookies allow ad networks to track a user's browsing habits, such as the sites they visit and the searches they make. Ad networks use this information to build a profile of the user's interests, which they then use to deliver targeted ads.

But many consumers, as well as policymakers, do not understand these details. Instead, they incorrectly believe that companies are selling their personal data to advertisers. In reality, ad networks are delivering targeted ads to users based on their interests, but they are not selling this information to advertisers. Instead, ad networks are acting as a digital matchmaker, connecting advertisers, publishers, and users. Indeed, ad networks are mostly collecting information that is not personally identifiable. In other words, they do not know the identity of the person behind the profile. They only know that a user with certain interests has visited a website. This is a crucial distinction because it means that these websites are not selling personal data to advertisers, as is often assumed.

Another reason for the confusion is that some people do not understand the distinction between online ad platforms and data brokers. Indeed, Rep. McMorris Rodgers repeatedly referred to “data brokers and Big Tech” in her opening remarks, conflating the two. But ad networks are not the same as data brokers. Data brokers are companies that collect personal data from a variety of sources, such as retail loyalty programs, credit card companies, and public records. They then sell this information to other companies, including advertisers who purchase this information for direct marketing, such as direct mailings or email marketing. Data brokers have also had some major data breaches, such as Equifax involving 163 million people in 2017 and Exactis involving 340 million people in 2018. When people hear about these data breaches, they may assume that advertisers have sold their personal data without their knowledge or consent.

While some people may not like what data brokers do, buying and selling consumer data for marketing purposes is a long-standing business practice that predates the Internet. Indeed, politicians and political organizations are some of the biggest clients of data brokers, as they regularly buy data about voters for their campaigns. Many of these uses are legitimate, especially when they involve public information, and help businesses reach new customers. Nevertheless, additional transparency and accountability would help address concerns about how data brokers use consumer data. Federal data privacy legislation, which ITIF has called for, would create a baseline set of consumer rights for how data brokers, advertisers, and many others organizations, collect and use personal data. This legislation should preempt state laws, ensure reliable enforcement, streamline regulation, and minimize the impact on innovation.

As Congress continues to debate federal data privacy legislation, it is important that it understands how online advertising works, so as not to unintentionally harm the Internet ecosystem. In its current state, it benefits all parties. Consumers see ads for products and services that are relevant to them, which can make their online experience more efficient and enjoyable. Businesses can launch effective advertising campaigns, so they can reach people who are more likely to be interested in their offerings. And publishers, large and small, receive the revenue they need to pay for the content, apps, and services that Internet users want, but do not necessarily want to pay for.