The past several years have witnessed consumer privacy become central to many discussions about marketing and advertising. The topic reached a fever pitch in 2024 as organizations began the year preparing for third-party cookie deprecation in Chrome (which never came) and ended the year adopting all kinds of new AI technologies. While discussions of privacy have become the norm, keeping compliance obligations and the privacy rights of users central to marketing and advertising strategy remains important. As the privacy environment evolves, here are six trends to be aware of heading into 2025.
Expect the increasing trend of private litigation under privacy laws to continue, now fueled by AI
In the United States, various laws with privacy obligations, such as California’s Invasion of Privacy Act and the Federal Video Privacy Protection Act, carry private rights of action. This means that private litigators can bring legal action against organizations for alleged violations, resulting in heavy operational burdens and legal costs even in the event of dismissal. 2024 saw a continued increase in these actions being brought. Expect this trend to continue in 2025 with more private law firms using generative AI to reduce their time and effort in creating the necessary legal briefs.
Meanwhile, in Europe, additional organizations such as the privacy watchdog NOYB are now qualified to bring collective redress actions for alleged GDPR violations. Similar to private rights of action, this qualification allows certified groups to bring collective action against organizations for alleged EU regulation violations, essentially democratizing the enforcement process. With more eyes on privacy compliance enforcement, the risk of mistakes being identified grows, growing the overall compliance risk faced by organizations. Ensure your privacy program is buttoned-up to reduce the risk of legal headaches in the new year.
Increase enforcement focus on secondary uses of data
Speaking of AI, every advertising technology on the market is seemingly introducing AI-powered functionality to improve business efficiencies and outcomes. All of these new features and platforms use collected consumer data. As organizations evaluate and adapt to the AI-driven future, it is important to remember that global privacy compliance obligations hold that personal data must only be processed (i.e. used) for purposes consistent with the purpose disclosed and consented to by users at the time of collection. Just because data is there does not mean that it can be used for any purpose. The end of 2024 already saw fines in Europe for improper secondary uses of data. In the United States, a past $150 million penalty to Twitter in 2022 for improper use of personal information for targeted advertising provides the same cautionary tale. It is critical to ensure that any new purpose for using consumer data has a lawful justification and basis for the new use case.
The rise of probabilistic identifiers in adtech will raise the stakes for personal data
Over the holidays, Google made news by announcing a change to their advertising platforms policies to begin allowing additional identifiers such as IP addresses for targeted advertising. The change drew a swift and stern rebuke from the UK’s Information Commissioner’s Office (the UK agency tasked with privacy enforcement) over concerns about users being “fingerprinted” and increasing privacy risks. Fingerprinting is the use of browser and operating system information, such as IP addresses, screen dimensions, and device information to create a unique identifier for the user. Much of this information is collected automatically by all adtech on a website. As more advertising platforms allow these identifiers for targeting, as well as alternative identifiers such as UID2.0 and RampIDs, more behavioral information for users across domains and devices becomes “personal” and is used for targeted advertising. It is important to ensure your organization’s usage of advertising technology aligns with user expectations and any information used for advertising is clearly disclosed to users.
A renewed focus on consent
In November 2024, the European Data Protection Board published updated guidance on the scope of the ePrivacy Directive, explicitly calling out tags/pixels as in scope. This clarifies that explicit consent is necessary for the execution of the scripts on websites responsible for any data collection from a user. Following the aforementioned Google announcement for the allowance of IP address and device fingerprints for advertising on their platforms, the UK ICO published similar guidance for their consent law (PECR). Beyond just Europe, many comprehensive state privacy laws in the United States that become enforceable in 2025 carry requirements to respect universal opt-out mechanisms such as Global Privacy Control. With a renewed focus from enforcement agencies on consent to the collection and usage of user information and usage of advertising technologies, expect a rise in scrutiny for how organizations are respecting the consent preferences of users.
A slow-down in United States Federal enforcement agency rule-making
A consistent challenge for organizations, especially those in healthcare, in 2024 was changes in enforcement rules being published for privacy compliance requirements. In the healthcare example, the U.S. Department of Health and Human Services published guidelines at the end of 2023 placing additional obligations for the collection and use of health-related information. The rules were struck down in court later in the year before eventually being rescinded.
In June of 2024, a significant Supreme Court decision struck down what was known as the Chevron doctrine. Essentially, this doctrine allowed federal agencies to issue their own interpretation of laws (rules and guidance) in instances where there was ambiguity. By striking down the doctrine, federal agencies in the United States have far less ability to issue their own rules for privacy enforcement in the absence of explicit authorization from Congress. While this will introduce a lot more legal uncertainty in 2025, for purposes of privacy, it can help simplify the understanding of privacy compliance obligations in the near term.
New state laws in the United States to address privacy
In the absence of federal guidance and rulemaking, however, an acceleration of state-specific privacy laws to address sensitive data collection and usage such as health information is likely to commence. Washington’s My Health My Data law, which restricts the collection of health-related information for non-HIPPA covered entities, is a great example of a state privacy law specific to certain types of personal information. Advertisers should expect more similar laws to be taken on at the state level in 2025.
In addition to industry-specific state laws to address sensitive information, 2025 will also usher in eight new comprehensive state privacy laws for enforcement. This means 16 states with enforceable privacy laws by the end of the year and three more to go into force on Jan. 1, 2026. Also expect the passage of additional comprehensive state privacy laws as the year begins with five states actively working on bills.
As the old axiom goes, the only constant is change. This is no different for the privacy landscape. For this reason, it is important to focus on the fundamentals and foundations of respecting consumer privacy rights. Start the year by evaluating your use cases for personal information usage in all marketing and advertising activities planned for the year. Review and ensure consent architectures are in place to lawfully collect and use the data and update user disclosures as necessary to support emerging business use cases. As always, respecting the privacy expectations of users is paramount for a privacy-centric advertising strategy.
