Biden’s crackdown on sales of Americans’ data to China & Russia reverberates across adland

The administration hopes to strengthen national security by restricting large-scale transfers of personal data and limiting foreign entities’ ability to access certain classes of sensitive consumer data like geolocation, financial transactions, personal health records and other kinds of personally identifiable data.

In particular, the administration is concerned about the sharing of Americans’ data that could result in nefarious activities. “Bad actors can use this data to track Americans (including military service members), pry into their personal lives, and pass that data on to other data brokers and foreign intelligence services,” reads a fact sheet published by the White House today. “This data can enable intrusive surveillance, scams, blackmail, and other violations of privacy.”

The executive order represents the first-ever attempt of a US president to come down on the sharing and sale of US citizens’ data to third-parties.

Through the order, the US Department of Justice (DOJ) will take on a key role. It’s tasked with issuing new regulations to create protections for Americans’ information that falls in six categories of sensitive data: genomic data, biometric data, personal health data, geolocation data, financial data and certain kinds of personal identifiers.

The agency will be required to block the large-scale transfer of such data to organizations in the “countries of concern,” which the White House says “have a track record of collecting and misusing data on Americans.” While data brokerage transactions to “countries of concern” will be prohibited, the order also includes a handful of carve-outs for specific kinds of transactions – for payroll purposes within multinational US corporations, for example.

The DOJ will also put forth new regulations designed to protect sensitive government-related data.

Further, it will collaborate with the Department of Homeland Security to establish guardrails for curbing the countries’ access to Americans’ sensitive data through alternative commercial means, such as through employment contracts or via vendors or investors.

Officials acknowledged earlier today in a briefing with journalists, that the administration doesn’t want to undermine legitimate commercial uses of data sales and sharing.

“One of the things that you’ll hear repeatedly from the administration is that this is a very targeted, cautious approach,” says Cobun Zweifel-Keegan, the Washington, DC managing director of the International Association of Privacy Professionals (IAPP). “They’re being very proactive and engaging with stakeholders and thinking through how to properly tailor this idea so that it solves the problem that they’re looking to solve. [That problem has to do with] national security risks from ‘countries of concern’ that use … commercially acquired data to potentially target US persons in order to influence them, or blackmail them or engage in hacking operations.”

Much of the data about US consumers that is collected and traded is done by digital platforms and advertising organizations, who rely on user data to support a vast targeted ad ecosystem.

As such, experts say the executive order, which will be open to stakeholder comments before a draft regulation is drawn up, may have large-scale implications for the world of digital advertising.

In particular, platforms operated by companies in any of the order’s denoted countries could be impacted. “The precise parameters of the executive order will need to be specified – for instance, it’s not clear whether [the term] ‘personal identifiers’ [as spelled out in the order] applies to device identifiers – but these limitations will likely disproportionately impact popular apps published by Chinese developers such as Temu, Shein, TikTok and CapCut,” says Eric Seufert, analyst at mobile marketing firm Mobile Dev Memo.

While it’s unlikely that the data brokerage limits spelled out in the order will impede any given app’s “core use case,” Seufert says, it may well “make it harder for the mélange of data emitted by most consumer apps to be used in unexpected ways to trace users’ behaviors and physical locations.”

The IAPP’s Zweifel-Keegan says that while apps owned by foreign entities have come under scrutiny from policymakers in recent years due to their own role in collecting consumer data, it’s “possible that they are also purchasing that data.” At this point, before a draft rule has been issued, Zweifel-Keegan says “it’s unclear” whether the TikToks and Temus of the world will be forced to comply with new data buying rules.

And while apps like TikTok, Temu and CapCut – all owned by Chinese companies – may be top-of-mind in relation to the new executive order, the material impacts on the ecosystem could expand far beyond the limits of a handful of apps, says Arielle Garcia, advisor and privacy advocate, and former chief privacy officer at ad agency UM Worldwide.

“It’s important to understand the context,” she says. She suggests that the administration’s heightened concern over foreign data transactions may be informed by growing awareness of the digital ad industry’s role in augmenting national security issues.

“Biden's executive order immediately follows a book [release] by Byron Tau that speaks to how the adtech ecosystem and real-time bidding data enables surveillance at scale, domestically and abroad – after the release of reports by the Irish Council for Civil Liberties last year on similar topics,” Garcia explains. “So, while immediate impacts might be that advertisers could fear sanctions for uploading customer lists or using TikTok pixels, the real implications of this could be far broader, impacting the fabric of the real-time-bidding model, or requiring due diligence and monitoring of downstream data recipients and onward data sharing.”

As it stands, tech and advertising professionals will have to wait for the DOJ’s proposed rule to be made public and for the processing of public comments before they understand the full scope of the impact.

“As with all things privacy and digital policy, the impacts of the Biden executive order will come down to definitions, interpretation and ultimately, enforcement,” says Garcia. “The devil will be in the details.”

For more, sign up for The Drum’s daily newsletter here.