Key Insight

In the internet’s first two decades, information crossed borders freely. Now local, state, and national governments are creating a complex patchwork of regulation that assigns internet users (and their data) different rights in different places.

Why It Matters

Anyone producing content—marketers, advertising agencies, brands, news organizations and entertainment companies—will need to adapt to a fragmented landscape of laws and regulations.

Examples

The California Consumer Privacy Act (CCPA) went into effect in January 2020, giving Californians the power to stop businesses from selling their personal information and a GDPR-style right to have information deleted. Even though the first enforcement actions aren’t expected before April, businesses that serve Californians—even if they’re not based in California—were required to be compliant in January.

Vermont’s data broker regulation law went into effect on January 1, 2019. Washington State passed a law strengthening the definition of personally identifiable information in the state and shortening the window companies have to notify consumers and the state attorney general after a data breach. In New York, legislators passed the Stop Hacks and Improve Electronic Data Security Act to increase the types of personal information covered by the state’s data breach reporting law. The New York State Senate also considered the New York Privacy Act, a bill that would give companies a fiduciary responsibility to protect data—and establish a right for New Yorkers to sue for damages if their data was compromised.

New laws will give real meaning to the physical geography of where a user accesses the internet, and of where the companies involved are located. The CCPA, for example, protects California residents no matter where they are; the scope of other laws may be different.

What’s Next

CCPA and the other state laws on the horizon will impact ad targeting, but watch for major changes in any business that depends on knowing its consumers, like subscription marketing. Expect the debate about regulation of the internet (and its consequences) to continue. Bills that were defeated by lobbyists this past session may be back next year.

The Impact

Without coordinated effort, geographic differences in rights and expectations will continue to proliferate. This could change the economics and operating model for firms that serve customers across international borders (or even across state lines in the U.S.). Established tech platforms and multinational organizations will have the scale to account for that kind of regulatory complexity, but new entrants may find it hard to serve—and monetize—audiences in multiple jurisdictions.

Watchlist

European Union, Federal Communications Commission, tech platforms, news and entertainment media companies and lawmakers around the world.