The NAI

🇺🇸 The center of gravity in U.S. privacy regulation has shifted decisively to the states. Here's what that means: With 20+ comprehensive state privacy laws now on the books and enforcement at unprecedented levels, treating privacy as a one-time compliance exercise is over. A few developments demanding attention: → California is launching its Delete Request and Opt-Out Platform (DROP), with significant per-violation penalties for noncompliance — and a reformed funding model where enforcement revenue replenishes the agency's budget. The CPPA has indicated it's pursuing hundreds of open investigations. → Texas has emerged as an aggressive enforcement jurisdiction, with privacy-related settlements exceeding $1 billion in 2025. → Multi-state coordinated enforcement — particularly around GPC compliance — became a defining trend, with bipartisan coalitions of state AGs running joint sweeps. Until Congress reaches consensus on a uniform national law, state-driven regulation will keep driving the compliance landscape. Helping members navigate exactly this patchwork is what our program is built for. ↓ Find out more in the comments. ↓ #DataPrivacy #PrivacyLaw #Enforcement #AdTech #CCPA

In healthcare advertising, "move fast" and "protect patient privacy" are too often framed as opposing goals. Our latest conversation with Andrew Lucking from PurpleLab makes the case that they're built on the same foundation. A few takeaways worth sitting with: → Healthcare advertising, done right, is a patient-driven force for better outcomes. The work is advocating for its benefits while taking privacy concerns seriously. → Speed and compliance are a product of the architecture you build up front. Get the internal standards, integrations, and privacy-enhancing technologies right, and fast, rigorous analytics becomes the default. → The technical backbone matters. PurpleLab runs a data warehouse of billions of healthcare claims behind an "always-on" expert certification layer — software that enforces data minimization and checks reidentification risk across every permutation. Clean rooms, deidentification, tokenization, and synonymization let partners collaborate safely inside a regulated ecosystem. This is exactly the kind of work industry standards and organizations like The NAI exist to support: raising the floor for everyone so responsible innovation and patient privacy advance together. 🎬 Watch the full video 👇 #HealthcareAdvertising #DataPrivacy #AdTech #PrivacyEnhancingTechnologies #NAI

Privacy-Enhancing Technologies are moving from theory to deployment. Use The NAI's Primer to keep up: Trusted execution environments. Multiparty computation. Differential privacy. Zero-knowledge proofs. PETs are no longer academic, they're being deployed to protect consumer privacy and proprietary data while still enabling effective, data-driven advertising. Our 2025 PETs Primer examines four key technologies and their practical advertising applications. It's also honest about the tradeoffs: PETs involve a balance between accuracy and utility, and they're not a substitute for a robust privacy program. But they can meaningfully complement existing data governance and compliance efforts. As adoption accelerates and regulators begin evaluating how PETs interact with consent and data minimization, this is a space worth understanding now. ↓ Find out more in the comments. ↓ #PETs #PrivacyTech #DataPrivacy #AdTech #Innovation

In 2025 we modernized our consumer privacy resources from the ground up. Here's what we updated. As privacy law evolved, we aligned our consumer-facing tools with our new Self-Regulatory Framework: → A user-friendly GPC browser extension that deploys opt-out preference signals across more than a dozen states, built for usability and legal consistency → Step-by-step instructions for exercising privacy choices directly with NAI members — and across browsers, mobile devices, connected TVs, and streaming devices → A new Consumer Choice Task Force developing best practices for opt-out preference signals and universal opt-out mechanisms → Retirement of our legacy cookie- and email-based opt-out tools, with continued opt-out access through the DAA's AdChoices tools Good privacy practice isn't a cost center. It's the foundation for long-term trust. #GPC #ConsumerPrivacy #DataPrivacy #AdTech

📋 HIPAA says your data is de-identified. State privacy law says it's still personal data requiring consent. Who's right? In the latest episode of our web series PurpleLab's General Counsel Andrew Lucking breaks down a gap that's tripping up healthcare marketers everywhere: privacy regulations and healthcare marketing technology are operating from two different rulebooks. Here's the tension: → HIPAA's expert determination standard asks you to assess reidentification risk based on the specific dataset, recipient, and use case → State privacy laws start from a personal data consent framework (opt-outs, sensitive data labeling) with little technical or operational standardization → The result: two frameworks that don't talk to each other, and a lot of ambiguity in between That ambiguity is exactly where NAI's five-factor analysis comes in, giving companies a way to navigate the space between "de-identified" and "consented" with some rigor. The stakes are real. Advertising use cases were not built with healthcare data in mind, and PurpleLab's whole mission depends on getting that line right. 🎬 Watch the full episode now: #Healthcare #AdTech #DataPrivacy #HIPAA #PrivacyFirst #NAI

🚸 The age threshold for heightened privacy protection is moving from 16 to 18. A growing trend we flagged across our privacy reviews: states are placing new restrictions on processing the personal data of consumers under 18 — not 16, the threshold used in earlier laws. Two examples that took effect October 1, 2025: → Maryland's Online Data Privacy Act prohibits targeted advertising to, or selling the data of, a consumer the controller knew or should have known is under 18 → Colorado's Children's Privacy Amendment bars knowingly processing minors' (under 18) data for targeted advertising, sale, or profiling without consent For ad-tech companies, this raises a practical question that reaches deep into the data supply chain: do your contracts with partners and data-source vendors address app-level data sources? Even if your business model doesn't include children's data, you need confidence that others in your ecosystem aren't sharing it with you. Worth reviewing your privacy disclosures and considering whether to raise your age threshold to 18 if you haven't already. ↓ Find out more in the comments. ↓ #ChildrensPrivacy #COPPA #DataPrivacy #AdTech

New guidance from the NAI: Key Do's & Don'ts for Using AI in Network Advertising 🔎 AI isn't new to adtech, but agentic systems that can access data, bid, and transact on their own are. So how should privacy and governance keep up as AI gains more authority to act? Our new guidance covers 9 areas—from disclosures and permissions to oversight, vendor contracting, and accountability—plus a one-page checklist of working questions like: Would we notice if an AI-built segment turned out to be a proxy for a health condition? The core principle: recommendations scale with a system's autonomy. The more authority an AI has, the stronger the case for testing, monitoring, and human oversight, because people remain accountable for the results. Link to full guidance document in comments! #AdTech #ResponsibleAI #PrivacyByDesign

🇺🇸 Two state laws quietly reshaped location-based advertising in 2025. Maryland and Oregon introduced strict limits on the sale of precise geolocation data — a real shift from the prior notice-and-choice model to categorical restrictions on how location data can be used and monetized. The operational fallout was immediate: → Some companies withdrew certain location-based services from these states entirely → Others kept operating but with reduced functionality → Capabilities like in-store visitation measurement became unavailable in some markets These developments are changes to core business models. Regulators are increasingly focused not on how data is described, but on whether it can still reveal precise or sensitive insights in practice. 📑 The NAI's Voluntary Enhanced Standards for precise location remain a model for filtering sensitive points of interest. ↓ Find out more in the comments. ↓ #Geolocation #LocationData #DataPrivacy #AdTech #SensitiveData