17 Jan 2026 Search

Previously: there ought to be a law

Privacy bills are hard. But there’s a cheat code.

The path to making a practical, enforceable state privacy law starts with understanding how most large-scale privacy harms are downstream of some scheme to extract money from advertisers or content creators. And just as Big Tech’s schemes to take advantage of legit businesses end up violating user privacy as a side effect, limiting those schemes and protecting legit businesses will protect user privacy as a side effect.

A good privacy law will act like a tax cut, by lowering the two taxes that Big Tech puts on the Internet now: Good ads in bad contexts, and bad ads in good contexts.

good ads in bad contexts: The big reason that Big Tech companies are violating people’s privacy using cross-context tracking is in order to commodify ad-supported content. They’re mostly not surveilling you because they want to surveil you in particular, they’re surveilling you so that they can follow you from an expensive context (such as a site, page, or channel) to a cheaper one. They want to pay a little for stuff like Shrimp Jesus images and other AI slop, instead of supporting more accurate, expensive content such as air purifier reviews, news from Ukraine, or the latest detailed info about Linux development. The idea behind cross-context tracking is to keep paying less for content while charging the advertisers more, and profit from the difference. A legit advertiser, of course, tends to want the opposite—for their ad to appear on some content that their intended customers trust, and where it doesn’t just protect their brand’s reputation but also works better. For example, a Teads Study More on the halo effect, with links found that trusted news sites increased ad attention by 20%.

bad ads in good contexts: Search and social media ads are based on an internal auction, where advertisers bid for impressions (opportunities to put one ad in front of one person). The more bidders, the more that all advertisers pay. So Google and Meta adjust their ad policies to allow more fraudulent advertisers,

For example, Google has adjusted their Trademark Policy to allow one advertiser to copy another’s trademark, unless the trademark holder somehow manages to identify and report the infringement. But the ads are personalized to the user and customized to the search query, so good luck spotting an ad that delivers malware to a specific group of people, such as customers or employees of a particular company. And even if you do report the trademark infringer, and even if Google does kick them off, good luck spotting their new account that they probably already have warmed up. Google’s scheme to extract more money from advertisers results in privacy harms to users at massive scale. It’s bad enough that the FBI’s public service announcement Cyber Criminals Impersonating Employee Self-Service Websites to Steal Victim Information and Funds warns people, Type the business’s URL directly into an internet browser address bar to access the official website instead of searching for it in a search engine, and Use an ad blocking extension when performing internet searches.

The Meta scam ads work similarly. According to the news, scam ads account for 10% of Meta’s revenue—but that’s an understatement. Scam ads don’t just contribute what the scammers pay directly. The presence of extra scam bidders drives up the ad rates for the other advertisers.

Shared interests of legit advertisers, publishers, and shoppers

Big Tech wants to simplify the privacy debate into “users” versus “business” and get themselves in on the “business” side. But that’s the wrong way to look at it. The real two sides are

  • Big Tech + scammers + crappy, deceptive content

  • Legit businesses + content creators + customers

So part of building an effective set of state privacy laws is figuring out how to build on that natural alignment between shoppers who want trustworthy products, and legitimate businesses that want customers. It’s basic accounting: for every sale made by some legit business, some customer is buying a legit product.

Check My Ads has a Policy Platform which is a good start. But some of the items on there are good examples of legislating in the rear-view mirror. They assume a competitive Lumascape of DSPs, SSPs, and all the other adtech alphabet soup, while in reality, Google admits that “open web” advertising is in “rapid decline” as ad budgets move to YouTube and other Big Tech-controlled contexts. Doing the whole Check My Ads list would be good, in the same way that banning junk faxes is good. It’s the right thing to do, but probably not the biggest impact for available legislature time.

For example Check My Ads suggests “Place Limits on Common Ownership” which doesn’t have a lot of impact as long as long as any one company controls both some advertising-related service and a major browser or mobile platform. If the advertiser-facing and publisher-facing adtech have to be in separate companies, which one will be profitable? The one that’s owned by the same company as the browser and phone OS. If you want to get a meaningful impact from splitting up a company, you have to split clients and servers which is a bigger job.

So considering the motivations and technical and policy decisions behind large-scale privacy harms on the current Internet, here’s a list of advertiser protections that would also help with privacy.

Owner/manager exclusion lists. Exclusion lists are a game that’s rigged against advertisers. Since the platform wins by putting the most lucrative possible ad into the worst possible context, they deliberately limit the exclusion list functionality to work just one context (domain, page, or channel) at a time. Which means that an operator of a problem context can just start up a new one as soon as they get on too many exclusion lists. An advertiser protection law should require exclusion lists to work not just by context, but also by context owner, manager, or owner/manager of landing page domains.

Advertiser terms should not disallow independent research. Platforms want their schemes to be as hard to understand as possible (How external researchers struggle to understand the ‘black box’ of Facebook). A relatively simple step for state laws would be to make sure that advertisers are not blocked by the terms of service from cooperating with independent researchers. Any advertiser contract that attempts to restrict research into advertising practices should be considered unconscionable, not in the public interest, and not enforceable.

Mandatory notification to advertisers whose ads appeared on content that was later demonetized or removed. It is in the public interest for legitimate businesses to be able to understand risks to their reputations from appearing in problematic contexts. When any content is demonetized or removed from a platform, notify all the advertisers whose ads appeared on that content and include either (1) a copy of the content if it is legal to make a copy or (2) an accurate description and summary of the content if the content itself cannot legally be redistributed (such as when an ad appears on CSAM or on personal info used without consent). In cases where ads and content appear in a single stream or feed, use existing industry “viewability” standards to identify which advertisers were affected.

Crawlable, searchable ad libraries. Any large platform that allows user-uploaded or AI-generated advertising must be required to make all ads available online, with no restrictions on crawling by independent firms (such as image search services or brand protection services). Ads should be available on the ad library before being served to users.

Ad libraries are complicated software, so the law needs to be general, and require something like what a reasonable trademark owner would expect in order to locate infringing ads, and then set up a private right of action in case of deceptive design features. People at the platform companies know perfectly well how to make an ad library either like today’s scam-friendly ones, or a more useful one that hides problems less well, but they need an incentive to cut out the shenanigans and do the latter. (icymi: Meta created ‘playbook’ to fend off pressure to crack down on scammers, documents show by Jeff Horwitz)

Some basic library features would include:

  • Show, and allow searching by, owners, managers, landing page domains, and intermediary companies connected to an ad.

  • Link to all accounts running the same or substantially similar ads.

  • Index all ad copy (including OCR)

  • Search for images containing a logo or other brand asset

  • Search for people’s faces, at least as capable as existing non-ad features for searching for photos in which a person appears.

State-licensed firms in the gambling and alcohol businesses should be required to disclose targeting. Ad algorithms can be used to take advantage of those who seek to avoid alcohol or gambling. As part of the license renewal process, any alcohol or gambling firm licensed by the state must disclose ad targeting criteria and algorithms used. (Targeting must not be designed to reach any consumers who have chosen to avoid or limit alcohol or gambling advertising. If a company uses over-complicated “AI” targeting that the licensing board doesn’t understand, no license renewal.)

This one is a little outside the privacy silo—but if Big Tech is going to tie and cross-market their stuff, the various departments of state government need to act together too.

Require privacy tools and settings on computers and Internet-capable devices purchased by the state. Most desktop and laptop computers can be set up for reasonable privacy protections, but don’t come that way out of the box. States could require

on their IT purchases. More: new browser buying rules for states?

Postal process for “right to know.” Companies often make “right to know” processes unnecessarily complex in order to discourage consumers from attempting to receive their information. A Business Reply Mail based process for verifying consumer information is a helpful backup to encourage companies to make online RtKs work effectively. (Also remove toll-free telephone numbers from RtK requirements. Save everyone some time.)

Making “right to know” (RtK) practical is not just a user privacy thing. It enables advertisers to spot data brokers who are making false promises or using data they don’t have a right to. Effective right to know is critical to make all the other privacy laws work, and advertisers using it will be another check on the data broker business and the Big Tech companies.

Funding for research on the economic impact of surveillance advertising. Much of the policy debate on surveillance advertising is informed by industry-funded research by groups that either (1) choose not to address policy-relevant questions (2) fail to cite some of the most relevant research in the field and (3) fail to include some policy-relevant findings in the research they do cite. State privacy bills should include funding for university and NGO research, especially behavioral economics research, to better inform the debate on future privacy bills. (Much research that is relevant to surveillance advertising policy is in paywalled, non-Open-Access advertising and marketing journals and books—funding a literature review would be a powerful way to help reset assumptions.) Research funded under this bill should be available under open access terms.

The other interesting part about restricting surveillance advertising as an economic cheat code is: when do the better results for consumers and businesses show up in the official economic stats and in people’s feelings about the economy? Properly timed, a crackdown on fraud and surveillance could juice the economy enough to affect an election. Maybe state politicians have some good ideas on how to time it.

More: fix liability and ad libraries: anti-fraud policy ideas from Canada