[House Hearing, 115 Congress]
[From the U.S. Government Publishing Office]


            UNDERSTANDING THE DIGITAL ADVERTISING ECOSYSTEM

=======================================================================

                                HEARING

                               BEFORE THE

        SUBCOMMITTEE ON DIGITAL COMMERCE AND CONSUMER PROTECTION

                                 OF THE

                    COMMITTEE ON ENERGY AND COMMERCE
                        HOUSE OF REPRESENTATIVES

                     ONE HUNDRED FIFTEENTH CONGRESS

                             SECOND SESSION

                               __________

                             JUNE 14, 2018

                               __________

                           Serial No. 115-139
                           
                           
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]                          



      Printed for the use of the Committee on Energy and Commerce

                        energycommerce.house.gov


                              __________
                               

                    U.S. GOVERNMENT PUBLISHING OFFICE                    
34-638 PDF                  WASHINGTON : 2019                     
          
-----------------------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Publishing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).
E-mail, [email protected]. 






                    COMMITTEE ON ENERGY AND COMMERCE

                          GREG WALDEN, Oregon
                                 Chairman

JOE BARTON, Texas                    FRANK PALLONE, Jr., New Jersey
  Vice Chairman                        Ranking Member
FRED UPTON, Michigan                 BOBBY L. RUSH, Illinois
JOHN SHIMKUS, Illinois               ANNA G. ESHOO, California
MICHAEL C. BURGESS, Texas            ELIOT L. ENGEL, New York
MARSHA BLACKBURN, Tennessee          GENE GREEN, Texas
STEVE SCALISE, Louisiana             DIANA DeGETTE, Colorado
ROBERT E. LATTA, Ohio                MICHAEL F. DOYLE, Pennsylvania
CATHY McMORRIS RODGERS, Washington   JANICE D. SCHAKOWSKY, Illinois
GREGG HARPER, Mississippi            G.K. BUTTERFIELD, North Carolina
LEONARD LANCE, New Jersey            DORIS O. MATSUI, California
BRETT GUTHRIE, Kentucky              KATHY CASTOR, Florida
PETE OLSON, Texas                    JOHN P. SARBANES, Maryland
DAVID B. McKINLEY, West Virginia     JERRY McNERNEY, California
ADAM KINZINGER, Illinois             PETER WELCH, Vermont
H. MORGAN GRIFFITH, Virginia         BEN RAY LUJAN, New Mexico
GUS M. BILIRAKIS, Florida            PAUL TONKO, New York
BILL JOHNSON, Ohio                   YVETTE D. CLARKE, New York
BILLY LONG, Missouri                 DAVID LOEBSACK, Iowa
LARRY BUCSHON, Indiana               KURT SCHRADER, Oregon
BILL FLORES, Texas                   JOSEPH P. KENNEDY, III, 
SUSAN W. BROOKS, Indiana             Massachusetts
MARKWAYNE MULLIN, Oklahoma           TONY CARDENAS, California
RICHARD HUDSON, North Carolina       RAUL RUIZ, California
CHRIS COLLINS, New York              SCOTT H. PETERS, California
KEVIN CRAMER, North Dakota           DEBBIE DINGELL, Michigan
TIM WALBERG, Michigan
MIMI WALTERS, California
RYAN A. COSTELLO, Pennsylvania
EARL L. ``BUDDY'' CARTER, Georgia
JEFF DUNCAN, South Carolina

                                 ______

        Subcommittee on Digital Commerce and Consumer Protection

                         ROBERT E. LATTA, Ohio
                                 Chairman
ADAM KINZINGER, Illinois             JANICE D. SCHAKOWSKY, Illinois
  Vice Chairman                        Ranking Member
FRED UPTON, Michigan                 BEN RAY LUJAN, New Mexico
MICHAEL C. BURGESS, Texas            YVETTE D. CLARKE, New York
LEONARD LANCE, New Jersey            TONY CARDENAS, California
BRETT GUTHRIE, Kentucky              DEBBIE DINGELL, Michigan
DAVID B. McKINLEY, West Virgina      DORIS O. MATSUI, California
ADAM KINZINGER, Illinois             PETER WELCH, Vermont
GUS M. BILIRAKIS, Florida            JOSEPH P. KENNEDY, III, 
LARRY BUCSHON, Indiana                   Massachusetts
MARKWAYNE MULLIN, Oklahoma           GENE GREEN, Texas
MIMI WALTERS, California             FRANK PALLONE, Jr., New Jersey (ex 
RYAN A. COSTELLO, Pennsylvania           officio)
JEFF DUNCAN, South Carolina
GREG WALDEN, Oregon (ex officio)

                                  (ii)
                             
                             
                             C O N T E N T S

                              ----------                              
                                                                   Page
Hon. Robert E. Latta, a Representative in Congress from the State 
  of Ohio, opening statement.....................................     1
    Prepared statement...........................................     3
Hon. Janice D. Schakowsky, a Representative in Congress from the 
  State of Illinois, opening statement...........................     4
Hon. Frank Pallone, Jr., a Representative in Congress from the 
  State of New Jersey, opening statement.........................     5
    Prepared statement...........................................     7

                               Witnesses

Rachel Glasser, Chief Privacy Officer, Wunderman.................     8
    Prepared statement...........................................    11
    Answers to submitted questions...............................   104
Mike Zaneis, President and Chief Executive Officer, Trustworthy 
  Accountability Group...........................................    20
    Prepared statement...........................................    22
    Answers to submitted questions \1\...........................   113
Justin Brookman, Director, Privacy and Technology Policy, 
  Consumers Union................................................    34
    Prepared statement...........................................    36
    Answers to submitted questions...............................   116
J. Howard Beales III, Ph.D., Professor of Strategic Management 
  and Public Policy, George Washington School of Business........    50
    Prepared statement...........................................    52
    Answers to submitted questions...............................   132

                           Submitted Material

Report of Oxford BioChronometrics, ``Quantifying Online 
  Advertising Fraud: Ad-Click Bots vs Humans,'' January 2015, by 
  Adrian Neal and Sander Kouwenhoven, submitted by Mr. Latta.....    87
Report of Oxford BioChronometrics, ``Ad Fraud Summary,'' June 
  2018, submitted by Mr. Latta...................................    95
Report of IAB, ``Economic Value of the Advertising-Supported 
  Internet Ecosystem,'' January 2017, by John Deighton, et al., 
  \2\ submitted by Mr. Latta
Slide presentation, ``The Rise of the 21st Century Brand 
  Economy,'' IAB Annual Leadership Meeting, February 12, 2018, 
  \2\ submitted by Mr. Latta
Blog post of June 14, 2018, ``Voluntary Advertising Initiative 
  May Hold a Key to a Responsible Internet,'' by Neil Fried, 
  Motion Picture Association of America, submitted by Mr. Latta..   101

----------
\1\ Mr. Zaneis did not answer submitted questions for the record 
  by the time of printing.
\2\ The information has been retained in committee files and also 
  is available at  https://docs.house.gov/Committee/Calendar/
  ByEvent.aspx?EventID=
  108413.

 
            UNDERSTANDING THE DIGITAL ADVERTISING ECOSYSTEM

                              ----------                              


                        THURSDAY, JUNE 14, 2018

                  House of Representatives,
     Subcommittee on Digital Commerce and Consumer 
                                        Protection,
                          Committee on Energy and Commerce,
                                                    Washington, DC.
    The subcommittee met, pursuant to call, at 10:16 a.m., in 
room 2322, Rayburn House Office Building, Hon. Robert Latta 
(chairman of the subcommittee) presiding.
    Members present: Representatives Latta, Kinzinger, Burgess, 
Upton, Lance, Guthrie, Bilirakis, Bucshon, Walters, Costello, 
Schakowsky, Cardenas, Dingell, Matsui, Welch, Kennedy, Green, 
and Pallone (ex officio).
    Staff present: Melissa Froelich, Chief Counsel, Digital 
Commerce and Consumer Protection; Adam Fromm, Director of 
Outreach and Coalitions; Ali Fulling, Legislative Clerk, 
Oversight and Investigations, Digital Commerce and Consumer 
Protection; Elena Hernandez, Press Secretary; Paul Jackson, 
Professional Staff Member, Digital Commerce and Consumer 
Protection; Bijan Koohmaraie, Counsel, Digital Commerce and 
Consumer Protection; Mark Ratner, Policy Coordinator; Austin 
Stonebraker, Press Assistant; Greg Zerzan, Counsel, Digital 
Commerce and Consumer Protection; Michelle Ash, Minority Chief 
Counsel, Digital Commerce and Consumer Protection; Jeff 
Carroll, Minority Staff Director; Lisa Goldman, Minority 
Counsel; Carolyn Hann, Minority FTC Detailee; Caroline Paris-
Behr, Minority Policy Analyst; and C.J. Young, Minority Press 
Secretary.
    Mr. Latta. Well, good morning, and welcome to the 
Subcommittee on Digital Commerce and Consumer Protection. We 
really appreciate you all being here, and we look forward today 
to your testimony.
    And at this time, I'll recognize myself for 5 minutes for 
an opening statement. And again, good morning and I wanted to 
again thank our witnesses for being with us today.

OPENING STATEMENT OF HON. ROBERT E. LATTA, A REPRESENTATIVE IN 
                CONGRESS FROM THE STATE OF OHIO

    An advertisement used to mean a quarter-page section in 
your local newspaper, a billboard along the highway, or as our 
chairman of the full committee would know in his radio days, a 
radio spot during the rush-hour commute.
    While those types of advertisements still exist, targeted 
digital advertising has begun to dominate the advertising and 
marketing industry.
    The digital advertising ecosystem is complex and often 
misunderstood. Today, we hope to clear up some of this 
confusion for consumers and discuss both the benefits and 
emerging, often high-profile, challenges of online advertising.
    Our expert panel of witnesses will explain how this 
technology works and its place in our economy and our lives.
    According to the Interactive Advertising Bureau, the ad-
supported internet ecosystem generated over $1 trillion for the 
U.S. economy in 2016 and was responsible for 10.4 million jobs 
with 44 percent of those jobs employed by small and medium 
businesses.
    The massive growth of online advertising's contribution to 
GDP can be tied to improved data collection and subsequent ad 
targeting. Digital ads are dependent on consumer-related 
information and data, and many of the largest companies in the 
world--Facebook, Google, and the like--are supported by revenue 
generated from the collection of this data for the use of 
targeted ads.
    While these companies clearly have dominance in this space, 
many of the benefits of this data collection trickle down to 
small businesses and create a more tailored online experience 
for consumers.
    For example, a local greenhouse can use their limited time 
and resources to advertise in the most effective way for less 
cost by using targeted ads. Instead of publishing an imprecise 
catch-all ad in the newspaper, they can purchase ad space on 
websites dedicated to gardening or set up a geolocation range 
for IP addresses in driving distance in their greenhouse.
    This ensures that their ad is reaching their most likely 
group of customers--avid gardeners who live within 10 miles of 
the greenhouse. In the same transaction, the gardeners benefit 
from knowing what promotions and deals are available in their 
home area.
    To some consumers, these practices can feel like an 
invasion of privacy, or leave them wondering how much personal 
information about them is being sold. As this subcommittee 
continues to grapple with the many privacy issues and data 
breaches of the past few years, we are no stranger to the risks 
of collecting such detailed consumer profiles and amassing it 
in centralized data repositories susceptible to bad actors.
    This hearing is yet another opportunity to discuss these 
risks and understand what those are in the private sector--and 
what those are in the private sector are doing to address them.
    Additionally, ads are only effective if they're reaching 
actual people. Digital ad fraud and the scourge of traffic 
bots, algorithms designed to look like actual humans, 
complicate this system in new ways, and undermine the trust in 
the current advertising model.
    Businesses who think they are paying for ad space because 
of high audience interest might not get the response they want 
because of bots. One study found that 22 percent of desktop 
video ads were viewed only by bots.
    The online advertising ecosystem has many players that 
contribute to its effectiveness. Understanding how each of 
these players interact with each other and with consumers is an 
important step in discussing larger issues like privacy and 
data security.
    As always, it is one of the primary goals of the Energy and 
Commerce Committee to ensure that consumers are informed and 
can make educated decisions about their online habits.
    The advertising-based model supports the platforms that we 
use to communicate, connect, shop, and work. Today, we hope to 
hear of the many efforts undertaken by industry to innovate and 
grow in this space, while at the same time responding to 
consumer demands for privacy and security of their data.
    [The prepared statement of Mr. Latta follows:]

               Prepared statement of Hon. Robert E. Latta

    Good morning and thank you to all our witnesses for joining 
us today. An advertisement used to mean a quarter page section 
in your local newspaper, a billboard along the highway, or as 
our chairman of the full committee would know, a radio spot 
during the rush-hour commute. While those types of 
advertisements still exist, targeted digital advertising has 
begun to dominate the advertising and marketing industry.
    The digital advertising ecosystem is complex and often 
misunderstood. Today, we hope to clear up some of that 
confusion for consumers and discuss both the benefits and 
emerging, often high profile, challenges of online advertising. 
Our expert panel of witnesses will explain how this technology 
works, and its place in our economy and our lives.
    According to the Interactive Advertising Bureau, the ad-
supported internet ecosystem generated over $1 trillion for the 
U.S. economy in 2016 and was responsible for 10.4 million jobs 
with 44 percent of those jobs employed by small and medium 
businesses. The massive growth of online advertising's 
contribution to GDP can be tied to improved data collection and 
subsequent ad targeting.
    Digital ads are dependent on consumer-related information 
and data, and many of the largest companies in the world, 
Facebook, Google, and the like, are supported by revenue 
generated from the collection of this data for the use of 
targeted ads. While these companies clearly have dominance in 
this space, many of the benefits of this data collection 
trickle down to small businesses and create a more tailored 
online experience for consumers.
    For example, a local greenhouse can use their limited time 
and resources to advertise in the most effective way for less 
cost by using targeted ads. Instead of publishing an imprecise, 
catch-all ad in the newspaper, they can purchase ad space on 
websites dedicated to gardening or set up a geolocation range 
for IP addresses in driving distance to their greenhouse. This 
ensures that their ad is reaching their most-likely group of 
customers: avid gardeners who live within 10 miles of the 
greenhouse. In the same transaction, the gardeners benefit from 
knowing what promotions and deals are available in their area.
    To some consumers, these practices can feel like an 
invasion of privacy, or leave them wondering how much personal 
information about them is being sold. As this subcommittee 
continues to grapple with the many privacy issues and data 
breaches of the past few years, we are no stranger to the risks 
of collecting such detailed consumer profiles and amassing it 
in centralized data repositories susceptible to bad actors. 
This hearing is yet another opportunity to discuss these risks 
and understand what those in the private sector are doing to 
address them.
    Additionally, ads are only effective if they're reaching 
actual people. Digital ad fraud and the scourge of traffic 
bots, algorithms designed to look like actual human views, 
complicate this system in new ways, and undermine the trust in 
the current advertising model. Businesses who think they are 
paying more for ad space because of high audience interest, 
might not get the response they want because of bots. One study 
found that 22 percent of desktop video ads were viewed only by 
bots.
    The online advertising ecosystem has many players that 
contribute to its effectiveness. Understanding how each of 
these players interact with each other and with consumers is an 
important step in discussing larger issues like privacy and 
data security. As always, it is one of the primary goals of the 
Energy and Commerce Committee to ensure that consumers are 
informed and can make educated decisions about their online 
habits.
    The advertising-based model supports the platforms that we 
use to communicate, connect, shop, and work. Today, we hope to 
hear of the many efforts undertaken by industry to innovate and 
grow in this space, while at the same time responding to 
consumer demands for privacy and security of their data.
    Thank you to all of our witnesses for being here today. I 
yield to the gentle lady from Illinois, the ranking member of 
the subcommittee, for a 5-minute opening statement.

    Mr. Latta. Again, I want to thank our witnesses for being 
with us today, and at this time I will yield back my time and 
recognize the gentlelady from Illinois, the ranking member of 
the subcommittee, for 5 minutes.

       OPENING STATEMENT OF HON. JANICE D. SCHAKOWSKY, A 
     REPRESENTATIVE IN CONGRESS FROM THE STATE OF ILLINOIS

    Ms. Schakowsky. Thank you, Mr. Chairman.
    Ads are ubiquitous, often irritating, as you browse the 
internet. Most of the time, we give little thought to why those 
ads are there.
    But, as we touched on during the Facebook hearing earlier 
this year, the ads that consumers see are often highly 
targeted.
    I've certainly noticed them in my own experience that I am 
being tracked online. I start to shop on a website and then 
next thing you know an ad for the very same product I was 
looking for turns up on a completely different website.
    Companies may claim that consumers like targeted ads, and 
some may. But consumers tell a different story often when they 
are polled. In fact, most Americans report taking at least some 
steps to block tracking.
    Americans are realizing how little control they have over 
their own information. You may not even be on Facebook, but 
Facebook collects information about you.
    You can block cookies but you are still tracked. You are 
tracked regardless of whether you're on a computer, smartphone, 
or tablet, and the internet of things expands which devices can 
collect your data even further.
    The use of targeted digital ads can have serious 
consequences. It's not just online shopping. We have learned 
more and more in the past year about how Russia used targeted 
ads to spread disinformation and meddle in our elections.
    The grand jury in Special Counsel Robert Mueller's 
investigation has indicted 13 Russian nationals and three 
companies for waging information warfare on the United States.
    Targeted ads can also be tools for discrimination. A 
ProPublica investigation last year found that Amazon, Verizon, 
UPS, and Facebook all posted jobs--job ads that were targeted 
specifically to specific age groups, excluding older Americans.
    We have also seen ads for junk financial products that are 
directed to communities of color. Facebook has now removed the 
option to exclude certain ethnic groups for advertising. But 
the potential for discrimination remains in the online ad 
market.
    Congress has been woefully slow in responding to the risks 
that online advertising practices pose to privacy, fairness, 
and our very democracy.
    The Federal Trade Commission does not have the resources it 
needs to be an effective consumer watch dog. It does not have 
close to enough staff to monitor anti-consumer practices online 
and it has weak enforcement tools.
    The FTC has limited rulemaking authority. It cannot impose 
civil penalties right away. When a company fails to protect 
consumer privacy, instead it has to negotiate a consent order 
and only if it later finds a violation of that consent order 
does a company actually pay for misusing consumer data.
    Perversely, the Republican majority tried the last Congress 
to further restrict the FTC's authority. Fortunately, that 
legislation was not passed.
    Consumers deserve a real protection. We need rules of the 
road for what information can be collected and stored on--and 
stored about consumers.
    Consumers need real options when it comes to how their 
information is used. The Facebook scandal and the many data 
breaches in recent years have made consumers increasingly aware 
of how much data is sitting out there--how much of their own 
data.
    After the Equifax data breach, we had a witness describe 
the steps a consumer could take to protect the information, and 
she basically made protecting your privacy sound like a full 
time job.
    It shouldn't be that way. I am glad that we are having 
this--we are continuing to discuss the field of digital ads. My 
question is what comes next.
    Is the subcommittee finally going to take up legislation to 
strengthen consumer privacy protection? This is a complicated 
issue.
    But I believe that we are up to the challenge. Let's bring 
our ideas to the table and hash out the solutions that are--
that our constituents deserve.
    People are fed up with big corporations tracking their 
every move online and controlling what they see. They are 
demanding action and it is time for Congress, for this 
committee, to deliver.
    I yield back.
    Mr. Latta. Thank you very much. The gentlelady yields back, 
and I believe the chairman of the full committee has not 
arrived yet. Is there anyone on the Republican side wishing to 
claim the chairman's time?
    If not, at this time I will recognize the gentleman from 
New Jersey, the ranking member of the full committee, for 5 
minutes.

OPENING STATEMENT OF HON. FRANK PALLONE, JR., A REPRESENTATIVE 
            IN CONGRESS FROM THE STATE OF NEW JERSEY

    Mr. Pallone. Thank you, Mr. Chairman.
    Today's hearing will explore online advertising and its 
role in society. In the early days of the internet, online 
advertising was like other forms of advertising.
    Advertisers would place ads aimed at broad audiences. But 
that has all changed. Advertising is now directed to smaller 
targeted categories of audiences, those most likely to purchase 
their products and services.
    Targeted advertising can provide more relevant advertising 
to consumers. It also provides revenue to advertisers.
    For example it allows a small business selling boutique 
men's razors to reach men, say, in their 40s and 50s who may be 
able to afford a specialty product.
    However, it also allows a scammer to reach women over a 65 
in a particular zip code who have been duped in the past to 
give their money to fake veterans charities.
    Moreover, contrary to industry claims, it's not always 
anonymous. Right now, anyone willing to pay can target 
advertising to a list of 20 names and send a specialized adjust 
to them.
    Without explaining or justifying the list, an advertiser 
could send an advertisement to 20 specific people who have a 
mental health condition or are taking a particular medication.
    And target advertising is possible because of the vast 
amounts of information collected about individual consumers by 
companies across the advertising ecosystem.
    Beyond the websites, you go to the advertisers today to see 
there are numerous middlemen, ad networks, ad agencies, data 
brokers, and the like.
    These companies lurk in the background, often unknown to 
consumers, and not just collecting and storing data that would 
choose to share. They track what websites we visit, what 
purchases we make, and even the movement of your mouse on the 
computer screen.
    And information collected about our online activity is 
increasingly being merged with our offline identity to create 
extremely detailed profiled.
    Moreover, they can go beyond facts to include inferences 
about our interests and demographic information. Targeted 
advertising by its very nature separates people into categories 
and shapes our choices.
    We have shown limited options that are chosen for us by 
automated processes based on our profiles. So what I see on the 
internet may end up being very different from what you see, and 
neither of us getting all the information that may help us make 
our purchasing decisions.
    Even if we seek out additional information we may get 
created content, further limiting our choices.
    In addition to the risks of scams, targeted ads can result 
in blatant discrimination. It's been well documented than 
targeted advertising systems have allowed housing ads to 
exclude people of color and job ads to exclude older workers.
    At this committee's hearing last year on the effect of 
algorithms on consumers we discussed how bias can be built into 
algorithms, resulting in bias results, and that problem does 
not just apply to content and search results. It applies to 
advertisement as well.
    It is good that Google and Bing have now blocked ads for 
predatory payday loans, but that's not enough. The American 
people rightfully feel like they've lost control.
    One survey showed that 84 percent of people want more 
control over what companies can learn about them online, yet 65 
percent of people are resigned to the fact that they have 
little control.
    So we hear a lot about self-regulatory transparency, 
notice, and choice but we all receive many updated privacy 
policies spurred by the EU's new data privacy regulations. None 
of us have time to read all of them, let alone actually 
understand and remember what each company is doing with our 
data.
    And what about the companies collecting our data that we 
don't even know exist?
    The Equifax breach brought that issue up front and center, 
and people weren't just upset that their data was stolen. They 
were upset that a company that may have never--they've never 
interacted with had all that data.
    So I think we can do better and I think we must do better, 
Mr. Chairman. It's time we all admit that the current system 
just isn't working for consumers, and Congress needs to do a 
better job and pass comprehensive privacy legislation so people 
can take back control that they've lost.
    And I yield back.
    [The prepared statement of Mr. Pallone follows:]

             Prepared statement of Hon. Frank Pallone, Jr.

    Today's hearing will explore online advertising and its 
role in society.
    In the early days of the internet, online advertising was 
like other forms of advertising-advertisers would place ads 
aimed at broad audiences. But that has all changed. Advertising 
is now directed to smaller, targeted categories of audiences-
those most likely to purchase their products and services.
    Targeted advertising can provide more relevant advertising 
to consumers. It also provides revenue to advertisers. For 
example, it allows a small business selling boutique men's 
razors to reach men, say in their 40s and 50s, who may be able 
to afford its specialty product. However, it also allows a 
scammer to reach women over 85, in a particular zip code, who 
have been duped in the past to give their money to fake 
veterans' charities.
    Moreover, contrary to industry claims, it is not always 
anonymous. Right now, anyone willing to pay, can target 
advertising to a list of 20 names and send a specialized ad 
just to them. Without explaining or justifying the list, an 
advertiser could send an advertisement to 20 specific people 
who have a mental health condition or are taking a particular 
medicine.
    Targeted advertising is possible because of the vast 
amounts of information collected about individual consumers by 
companies across the advertising ecosystem. Beyond the websites 
you go to and the advertisers whose ads you see, there are 
numerous middlemen-ad networks, ad agencies, data brokers, and 
others.
    These companies lurk in the background, often unknown to 
consumers. They are not just collecting and storing data that 
we choose to share. They track what websites we visit, what 
purchases we make, and even the movement of your mouse on the 
computer screen. And information collected about our online 
activity is increasingly being merged with our offline identity 
to create extremely detailed profiles. Also, they can go beyond 
facts to include inferences about our interests and demographic 
information.
    Targeted advertising, by its very nature, separates people 
into categories and shapes our choices. We are shown limited 
options that are chosen for us by automated processes based on 
our profiles.
    So, what I see on the internet may end up being very 
different from what you see. And neither of us is getting all 
the information that may help us make our purchasing decisions. 
Even if we seek out additional information, we get curated 
content further limiting our choices.
    In addition to the risk of scams, targeted ads can result 
in blatant discrimination. It's been well-documented that 
targeted advertising systems have allowed housing ads to 
exclude people of color and job ads to exclude older workers.
    At this committee's hearing last year on the effect of 
algorithms on consumers, we discussed how bias can be built 
into algorithms resulting in biased results. That problem does 
not just apply to content and search results, it applies to 
advertisements as well. It is good that Google and Bing have 
now blocked ads for predatory payday loans, but it is not 
enough.
    The American people rightfully feel like they've lost 
control. One survey showed that 84 percent of people want more 
control over what companies can learn about them online yet 65 
percent of people are resigned to the fact they have little 
control.
    We hear a lot about self-regulatory transparency, notice, 
and choice, but we all received many updated privacy policies 
spurred by the EU's new data privacy regulations. None of us 
have time to read all of them, let alone actually understand 
and remember what each company is doing with our data.
    And what about the companies collecting our data that we 
don't even know exist. The Equifax breach brought that issue 
front and center. People weren't just upset that their data was 
stolen. They were upset that a company that they may have never 
interacted with had all that data.
    We can do better, and we must do better. It's time we all 
admit that the current system just isn't working for consumers. 
Congress needs to do its job and pass comprehensive privacy 
legislation so people can take back control.
    Thank you, I yield back.

    Mr. Latta. Thank you very much. The gentleman yields back 
the balance of his time.
    And that now concludes Member opening statements. The Chair 
reminds Members that, pursuant to committee rules, all Members' 
opening statements will be made part of the record.
    Again, I want to thank our witnesses for being with us 
today and taking time to testify.
    Today's witnesses will have the opportunity to give a 5-
minute opening statement followed by a round of questions from 
the Members.
    Our witness panel for today's hearing will include Ms. 
Rachel Glasser, who is the global chief privacy officer at 
Wunderman; Mr. Mike Zaneis, president and CEO of Trustworthy 
Accountability Group; Mr. Justin Brookman, the director of 
privacy and technology policy at Consumers Union; and Dr. 
Howard Beales, professor of strategic management and public 
policy at George Washington University.
    Again, we want to thank you all for being with us and 
taking the time to testify and, again, Ms. Glasser, you're 
recognized for 5 minutes for your opening statement. So just 
pull that mic up close and press the button to get her on, and 
we appreciate hearing your testimony today.
    Thanks very much.

STATEMENTS OF RACHEL GLASSER, CHIEF PRIVACY OFFICER, WUNDERMAN; 
MIKE ZANEIS, PRESIDENT AND CHIEF EXECUTIVE OFFICER, TRUSTWORTHY 
 ACCOUNTABILITY GROUP; JUSTIN BROOKMAN, DIRECTOR, PRIVACY AND 
   TECHNOLOGY POLICY, CONSUMERS UNION; J. HOWARD BEALES III, 
  PH.D., PROFESSOR OF STRATEGIC MANAGEMENT AND PUBLIC POLICY, 
              GEORGE WASHINGTON SCHOOL OF BUSINESS

                  STATEMENT OF RACHEL GLASSER

    Ms. Glasser. Thank you very much, Chairman Latta, Ranking 
Member Schakowsky, and members of the subcommittee.
    Good morning, and thank you for the opportunity to speak at 
this important hearing. I am honored to have traveled from New 
York to appear before you to today to discuss how responsible 
digital advertising supports innovative, diverse, and free 
services that are the foundation of our online economy.
    My name is Rachel Glasser. I am the global chief privacy 
officer for Wunderman, who's the parent company of KBMG.
    I am responsible for data privacy strategy and 
implementation and ongoing process improvements for all of 
Wunderman including KBMG.
    KBMG is headquartered in Louisville, Colorado, with offices 
in New York, Texas, and Brazil. We help brands, companies, and 
nonprofit, large and small, use data as a strategic asset and 
provide data-driven marketing engagement for improved marketing 
performance and a resident customer experience.
    The internet has drastically improved the way people work, 
consume content, learn, travel, access health care, spend 
leisure time, and communicate with one another.
    Many of these life changing benefits are available to 
consumers for free because it's supported by digital 
advertising. In short, digital advertising is the lifeblood of 
the internet economy and connects business with consumers who 
are most likely to value their products and services.
    Data is at the center of this American success story and is 
core to the marketing services that KBMG provides the clients.
    Accordingly, the foundation of our business model is trust. 
We work every day to earn and maintain the trust of both 
consumers and companies with whom we work.
    My job is to help ensure that privacy and respect for the 
consumer are integrated into every initiative.
    This message comes from the top. Respect consumer privacy, 
be transparent about our data collection and use practices, 
offer consumer choice, and honor those choices.
    This trust allows us to innovate faster, provide more value 
to clients, and create better experiences for consumers.
    Digital advertising is a broad term used to describe the 
paid advertising that publishers put on their websites or apps. 
It enables these publishers to provide consumers with content 
and services for free.
    Today, I am focusing on digital advertising tailored to 
consumers' likely interests. This is generally known as 
interest-based advertising, or IBA.
    IBA is why consumers see ads that are relevant to their 
interests. With this type of advertising, companies and 
advertisers collect information across some of the sites and 
apps that they visit.
    This information is then used to predict what ads might be 
the most interesting to consumers. IBA doesn't depend on 
information that may be personally identifiable such as a 
consumer's name or a phone number or postal address.
    In fact, most ad tech companies do not want to know the 
identity of a consumer for the purposes of IBA. They only want 
to link an interest category to demographic data with the 
consumer's browser so that they can serve up relevant ads.
    Of course, different companies may use different methods of 
IBA. To kind of level set, it's important to go over the fact 
that there are several different players in the advertising 
ecosystem.
    We have the consumer, the publisher, the advertiser, and 
the third party advertising company, and that's where my 
company sits.
    We are third party advertising company. As I mentioned, 
KBMG, as a digital marketing company, places a high priority on 
consumer privacy and reasonable use of data.
    We expect that participants in the online economy will 
honor high standards regarding the collection and use of online 
data.
    This supplies the publishers, platforms, social media, data 
management companies, ad tech providers, commerce sites, and 
more.
    At a minimum, when data is collected and used to support 
various activities such as online advertising or to create 
personalized experiences, each player in the data life cycle 
has a responsibility to be transparent, offer consumers 
appropriate choices, and honor those choices with respect to 
data collection and use.
    We also expect every company to take reasonable measures to 
secure that data prevent--to secure that data and prevent 
potential misuse.
    This leads me to my final point this morning. Businesses 
have a vested interest in acting responsibly and building user 
trust on line. Recognizing the value of user trust and the 
potential applications of data online, the digital ecosystem 
has taken initiative and thorough measures to put in place a 
set of codes and principles to reinforce these practices.
    The NAI and the DAA are two self-regulatory groups 
committed to maintaining and enforcing responsible privacy 
practices and high standards for data collection.
    These standards include providing consumers with enhanced 
transparency and control and companies like mine voluntarily 
commit themselves to these organizations.
    These companies demonstrate their desire to be good actors 
and they are obliged to abide by the respective codes and 
principles. This is a clear indication of the intent of 
companies to act responsibly, build user trust, and help drive 
innovation and grow the internet economy.
    There is no question that data privacy is on everyone's 
minds these days. But for our industry it's been on our mind 
for nearly two decades.
    While not to be downplayed by any means, we do not want the 
recent events of recent to overshadow the extraordinary 
benefits of the online advertising ecosystem and we are very 
pleased that the Energy and Commerce Committee is taking the 
time to learn more about this vibrant and exciting sector.
    Thank you.
    [The prepared statement of Ms. Glasser follows:]
    
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    Mr. Latta. Well, thank you for your testimony this morning, 
and Mr. Zaneis, you are recognized for 5 minutes.

                    STATEMENT OF MIKE ZANEIS

    Mr. Zaneis. Thank you, Chairman Latta, Ranking Member 
Schakowsky, distinguished members of the subcommittee, it's 
wonderful to be before you again today.
    May name is Mike Zaneis. I am the president and CEO of the 
Trustworthy Accountability Group, or TAG, as it's known in the 
industry.
    TAG is a industry not-for-profit organization whose mission 
is to fight criminal activity throughout the digital 
advertising supply chain.
    It may come as a surprise to all of you that that's a 
necessary mission. But let me assure you it is. Our industry is 
fighting the same criminal networks that operate globally often 
to commit human trafficking, drug trafficking, and widespread 
digital identity theft.
    Why is that? It's because digital advertising is the engine 
that drives America Mr. Justin BrookmanDirector, Privacy and 
Technology Policy, Consumers Union's digital data-driven 
economy.
    This is an industry that contributed $1.12 trillion to the 
domestic economy in 2016 and in so doing created 10.4 million 
jobs, and these are incredibly high quality jobs that pay very 
well, spread across the country in literally every 
congressional district.
    With that prosperity, though, comes added attention, as I 
mentioned. The complexity then Ms. Glasser talked about with 
the digital supply chain--the fact that you may have dozens of 
companies touching an ad from the marketer, the agency, the 
tech firms, all the way down to the publisher before it ever 
appears, hopefully, in front of a real consumer, creates 
sometimes an opaque supply chain and that allows criminals to 
hide in the dark murky corners and to infiltrate it.
    It's estimated then that this criminal activity, as I 
mentioned, causes more than $8.2 billion in harm. But that's 
just domestically, and the impact is greater globally.
    The industry found a common chain of criminal activity a 
few years ago. The first link in this chain is the theft of 
digital content. Criminals don't take the time or the effort to 
create content like our own homegrown creative community does.
    Instead, they steal it. Maybe it's a blog posting, a local 
news article, all the way up to the latest music and movies, 
and they put this content on websites that they own, and that's 
because domains are inexpensive and easily accessible.
    Once they have a website with quality content on it, they 
have to generate an audience to visit that website. That's very 
difficult to do.
    Here, again, criminals, of course, cheat, as they always 
do. They prefer to distribute malware onto consumers' computers 
and devices.
    Once infected, that device can actually open up individual 
browsers or even behind-the-scenes mobile apps, unbeknownst to 
the consumer, and it visits Web sites.
    We call this fraudulent nonhuman traffic. That's because 
there's not a person on the other end of that screen. It's 
estimated then to digital app at a cost to the industry $4 
billion a year here in the U.S.
    Finally, now that a criminal network has a website with 
great content, they have what appears to be large engaged 
audience. They're a perfect candidate to attract digital 
advertising revenue.
    Like any legitimate business, they can embed ads into that 
site and begin to receive revenue into a matter of weeks a 
great democratization tool for small businesses in this 
country.
    TAG was created by the industry to solve these challenges. 
And so we are often referred to as sort of the good 
housekeeping seal of approval.
    To date, the industry has rallied behind these efforts, 
although we are only 3 years old. More than 680 companies have 
applied to join TAG.
    That's spread across 27 countries and six continents. Most 
importantly, more than 100 companies have already achieved a 
TAG certification.
    What that means is that these companies are living up to 
the highest standards using the best technology to fight fraud, 
to fight ad-supported piracy, to fight malware, and also we 
have an overarching goal of increasing transparency throughout 
the supply chain.
    We've been very gratified to learn over the past year that 
these programs are working. Two pieces of independent research 
showed that in our anti-fraud program that if marketers worked 
with TAG-certified entities through what we call a TAG-
certified channel, they could remove at least 83 percent of 
those fraudulent non-human impressions that they receive. It 
can save them billions of dollars a year.
    With our anti-piracy efforts, a study by EY--Ernst and 
Young--found that industry efforts to keep ads off of sites and 
steal content and have illicit material on them had kept more 
than half of that revenue from flowing to these pirate sites.
    I think most encouraging about that research is that the 
little revenue that does flow to pirate sites comes from 
nonpremium marketers, meaning the smaller, less reputable 
folks.
    So I appreciate the opportunity to speak to you today and I 
look forward to answering your questions.
    [The prepared statement of Mr. Zaneis follows:]
    
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    Mr. Latta. Well, thank you very much for your testimony.
    Mr. Brookman, you are recognized for 5 minutes. Thank you.

                  STATEMENT OF JUSTIN BROOKMAN

    Mr. Brookman. Chairman Latta, Ranking Member Schakowsky, 
members of the committee, thank you very much for holding this 
hearing into the digital ad ecosystem and for the opportunity 
to testify here today.
    I am here today on behalf of Consumers Union. We are the 
advocacy division of Consumer Reports. We are the world's 
largest independent testing organization, rating thousands of 
products and services for consumers every year.
    I've been working on ad tech for a number of years now, 
dating back to suing adware companies in the 2000s for 
deceptive install practices.
    I recognize the value of ad targeting. I also recognize 
that a lot of consumers really don't like it and they don't 
feel they've agreed to be tracked everywhere they go with 
everything they do in exchange for free content.
    It used to be that online ad tracking was fairly 
straightforward. A lot of people didn't like it but it was 
simpler to understand. Advertising companies would put 
anonymous cookies in your browser and they serve you ads based 
on the sites you visited in your browser but not based on who 
you are, and you can control it by deleting or blocking 
cookies.
    Today, however, the techniques companies use are a lot more 
sophisticated. Companies like Google and Facebook track you by 
real name, not just on their own services but on the majority 
of other sites and apps that are out there across all of your 
different devices.
    Deleting cookies or using private browsing mode may not do 
much good anymore if companies are using other technologies 
like digital fingerprinting to monitor you instead.
    And we are not just tracked on our computers anymore. It's 
other devices as well. Consumer Reports looked at a bunch of 
smart TVs earlier this year and all of them tried to use 
automated content recognition to take snapshots of what was on 
our screens to try to figure out what shows we are watching.
    Ad companies also want to tie what we do online to the 
physical world. So a couple days ago I was in New York City. I 
bought a cup of coffee at a place I would never been before.
    A day or so later, I got an email from them welcoming me to 
their rewards program. I had never given them my email address.
    Now, I can see why companies might want to do some of these 
things but I also see why consumers might want to make it stop. 
Privacy is, at some level, a right to seclusion--a right to be 
left alone--a right to autonomy over our own devices and what 
they share about us, and it's getting harder and harder to 
manage that personal information.
    Now, in response to this constant creeping encroachment 
into our personal spaces, there are some companies who are 
pushing back. Apple, for example, has done a lot to limit 
tracking and apps on iPhones. Just this week, they announced 
further changes to give users more control over cross-site 
tracking.
    Mozilla, maker of the Firefox browser, has also taken a lot 
of positive steps to limit tracking in their browsers, and 
we've also seen a tremendous rise in the use of ad blockers 
like Disconnect and Privacy Badger and uBlock and Brave by 
consumers who are frustrated by aggressive ads or the 
underlying tracking.
    Ad blocker penetration is expected to rise to 30 percent of 
the market this year, showing that users really are not 
satisfied with online ads' ecosystem.
    In my organization, Consumer Reports--long-time testing 
lab--we are starting to test products based on privacy and 
security in response to consumer demand.
    So I mentioned how we analyse privacy and security issues 
with TVs earlier. We are looking to build those sorts of 
evaluations into our everyday product testing.
    And so far, though, all this pressure hasn't really been 
enough to get industry to reform itself. There are self-
regulatory programs but they've always suffered from the same 
problems--they're too weak, they don't apply to all the 
companies in the space, they don't really address the data 
collection issue, the interfaces can be complicated and 
confusing, and a lot of times the tools are just broken.
    Now, the online ad industry had agreed to address these 
failings back in 2012 when they promised to honor do not track 
instructions in browsers. These are the easy-to-use settings in 
your web browser. You can signal to the world that you don't 
want to be targeted and tracked.
    Well, then a couple of years later the industry backtracked 
on that promise. Now it's been over 7 years since consumers 
have been activating do-not-track in their browsers. The ad 
industry still by and large just ignores those signals.
    And so while we at Consumer Reports are working to improve 
the market for privacy and security, ultimately, I do think we 
probably need some basic legislative protections.
    So we should have a discussion about what would work and 
what wouldn't, because privacy laws are already happening 
around the world.
    Europe recently expanded their legal protections with the 
GDPR that just went into effect and a lot of other nations 
around the world are copying European models and those laws do 
affect U.S. companies.
    States continue to pass privacy and security laws. States 
led the way on data breach notification laws and credit freeze 
laws and a lot of other basic consumer rights. We are starting 
to see them advance more comprehensive privacy and security 
legislation as well.
    So I would urge this committee not to leave the policy 
decisions entirely to Europe or to the States but to really dig 
in and think about what sort of practical protections can 
empower consumers to make their own decisions about their 
personal information.
    Thank you, again, for inviting me here today and I look 
forward to your questions.
    [The prepared statement of Mr. Brookman follows:]
    
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    Mr. Latta. Well, thank you again for your testimony.
    And Dr. Beales, you are recognized for 5 minutes. Thank 
you.

               STATEMENT OF J. HOWARD BEALES III

    Dr. Beales. Thank you, Chairman Latta, Ranking Member 
Schakowsky, and members of the subcommittee. I thank you for 
the opportunity to testify today.
    I am Howard Beales. I am a professor of strategic 
management and public policy at the George Washington School of 
Business. I've written academic articles about privacy and from 
2001 to 2004 I was the director of the Bureau of Consumer 
Protection at the FTC at the time when the commission 
promulgated the National Do Not Call Registry.
    I want to make three essential points this morning. First, 
internet content is a public good. Private market provisions of 
such public goods has historically depended on revenue from 
advertising, as does internet content today.
    Second, the value of advertising depends critically on the 
availability of information about the likely viewer. When 
information is available, advertising prices are, roughly, 
three times higher than when there's no information about the 
viewer.
    Impairing the flow of information would significantly 
reduce the revenues available to support internet content, an 
impact that would be particularly problematic for smaller 
publishers.
    Third, advertising actually benefits consumers, leading to 
more competitive markets, lower prices, product improvements, 
and smaller differences between demographic groups.
    To return to my first point, from an economic perspective, 
internet content is a public good. Unlike private goods, public 
goods are not used up in consumption.
    Like free broadcast radio or television, any number of 
consumers can enjoy the content without any additional cost of 
providing it. The primary market mechanism for providing such 
goods is advertising, which converts the public good of media 
content into a private good of exposures to advertising.
    Throughout history, advertising support has been a vital 
revenue source for media companies. Although purer subscription 
models exist, like satellite radio or premium cable TV, market 
behavior makes clear that most consumers most of the time are 
not willing to pay a premium price to avoid advertising.
    Online content is not fundamentally different. Publishers 
must cover their costs and advertising is critical to achieve 
that objective. Given the long histories of advertiser-
supported media markets, that fact should not be surprising and 
it's not likely to change.
    Second, the value of advertising depends on information. 
What advertisers are willing to pay for an advertising slot 
depends critically on what they know about the viewer. However 
attractive to an individual viewer, anonymity reduces the price 
of the advertisement and therefore reduces the revenue 
available to support the content the viewer is enjoying.
    In short, anonymity is a subtle form of free riding on the 
contributions of others. In two separate studies I've examined 
the impact of better information on the price of digital 
advertising.
    In a 2010 study, I surveyed advertising networks to 
determine the impact of behavioral targeting which uses 
browsing behavior data to categorize likely consumer interest 
in a particular advertisement.
    The price for behaviorally targeted advertising was, 
roughly, three times higher than the price of run of network 
advertising sold without regard to audience characteristics, 
and that's a substantial prices premium.
    My 2013 study analysed data from automated advertising 
exchanges. If there was a cookie available, the price of the 
advertisement was, roughly, three times higher than if there 
was no cookie. The longer the cookie had been in place, the 
more it was worth. With a 90-day-old cookie, the price was 
between 3.7 and 7.1 times higher than the price with no cookie.
    We also found that even the largest publishers sold about 
half of their ad slots through third-party technologies like ad 
exchanges while smaller long-tail publishers relied on these 
approaches for up to two-thirds of their advertising sales.
    Thus, regulatory requirements that impair the flow of 
information will significantly reduce the revenue available to 
online content producers, leading to a less vibrant internet. 
The impact will be greatest on the smallest publishers.
    Many important participants in the online marketplace are 
not consumer facing at all because they work with publishers or 
advertisers to observe behavior across independent websites.
    Consumers have never heard of most of them: for example, 
33Across, Accuen, Acuity, and Adara, which happen to be the 
first four names on the list of members of the Network 
Advertising Initiative.
    More elaborate consent requirements could seriously 
disadvantage these companies with the primary effect of 
protecting the market shares of the current leaders in the 
online advertising market.
    As in any other market, regulatory barriers that protect 
market leaders from competition are bad for consumers.
    Finally, advertising is not evil. It provides important 
benefits for consumers. Numerous economic studies have shown 
that restrictions on advertising increase prices for consumers.
    Advertising also facilitates innovation and narrows the 
differences between demographic groups. Advertising the 
relationship between fiber consumption and cancer, for example, 
resulted in the greatest increases in fiber consumption in 
racial minority and single parent households.
    When eyeglass advertising was restricted, the least 
educated paid the highest prices.
    To summarize, the provision of internet content depends on 
advertising revenue. That revenue, in turn, depends on the 
availability of information about the viewer, and online 
advertising, like other advertising, benefits consumers.
    Thank you again for the opportunity to testify today and I 
look forward to your questions.
    [The prepared statement of Dr. Beales follows:]
    
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    Mr. Latta. Well, Dr. Beales, thank you very much for your 
testimony today and, again, I want to thank all of our 
witnesses for being here and we'll move into the question and 
answer portion of our hearing.
    I will begin the questioning and recognize myself for 5 
minutes.
    Ms. Glasser, would you describe some of the tools that are 
used to track consumers online and would you also tell what 
kinds of information digital ad businesses have about consumers 
and what they use it for?
    Put that mic on, please. Thank you.
    Ms. Glasser. Thank you. Thank you, Congressman, for your 
question.
    Sure, there are many different tools that you can use to 
track users online. I think it really could depend on the 
platform that you're using.
    Persistent identifiers tend to be of the most common and 
those would include things like cookies or advertising IDs. 
They don't identify an individual personally so they're not 
personally identifiable. Instead, it allows to--it allows the 
advertiser to make associations and inferences on the types of 
behavior and the types of things that a consumer enjoys.
    And can you repeat the second part of your question?
    Mr. Latta. Yes, and would you tell us also what kind of 
information the digital ad businesses have about consumers and 
how it's being used?
    Ms. Glasser. Sure. Again, I think that also depends on who 
you're speaking to in the supply chain. But, generally, for a 
company like mine, the type of information that we usually hold 
on the consumers would be things related to a cookie.
    So that could include an IP address, cookie ID, browser 
information. For example, if you're using a certain version of 
Google Chrome or Internet Explorer, it might include a time 
stamp and a date for verification purposes. It could really 
vary, depending on how you set the cookie to collect 
information.
    Mr. Latta. Thank you.
    Mr. Zaneis, how significant of a problem are bots and fake 
accounts in the digital ad ecosystem?
    Mr. Zaneis. There's no question that it's a massive 
challenge and a problem for the entire ecosystem. I think then 
there's a recognition that no industry can be based off of this 
high level of fraud.
    The number that you quoted of 22 percent fraud in certain 
display units--you know, we used to have a discussion around is 
fraud 20 percent of all inventory or 30 or 40 percent.
    Over the last 2 years, we've sort of turned the corner on 
that. We have not solved it. But now what we see, again, 
working with reputable partners it's relatively easy to get 
your fraud rate down well into, as I mentioned, less than 1.5 
percent.
    I sometimes look at other industries like, you know, 
produce shippers and manufacturers that have spoilage and 
breakage rates around 15 to 20 percent and I look at where we 
are getting the industry and think we are doing a good job.
    Mr. Latta. Let me follow up on that. Is there a conflict of 
interest in the industry if fake accounts are driving traffic 
numbers higher?
    Mr. Zaneis. No. I think that that's a common myth that has 
been put out there by some advertising naysayer--that because 
there can be more revenue generated by more traffic, even 
fraudulent traffic.
    There's no question that some companies--legitimate 
companies--could make more money from that. We always say in 
the industry that there are crimes of omission and there are 
crimes of commission, and sort of sitting back and maybe 
getting a little extra revenue from a few fake hits on your 
website used to happen all the time.
    Nobody in our industry is committing commission crimes of 
actually committing fraud, but I am happy to say that now the 
respectable companies--as I mentioned, 680 companies have 
sought to join TAG--now we've turned the corner on the crimes 
of omission.
    Mr. Latta. OK. Thank you.
    Ms. Glasser, in about my last minute that I have, if I 
wanted to create a website today and sell advertising space, 
for example, a banner ad, and some ads along the side, how 
difficult would that be and how much would it cost me to get 
started, especially if I was a small business?
    Ms. Glasser. I would not be able to comment on what it 
could cost or even a range, because that could really depend on 
the size of the audience you're trying to market to or that 
you're trying to attract to your website.
    It could also depend on the type of the audience, right?
    Mr. Latta. How about the difficulty, though? How difficult 
would it be for somebody to go out there to do that--to get a 
banner?
    Ms. Glasser. It's not very difficult. You would most likely 
have to engage with either--I think the easiest thing to do 
would be engage with an ad agency because they could basically 
do everything turnkey for you, or you could probably approach 
some ad networks on your own.
    I've really only worked with ad networks from an agency 
perspective so I wouldn't know how it is personally to go and 
do it. But I think some of the bigger companies and some of the 
companies who have been around a lot longer probably, you know, 
have certain teams to handle the smaller businesses.
    Mr. Latta. OK. Well, thank you. My time has expired and I 
will recognize the gentlelady from Illinois, the ranking member 
of the subcommittee, for 5 minutes.
    Ms. Schakowsky. Thank you.
    Mr. Brookman, in your written testimony you say just last 
week, Vice published a story purporting to prove that Facebook 
listens to ambient conversation for the--for ad targeting 
purposes.
    You acknowledge that privacy researchers cast doubt on the 
story but the fact that leading authorities cannot even agree 
on whether Facebook is mining personal audio conversations is 
emblematic of the generalized confusion about privacy.
    We do know, for example, that Samsung's smart TVs do record 
everything. They have some sound--some voice-responsive 
feature. And I don't know what disclosure means, if it's in, 
you know, some sort of tiny print thing that you can find when 
you unbox the TV.
    We also know that Vizio, also a TV, tracks second by second 
viewing information. There is right now an FTC enforcement 
action, or there was, against them because they did not 
disclose that.
    So, you know, what do consumers know and what don't they 
know and how should they know, and should this be done even if 
they are informed?
    Mr. Brookman. Yes. No, I think that's a good question.
    You know, I think there's just a lot of understandable 
uncertainty because there's so many sensors, right, all around 
our house.
    We have Echos. We have--we have a microphone right now. I 
mean, according to that Vice article, you know, any company 
could be listening to it.
    I do think that, you know, there are actually--some 
companies are kind of scared to go there. I know that Samsung 
in their privacy policy reserved the right to listen to 
everything you do. But they did, I think, fortunately, clarify 
that no, we will only actually listen when the button is 
pressed down, and I think that's the right choice.
    Facebook has also tried to clarify, you know, we will only, 
you know, listen, you know, if you--we don't listen to what's 
going on ambiently.
    But I think that's the question. I mean, according to Dr. 
Beales' testimony, it would actually probably be good if 
Facebook were listening to every single thing that I say and 
not just Facebook but also Google or Samsung or any of the 650 
companies that Mr. Zaneis mentioned because it could give us, 
you know, more targeted ads.
    I think consumers reject that and I do think it's actually 
unfair to kind of try to put that burden on consumers to try to 
figure out, you know, what every single company is doing, which 
is why I definitely support what you're saying--that there 
should be some basic rules of the road to empower consumers to 
kind of take some control over all these devices.
    Ms. Schakowsky. Thank you.
    What do you mean by rules of the road? Should we be passing 
legislation?
    Mr. Brookman. Yes. So there's a few things that could be 
done, like just better transparency for first, right? I mean, 
right now privacy policies--if you--if you look at them--you 
know, I review privacy policies as part of my job. I can't make 
heads or tails of them, and that's my job, right? They don't 
actually say what companies are doing. They reserve really 
broad rights to do stuff.
    Actually requiring disclosure kind of like SEC filings 
would, I think, will probably have some degree of 
accountability for consumers who should not be affected, read 
those but for regulators and for folks like me who, like, try 
to rate products based on these sorts of things, there should 
be easier kind of global choices. I talked about do not track, 
which is a thing that I worked on for a long time. You should 
be able to, you know, opt out of everything at once. I mean, 
maybe it should be opt in for some things, right, or maybe some 
things that just shouldn't be happening.
    You know, principles like data minimization--don't just 
collect every single thing, like, through the microphone just 
because it might be interesting one day. You know, security--
well, we don't have baseline security legislation in this 
country.
    The FTC has done a pretty good job of trying to interpret 
the statutes to require it. But they've run into some 
roadblocks. You know, access to your information--if the 
company has the information about you they should tell you 
about it.
    And so, I mean, there's been proposals floating around I 
think there are some good elements to, there's some bad element 
too, but, certainly, where we are right now where there's very 
little law, right, the basic privacy law is Section 5 of the 
FTC Act, which just says don't lie. And don't lie is a good 
principle but it's not enough, right? I mean, don't lie -- if 
it's why I have these privacy policies I can't figure out what 
they're saying.
    Ms. Schakowsky. In the few seconds I have, how common is it 
that there's discrimination in terms of--and maybe that's a 
loaded word--but in terms of hiring ads that do, particularly, 
age discrimination?
    Mr. Brookman. Yes. So I am familiar with the ProPublica 
work that was pointed out--you know, targeted ads for age but 
also, you know, you are allowed to target ads based on racist 
terms, right?
    And part of the problem is, you know, Facebook is, like, a 
$500 billion company, or whatever--they make a lot of money--
but they don't have a lot of staff, right?
    They don't review all these things. It's all automated. 
It's all programmatic, which is efficient in some ways, but 
it's harder to snake out the fraud and the discrimination.
    And I have a lot of respect for the work that Mr. Zaneis 
does to try to tackle that. But by and large, I mean, you look 
at the sort of ads that you see online. A lot of times they're 
a bad experience for consumers.
    Ms. Schakowsky. Thank you. I yield back.
    Mr. Latta. Thank you. The gentlelady yields back.
    The Chair now recognizes the gentleman from Illinois, the 
vice chair of the subcommittee, for 5 minutes.
    Mr. Kinzinger. Well, thank you, Mr. Chairman. I thank you 
all for being here today.
    Professor Beales, we want the internet to continue to 
thrive but we also don't want consumers to lose faith in the 
internet because their information is being used in an 
unanticipated or even a harmful way.
    Aren't there some baseline protections that would balance 
both innovation and consumers' trust in the privacy of their 
sensitive online information?
    Dr. Beales. Well, I think the approach you're trying to get 
consumers to understand the gory details of how this works and 
make choices on a provider by provider basis is just hopeless.
    It's like trying to understand--trying to ask consumers to 
understand all of the code that's on your computer and how it 
works and what it does. It's not going to happen.
    It shouldn't be used--the information, however it's 
collected and by whoever it's collected, should not be used in 
ways that are harmful to consumers.
    But you need to figure out what harm you're worried about 
and figure out what's the best way to stop that harm 
specifically. It's not an information problem. It's what people 
are doing with the information and if there's specific things 
that they're doing that are bad that's what you ought to 
address.
    But targeted advertising isn't one of those.
    Mr. Kinzinger. Yes, and so that you basically answered my 
second question, which is shouldn't the privacy protections be 
based on the potential for consumer harm and I think ----
    Dr. Beales. Absolutely. Absolutely.
    I mean, I think it's always been telling to me that in 
Europe it's about data protection and in the U.S. we do privacy 
through a consumer protection agency.
    Mr. Kinzinger. More people now access the internet from a 
device--phone, tablet, or IOT product--than from desktops or 
laptops. Knowing the geolocation of a consumer is increasingly 
important to these companies. Not only can companies target ads 
based on location but companies like Google and Facebook can 
assemble profiles and patterns of life about consumers.
    I would like to hear your opinions about as to whether 
precise geolocating information should be considered sensitive 
information, meaning consumers should have to affirmatively opt 
in for tracking and collection of their location.
    So Mr. Zaneis, can you explain to me how consumers are 
tracked between devices and how is it that ads on one device 
might be seen on another?
    Mr. Zaneis. Sure. Thank you for the question.
    Just to be clear, TAG does not work on consumer privacy 
issues. But I certainly have a lot of experience here and have 
testified in front of the subcommittee in the past on privacy 
issues and data issues. So I am happy to elaborate a little 
bit.
    Certainly, there are technologies--desktop and mobile 
browsing is technologically different than mobile apps, and 
cookies don't generally exist in the mobile app space. So you 
have different types of identifiers such as device identifiers 
for a mobile phone or a tablet that can be used.
    But the concept is the same, which is advertising requires 
an identifier. Whatever it is is less important. The technology 
that empowers it is less important than what it is, and we've 
proven, as an industry--Ms. Glasser mentioned the Digital 
Advertising Alliance and the Network Advertising Initiative to 
wonderful self-regulatory programs not dissimilar from TAG that 
have been able to put in place consumer protections even in the 
mobile space.
    Really, the key is to be technology agnostic but to set 
policy and self-regulatory principles based on principles and 
standards that everybody must meet. I think that's the 
effective method.
    Mr. Kinzinger. Thank you.
    Back to you, Professor. There's been a lot of debate about 
the concept of selling data, which culminated with the Facebook 
hearings recently.
    These large online businesses often assert that they don't 
sell their consumers' private--personal information to anyone. 
Yet, five data companies--Google, Facebook, Apple, Microsoft, 
and Amazon--represent a combined market share of nearly $4 
trillion.
    So regardless of ownership of the data, they're well 
compensated for their commodities through the transactions that 
they conduct. What do you think of their claim that they don't 
sell consumer data and is it really as nuanced as they--as they 
say?
    Dr. Beales. Well, the way I've seen it in the context of ad 
exchanges for--you know, for the purchase and sale of the 
advertising is there's not data that's bought and sold but 
there are cooperators in that process who are sharing data.
    For example, an ad comes up that General Motors might be 
interested in. The publisher sends some information about what 
it knows about me based on the cookies that are on my machine 
to the ad exchange.
    Somebody who's a potential bidder, like General Motors, who 
knows something else about me matches that information and now 
they know more than either party knew in the first place and 
they use that information in deciding on whether to bid on the 
ad.
    But people think--companies in this space tend to think 
their data is their lifeblood and they're not going to give it 
to somebody else. I mean, they hold on to it as closely as they 
can is the experience I've seen.
    Mr. Kinzinger. And just--with 10 seconds, because I am 
going to just get yes or no--consumer privacy laws and policy 
makers have regularly complained about the length and 
complexity of consumers facing privacy policies.
    Do any of you believe consumers have a clear understanding 
of what's contained in a privacy policy? And so a quick yes or 
no from each of you would be great.
    Ms. Glasser. No.
    Dr. Beales. No.
    Mr. Brookman. No.
    Mr. Zaneis. No.
    Mr. Kinzinger. Thanks. I yield back.
    Mr. Latta. The gentleman yields back and the Chair now 
recognizes the gentlelady from California for 5 minutes.
    Ms. Matsui. Thank you, Mr. Chairman, and thank you very 
much for our witnesses here today.
    As we discuss here today and in previous hearings a 
fundamental tenet of digital advertising is explaining to 
consumers what data is being collected and for what purpose--in 
other words, providing meaningful and robust transparency.
    But that, of course, is more complex than a list of the 
information on the types of data collected and whether that 
data is sold.
    Specifically, companies are able to take user data and sell 
ads based on the data users provide to those platforms without 
having to ever sell that data to a third party, and the more 
data that platforms have access to and, importantly, the more 
they can use that data to create inferences to target these 
users, the better these platforms can target advertisements.
    Entire panel--so even if data isn't so-called sold, how do 
we work towards meaningful transparency with both more clarity 
and nuance about data usage that don't make distinctions 
without differences?
    Anyone want to start?
    Ms. Glasser. Sure. I think, plain and simple, we just need 
to be better at describing what we do. It is a complicated 
space. It does get very technical and I think the easiest way 
to explain what we do is to provide an example. Explain to the 
user what happens when they go to Facebook or why they're 
seeing a certain ad.
    I think in addition to that, the self-regulatory groups 
have made a tremendous effort toward that end by creating an 
icon that's supposed to indicate when certain types of 
advertising is happening or a certain type of data collection 
is happening for interest-based advertising which I talked 
about earlier.
    Ms. Matsui. Right.
    Ms. Glasser. I think we just need to be more clear and we 
need to write these policies much better.
    Ms. Matsui. Do you agree?
    Mr. Zaneis. I do. I mean, we all just agreed that privacy 
policies are not understandable by consumers just because you 
have to tell the truth but that's all you have to say and you 
have to disclose everything. It's not a--it's not an effective 
mechanism for disclosure, which is why programs such as 
industry self-regulatory ones--the DAA and NAI--are so 
important.
    A lot of these third-party entities don't have a consumer 
touch point. So having a very simple policy disclosure outside 
of a privacy policy is key, and I will just add I think then 
the platforms that do have a consumer touch point have done a 
fantastic job of developing things like privacy centers and 
communicating with their users clearly.
    Ms. Matsui. OK. OK.
    Mr. Brookman. Yes. I mean, I think you're right that 
companies like Facebook or AT&T they make a big deal of the 
fact that they don't sell the data, right, but then it goes 
down to the question of excess data collection.
    You know, I give Facebook a lot of information about me on 
plenty of stuff--pictures of my kids, things I like, my 
religious and political affiliation.
    But that's not good enough, right? I mean, they actually--
and this was I thought a fascinating part of the Cambridge 
Analytica hearings--a lot of the questions were not about 
Cambridge but how Facebook watches what I do in all my other 
apps and websites, and that's the thing I think a lot of folks 
object to.
    So, really, you know, AT&T is like a service provider for 
me. They never used to listen to my phone calls to try to 
target ads to me. Do they have a--should they be able to watch 
everything I do online where I have no control because they're 
my pipe in order to target ads.
    I think that's the sort of out of context data collection 
and use that I think consumers object to. I think they're 
surprised by that. I think that there should be maybe more 
prohibitions but very much at least some sort of rights.
    Ms. Matsui. Do you think the public is more aware of this 
today based upon what's happening--the coverage?
    Mr. Brookman. I think--I think there's a generalized 
awareness that our privacy is under siege. This kind of goes to 
the questions from Ranking Member Schakowsky. I think people 
feel like, I am being listened to all the time by everyone--
what do I do about it--what's happening now. And I think 
there's just a lot of paralysis and a lot of confusion and a 
lot of, like, upset, right? I mean, we talked about the poll 
numbers. People don't like it but they don't know how to----
    Ms. Matsui. They don't know what to do.
    Mr. Brookman. They don't know what to do. That's exactly 
right.
    Ms. Matsui. OK. How about you?
    Dr. Beales. Well, as I said, I think--I think the key is to 
think about what it is that we are worried about would happen 
as a result of this information and then think about ways we 
can keep that from happening.
    The information is out there. It can be observed in a lot 
of different ways using a lot of different technologies, and 
new ones will be invented if not every day every year.
    Ms. Matsui. Right. The horse has left the barn, to a 
degree, so we have to figure out what we could do about it and 
try to explain it to everybody so people understand it, and 
then it's more of sense of how we deal with our own data and 
understanding as we click on things what could happen, right?
    Yes. OK. Well, I am running out of time so I yield back. 
Thanks.
    Mr. Latta. Thank you. The gentlelady yields back the 
balance of her time.
    The Chair now recognizes the gentleman from Michigan, the 
chairman of the Subcommittee on Energy and the former chair of 
the full committee, for 5 minutes.
    Mr. Upton. Well, thank you, Mr. Chairman.
    Ms. Glasser, I want to follow up a little bit on what Ms. 
Matsui said. In your testimony, you stated, quote, ``Using and 
sharing a consumer's name or similarly identifiable information 
is not necessary in many cases to provide rich, personalized, 
and relevant advertising.''
    So what's your thoughts as to why Facebook does in fact 
collect so much information along those lines like phone 
numbers and location and calling histories? What information--
what are they doing with that if they don't really need it and 
to tee up that interest-based ad?
    Ms. Glasser. Thank you for your question.
    Mr. Upton. If you want to comment. I don't----
    Ms. Glasser. Yes. I can't speak specifically to the motives 
behind Facebook for doing it. Just simply, I don't have that 
insight.
    However, my perception of the reason why they collect it is 
when you sign up for their platform, you have to provide this 
information so you can create your actual profile page.
    Now, as I understand it, I don't think you actually have to 
give your phone number but in that case if you decide to it's a 
way that they can--they use it for a means to text you certain 
sort of updates or they can use your phone number to identify 
that particular device and be able to provide you continuity of 
services. Maybe you get a new phone but, you know, the phone 
number is the same. The device is different. It's a way for 
them to keep linking it.
    Facebook is sort of a unique case in the broader ecosystem 
because they are a subscription-based platform. When you go to 
Facebook you provide your email, your name, and all of that 
information as a condition of signing up.
    I think when you are looking on a website just like New 
York Times, for example, or the Washington Post, unless you 
have a subscription--let's assume you don't--you're not 
providing any of that information.
    You're not giving your name, your phone number, your email 
address, and you don't need to in order to get advertising 
placed on that site that's relevant to your interests or things 
that you might have looked at before.
    Mr. Upton. So you mentioned a little bit earlier about the 
icons and I know that the Digital Advertising Alliance launched 
last month an industrywide initiative including a political ad 
icon for consumers.
    Are you aware of any political ads currently branded with 
that new icon?
    Ms. Glasser. I don't, but I just haven't seen them myself. 
I am sure I will start seeing them after this conversation 
because it always comes up after you talk about it. But I have 
not myself seen them yet.
    Mr. Upton. Great.
    Mr. Zaneis, can you explain how the third-party validation 
processes exist and how they work?
    Mr. Zaneis. Third-party validation as far as our 
certifications are concerned? Thanks for asking the question.
    You know, any certification program is only as strong as 
the validation process behind it. So we work with a number of 
independent audit firms and the majority of our members 
actually go through a third-party audit, which is very 
significant and they literally are on the site, kicking the 
tires, looking under the hood to make sure that the companies 
are complying with our standards, and I will take it one step 
further, because if you go up the supply chain a little bit a 
lot of our efforts to fight criminal activity are supported by 
really niche technically sophisticated companies--what we call 
vendor companies--an anti-fraud vendor, for example--which they 
also go through an independent accreditation from the Media 
Ratings Council. So they may go with EY or somebody like that 
and go through a very extensive certification process.
    It's really key to raise the bar.
    Mr. Upton. Well, I just want to say as a native Michigander 
I really appreciate your testimony. Thank you.
    Mr. Zaneis. I appreciate it. Thank you.
    Mr. Latta. The gentleman yields back and the Chair now 
recognizes the gentlelady--oh, I am sorry, I think Mr. Green 
just walked in.
    Mr. Green is recognized for 5 minutes.
    Mr. Green. I want to thank the chairman and the ranking 
member for holding this hearing. The two biggest online privacy 
scandals in the past year has come through this subcommittee--
the Equifax breach and the Facebook Cambridge Analytica issue--
and I hope we can soon see some legislation on the books to 
protect Americans online.
    Mr. Brookman, we know that small businesses as well as 
larger corporations sometimes benefit from consumer data since 
it allows them to show their ads to customers who are mostly 
likely to want their product.
    Do you know--do we know how common it is for small to 
medium-sized businesses to use tracking technology as compared 
to larger businesses?
    Mr. Brookman. I don't have that information. But I will 
grant the point--that it's small businesses, large businesses. 
Lots of companies rely--use behavioral targeting ad tracking to 
reach their customers.
    I will also concede Dr. Beales' point that in some cases 
those ads may be more valuable. I do think the vast majority of 
ads are not in fact behavioral and I do know that leading 
publisher trade associations like Digital Content Next--they 
used to be the Online Publishers Alliance--have been one of the 
more aggressive forces calling for actually privacy protection. 
Even though--and we are a member too, right?--I mean, even 
though those companies use targeting, they think it would be 
better for the ad ecosystem if there were some more protections 
in place.
    It would be partly just for confidence in the ecosystem, 
partly because a lot of the excess consumer surplus is just 
flowing to companies, to Facebook, and to Google and also 
because, I mean, they're seeing companies or users deploy ad 
blockers because the self-regulatory efforts that have happened 
so far haven't been sufficient to address a lot of these 
concerns.
    Mr. Green. OK. Any--do you have any thoughts on whether 
there are any way for any potential online privacy law at the 
Federal level to balance potential benefits to businesses along 
with better consumer privacy?
    Mr. Brookman. Yes, absolutely.
    I mean, it's a thing that I've worked on for a number of 
years. The United States is kind of an outlier around the world 
and most countries have some sort of basic privacy laws on the 
books to give folks control.
    United States is one of the rare exceptions so they don't. 
The default law is just don't lie to folks, which has not been 
sufficient to really safeguard privacy.
    So yes, having something on the books that provides better 
information--again, I don't want all the onus to be on 
consumers to try to figure out, you know, every single thing so 
I think, you know, a lot of this out of context data 
collection, data usage, may be, you know, should be prohibited 
in some cases, right?
    At the very least, though, there should be some more--at 
least a stronger ability to say no, right? A lot of folks 
just--you know, they feel like they want control. They feel 
like they're being monitored. They wish they could do more. 
They don't have the information or ability to do so today.
    Mr. Green. Well, and after our hearing with Facebook, we 
realized that, you know, somewhere along the way you can't 
accumulate this data without marketing it and that's the 
reason.
    But like you said--and I hear, you know, the balance of the 
consumer privacy--I really want to get permission for it. I 
don't want them taking it from me without knowing.
    Can you discuss ways to balance the consumer privacy, which 
polling shows is extremely the high priority for Americans, 
with any benefit that may sometime come from these ads?
    Mr. Brookman. Yes. I mean, Facebook has a lot of 
information about me. They have--like, they know where I live. 
They can serve me plenty of targeted ads.
    What I object to is them watching every place I go online, 
you know, in order to monitor me in ways I don't expect.
    They started doing that back in 2011 or so when they 
started rolling out like buttons and people would see a like 
button--``Oh, I can press this, I can click `like.'''
    What it didn't realize is that meant Facebook was watching 
them whether they clicked the button or not, right? And so 
that's the sort of thing I think folks object to. That's the 
sort of thing I think--I saw a lot of Members of Congress were 
objecting to during the Cambridge Analytica hearings--that's 
the sort of thing I think consumers, like, don't expect and 
that there should be stronger rules in place for, whereas today 
there really aren't.
    Mr. Green. Well, I even have a staff member who said he was 
planning to get married so he was looking for wedding rings, 
and all of a sudden he saw these adds all pop up on his 
handheld.
    So, I mean, it's a problem but how do we deal with it? 
While you were at the FTC you worked on a commissions cross-
device tracking report. Can you tell us some of your concerns 
about companies following people across these multiple 
platforms?
    Mr. Brookman. Yes, absolutely. So I think it's just 
unexpected in ways that folks, you know, don't necessarily 
think that just because I am on my phone I will suddenly--if I 
am searching for ``wedding ring'' on my phone, suddenly on my 
desktop computer--which, by the way, I share with my live-in 
girlfriend--suddenly she starts seeing pop-up ads over there 
for the wedding rings I was looking at.
    I think a lot of folks don't necessarily expect that, and I 
think they----
    Ms. Schakowsky. You better get married.
    [Laughter.]
    Mr. Brookman. Exactly. It's a lot of pressure.
    But I think, I mean, the information is used in ways that 
are surprising. So online tracking used to be fairly anonymous, 
but now if you go a publisher you type in--if you log in on, 
you know, Justin at Gmail, you know, that website might then 
spew out to a bunch of ad networks, hey, that's Justin, right? 
And so they are now tracking by real name in ways that they 
hadn't done before.
    And so I think these are the sorts of things that are 
unexpected, and I think when people know about them, they're up 
in arms. They're controversial, and they wish there were more 
limitations or at least controls around.
    Mr. Green. Mr. Chairman, just briefly, I heard that if I 
have a smart TV and I have my handheld, my iPhone, they can 
actually know what they're doing and together. Is there any 
solution there? Should we just turn it off?
    Mr. Brookman. Yes, it's tricky.
    Mr. Green. I really don't like the appliances talking about 
me.
    [Laughter.]
    Mr. Brookman. It's a big conspiracy, and I wish they would 
knock it off.
    You know, things like--most of these companies do offer, 
like, opt out. So there are controls, but they're kind of hard 
to find.
    And so, I mean, one thing we try to do in Consumer Reports 
is, like, say, ``Hey, if you want to knock this off, here's how 
to do it.''
    It's just, like, a lot of labor, right? I mean, we all have 
a lot going on. We don't want to have to spend, like, half an 
hour configuring our smart TV to, like, not talk to the 
toaster, right?
    I mean, there should be some things that by default just 
don't happen.
    Mr. Green. Thank you, Mr. Chairman.
    Mr. Latta. The gentleman's time has expired and yields 
back, and the Chair now recognizes the gentleman from New 
Jersey for 5 minutes.
    Mr. Lance. Thank you, Mr. Chairman.
    I want the panel to know I've been happily married for a 
generation, and none of these matters pop up on my computer.
    This subcommittee had Mr. Zuckerberg testify before us two 
months ago. As others on the panel have indicated, reports last 
week revealed that Facebook has data assuring partnerships with 
many device makers, including Chinese firms that U.S. 
intelligence agencies have labeled national security threats.
    Following these reports, I sent Mr. Zuckerberg a letter 
indicating my continued frustration with Facebook's handling of 
users' data.
    I reiterated a statement I made at our April hearing that I 
believe Facebook may have violated its 2011 consent agreement 
with the Federal Trade Commission.
    I believe Facebook's issues are interrelated with the 
subject of this hearing, digital advertising, as the company 
makes the vast majority of its profits from advertising, 
reporting $40 billion in revenue from advertising alone in 
2017.
    Another issue I am concerned about is the increase in fake 
news advertisements and foreign interference in our electoral 
process.
    I am one of the co-sponsors of the bipartisan Honest Ads 
Act, which enhances disclosure requirements and transparency 
for online political advertisements.
    I was pleased that Facebook pledged its support to the 
bill, and I thank the panel for being with us this morning.
    To the panel in general: From your expertise, how do 
companies balance the need to protect privacy while also 
offering the most effective advertising platforms to their 
clients?
    Ms. Glasser.
    Ms. Glasser. Thank you. There are a lot of things that we 
do before we engage with a company for advertising or analytic 
services.
    To us, it's of paramount importance to make sure that we 
are working with companies who behave appropriately and who do 
the right thing. It's our reputation on the line, and if we get 
caught up in things like misuse of data or data collecting--
being collected improperly, you know, that's a clear black mark 
on us.
    At the same time, we can't obviously control other 
companies. However, we have some expensive due diligence that 
we put in place, whether it starts with reading a company's 
privacy policy, ensuring they offer opt-out, ensuring they're 
actually describing how their services work, if they just 
describe data collection on their own website that doesn't 
necessarily get us where we need to be because consumers are 
using their services and their platforms and not necessarily 
their website.
    So we go through some extensive efforts to make sure that 
the companies we are working with are at least taking an effort 
to do the right thing, whether it's members of industry 
associations such as TAG or the NAI and DAA, it provides a 
level of comfort to know that they too recognize a lot of the 
issues and that they too are obliged to put certain protections 
in place.
    Mr. Lance. Thank you. Others on the panel?
    Mr. Zaneis. Yes. I think Ms. Glasser nailed it as far as 
every company really has to take privacy very seriously because 
it impacts their reputation in his market and it's a very fluid 
market. It's a very diverse market, and consumers can go to any 
of your competitors with one click.
    In my experience, it's been companies--early adopters in 
self-regulatory programs--it's a good signal that they care 
about it and in working it helps establish both the Digital 
Advertising Alliance almost a decade ago and now TAG 3 years 
ago. Facebook has always been an early adopter and a good 
participant.
    Mr. Lance. Mr. Brookman.
    Mr. Brookman. Yes. I mean, I will ultimately grant that, 
you know, I have friends that--who work at privacy companies 
and they do a lot.
    I just think that the balance is off--that there's always 
this wide-eyed enthusiasm that big data will save everything 
while folks tend to be very dismissive that things might go 
wrong.
    And I think, you know, the consequences if they go wrong, 
there really isn't enough risk. There's not any--Ranking Member 
Schakowsky talked about how the Federal Trade Commission--you 
know, even if a company does violate the fairly week laws that 
we have can't get penalties in most of the cases. They have a 
limited staff to police--like, again, all these things that, 
again, leading academic experts can't even figure out.
    When I was at the FTC, you know, I worked in their 
division, their office of technology, research, and 
investigations designed to try to help bring more tech 
expertise to the FTC. But we were understaffed. And so I think, 
you know, there's just not enough reason to try to safeguard 
privacy in the existing legal framework.
    Mr. Lance. Thank you. My time has expired but I look 
forward to working with all of the distinguished panel members.
    Thank you very much, Mr. Chairman.
    Mr. Latta. Thank you. The gentleman's time has expired, and 
the Chair now recognizes the gentlelady from Michigan for 5 
minutes.
    Mrs. Dingell. Thank you, Mr. Chairman.
    I am not calm like anybody here. I listened to all of you 
this morning. I've listened to my colleague, Ms. Schakowsky. I 
don't have an Alexa in my house. I don't want anybody 
listening.
    We've seen examples of people knowing that we are being 
listened to and, you know, in the past we've been told to just 
trust companies that hold our personal information, and that 
our information was used in a transparent process.
    We, obviously, now know that that's not the case and I 
think, quite frankly, the trust is wearing thing. You say, 
well, consumers are kind of worried about it but what can you 
do about it.
    Consumers don't understand how much that data is being used 
and how it can be used.
    Dr. Beales, I didn't sleep last night. I was up all night 
for two reasons. One, I pulled out my paper from my graduate 
school on public good, and I think that what we are talking 
about today in the internet is not a public good and I am going 
to write a paper.
    I was up until 3:00 a.m., and you're going to be the first 
copy to get a--first person to get a copy of it.
    And two, Michael Chertoff has a new book out on privacy and 
was talking about how the Chinese are using all of this data to 
actually--we think it's innocent.
    The Chinese are looking at who does these searches and 
compiling them and grading them, and how people get jobs, et 
cetera, and that's what's happening here.
    How do we know that this data, viewed alone, thousands of 
data points collected on each of us, don't paint a picture 
other than our, you know, our interests, curiosities, or 
preferences?
    But when they're combined together, they create a vivid 
mosaic of both our online and offline who we are, and we don't 
know who that's being shared with, and trust me, I don't trust 
you to say it's not being shared with lots of people.
    It should raise concerns for consumers. We've got laws that 
protect people at work, on the streets, and in their homes, and 
with the lines continually blurring between online and offline.
    I think we have to address these issues and we need to be 
doing a lot more to protect consumers and educate them. They 
think there's nothing they can do and what does it matter--it 
could matter a lot.
    So, Dr. Beales and Ms. Glasser, what are the market 
incentives for companies to not collect as much information as 
possible? There are none, I would like to say that.
    Dr. Beales. I think--I mean, collecting information has 
some cost. It's usually not very big, and so the incentive 
tends to be to collect more of it, and we'll see whether it is 
good for something.
    There's an incentive not to collect, I think, information--
that people are going to be reluctant to give you. I mean, if 
you do survey research you always ask questions about income at 
the end because a lot of people will stop answering question 
when you ask that question and you don't want to lose the data. 
There's not a lot of incentive.
    Ms. Glasser.
    Ms. Glasser. Sure. I think that there is definitely a lot 
of--a lot of reasons why companies would want to limit the data 
that they're collecting, first of all, for legal reasons, 
right? I mean it depends on which sector you're in and, as we 
all know, there are different sectoral logs here in the U.S. 
that protect different types of information, particularly CAPA.
    Now, I don't want to collect personally identifiable 
information by children, which includes cookies and personal 
identifiers.
    Same thing goes for health care or finance. I, as a 
company, have a vested interest to limit the data on collecting 
for several reasons.
    I don't want to risk a lawsuit. I don't want to risk 
enforcement by the FTC, not even from a legal perspective--of 
course, that's terrible, but--I mean, depending on whose side 
you are, but also because I don't want the press and I don't 
want people to know that I got caught doing something I 
shouldn't have been doing.
    I think the other reason is, if I am collecting all of this 
data that I don't necessarily need, I run the risk of 
collecting bad data, and when I am collecting bad data and it 
comes to be found out that it's bad data, then I have to go and 
purge all of my data that might be connected to that bad data 
and that comes at a tremendous cost to my company, literally, 
in money what it costs to have engineers and people go through 
the systems and do that. It also comes at a reputational cost 
as well and it could slow down business because we have to now 
remove this entire data set.
    So for me and for our company, there's, clearly, a vested 
interest to collect only what's needed.
    Mrs. Dingell. So I am almost out of time. So I am going to 
do more questions for the record. But I will give you all 
another example.
    I was prepping for a committee hearing. I stay up nights. 
They call me Dr. Google. But was doing opioid research and by 
the next morning was getting drug rehabilitation centers to 
check myself into, and I didn't want anybody to think that I 
was a drug user.
    But that's the kind of data that's being collected and then 
a potential employer can buy that from somebody. People don't 
think about it. I hope we can get them to.
    Thank you.
    Mr. Latta. The gentlelady's time has expired and the Chair 
now recognizes the gentleman from Kentucky for 5 minutes.
    Mr. Guthrie. Thanks a lot, and thanks for being here. And 
this is serious and really trying to figure out where we draw 
the line in public policy in this.
    I've said before that, you know, I am from Kentucky. I love 
college basketball. The most frustrating thing is every 4 
minutes you get a TV timeout.
    But I get to watch it for free because I got to watch the 
ad. And we are talking about free content. I think Mr. Brookman 
said people don't want to trade free content for the violation 
of privacy.
    And what will be interesting in some of these apps would 
have a subscription so you can subscribe and you get no ads 
whatsoever and see what people choose. That would be 
interesting to see where people move forward with that.
    But and I was in Ms. Schakowsky's district trying to figure 
out how to get around Monday--trying to get around traffic to 
get from Sheridan Road to Lake Shore Drive.
    And the app I was using popped up an ad right when in 
needed to make a critical turn. So that was--so there's a 
difference in frustrating--but I was in your wonderful 
district. Might ever trying to get me lost so I would stay in 
Chicago.
    Great city, by the way. And so we are trying to figure out 
what's, like, just nuisance and stuff you have to fool with and 
pop-ups and then really what gets into what some of the things 
that Mr. Brookman has talked about and where we need to draw a 
line.
    So just kind of the process of this. So, Ms. Glasser, 
first, so how do the--these target audiences are created by 
additional ad companies.
    I mean, just kind of how is that--I think we've kind of 
gotten into it. They look at all the different ways that you 
move forward. Can you kind of describe how a target audience 
from a digital ad company is created for--generically for 
somebody who's wanting to create an audience?
    Ms. Glasser. Sure, I would be happy to.
    So, basically, what happens is we talk about intra space 
advertising. Typically, we'll used intra space advertising to 
build these profiles and target audiences and what we do then 
is we actually will see what websites you have gone to over the 
course of time.
    So maybe one day you're visiting MapQuest to get 
directions. Another day you're on a gardening website. Then 
you're on the New York Times and then you're looking to buy dog 
food, and algorithmically and using modelling and science they 
are able to sort of piece these things together and, you know, 
put you in a certain age range--say, you're male, you live in 
Kentucky and you have an interest in gardening and dogs. Simple 
enough, right?
    That's basically an interest category. We then provide that 
data to other partners for them to target the specific 
audiences but we'll use the data collected over different 
websites over time to build up these profiles and to get a 
sense of the different interests so that we can build these----
    Mr. Guthrie. And then you build up ads that I want to see. 
That's the kind of the things instead of generic, like, when I 
do the basketball whatever comes on I got to watch but ads I 
want to see.
    So I don't have an issue with that but just trying to 
figure out where we draw the line.
    So, Professor Beales, you talk about or it's been suggested 
that online advertising market can operate like an financial 
exchange where people bid on the ads and people--I heard you 
talk about that earlier today.
    How does that work? I mean, how does that kind of--I didn't 
realize that happened.
    Dr. Beales. Yes, there's an----
    Mr. Guthrie. Usually, like here's a group of dog lovers 
from Kentucky so here's an ad that--and so somebody will bid on 
to get the ad----
    Dr. Beales. Well, you go to a website and the website will 
say here's an ad--here's the limited information that website 
has, other than you're on that website. That may be all it 
knows but it may be part of the network that knows something 
more.
    It passes that information to the ad exchange, which passes 
it on to potential bidders, which are typically advertisers or 
advertising agencies who have other information about you.
    Mr. Guthrie. Well, I will go to the--going to a website and 
boom, all this starts taking place instantaneously?
    Dr. Beales. Yes. Absolutely. Absolutely.
    There's a fascinating video that I think is 70 milliseconds 
or something like that, which is about how long it takes to 
actually serve the ad.
    Different advertisers bid. You know, I've got this great 
dog food that I know you're really going to like so I will bid 
a lot for your exposure. I win the auction, and the you get the 
dog food ad.
    But there may be dozens and dozens of advertisers that bid 
for that particular availability, each of who has a little bit 
information about what--about you, about what you might be 
interested in, and the one who thinks you're most valuable is 
the one----
    Mr. Guthrie. And, obviously, the more information I have 
the more valuable I become to that--whoever's bidding, 
obviously. The more they know my likes, the more they're going 
to bid on what I--and so therefore, to get me on somebody's 
website they're going to provide better content.
    So I will use their--so they kind of--it works that way, 
but it just gets into the--but they have to have so much 
information on you so that--are there things that you think 
need to be protected in that or people just need to know, going 
in, and that it's an open process?
    Dr. Beales. Well, I think it's a more going in--a known 
going in and I think it's more think about----
    Mr. Guthrie. The thing is if everybody's a good actor we 
are--I mean, the problem is the bad actor. If everybody's a 
good actor, then it makes me more valuable to that advertising.
    It makes somebody want me on their website. They're going 
to provide better content that I will then enjoy using. That's 
why I go there. And so it all works. But how do you protect 
against the bad actors in that?
    Dr. Beales. I think you got to think about what I means to 
be a bad actor and then try to restrict that particular 
conduct. It's not that--it's not that a lot of people know 
something about you from your various online behavior.
    It's what bad do we think might happen. I mean, 
Congresswoman Dingell's example of what China's doing--I mean, 
the problem there is the Government has got that data, and to 
the extent that that's a problem, that's a problem we can 
address directly by making it harder for the Government to get 
that data.
    But it's what are--and I think we need to ask what are the 
bad actors doing with that information that could be harmful, 
because we need to try to address the bad things that could 
happen to consumers.
    But it's not the information collection that itself is the 
bad thing. The bad thing is what somebody does with that.
    Mr. Guthrie. OK. Thanks. I am out of time. I yield back.
    Mr. Latta. The gentleman's time has expired and the Chair 
now recognizes the gentleman from California for 5 minutes.
    Mr. Cardenas. Thank you, Mr. Chairman, also Ranking Member 
Schakowsky for having this hearing, and I would like to thank 
the panellists for answering our questions and helping us make 
sense of all of this, and there's a lot of all of this involved 
here. It's very, very new to the human psyche and the human 
element.
    You know, this is on the heels of the Facebook scandal and 
the hearings that we've had here. But at the same time, I think 
that it's important to note that that's just the tip of the 
iceberg.
    There's a lot going on out there and a lot that we don't 
hear about, and I think that Mrs. Dingell brought up some good 
points about just getting online and all of a sudden the next 
day, you know, you get certain pop-ups and like she said, who 
knows in the future if people are going to use that against 
someone saying, hey, are you really an opioid addict because we 
got some information on you and you spent a heck of a lot of 
time looking at this stuff.
    But then again, she's just doing research, but at the same 
time, people are going to use that data as they wish, and what 
is unfortunate is that we have a lot of small businesses out 
there who are benefiting from this, who are able to compete now 
in an environment like never before with larger businesses, 
that are creating jobs.
    In my district alone, for example, it's come to my 
attention that thousands of jobs have been created just in my 
district alone because of this new technology and these new 
efforts.
    And when it comes to the economic boon as well, there is 
economic pluses. When you talk about thousands of jobs, you're 
talking about hundreds of millions of dollars of money that's 
coming into my community.
    So there is positive to all this as well. But where is the 
balance? And in that comes my first question is what data is 
collected from consumers and also what kind of data do 
companies pay for the most and what information about consumers 
is most valuable to them.
    If anybody can give me some perspective on that.
    Ms. Glasser. I would be happy to try.
    Mr. Cardenas. Sure. Thank you.
    Ms. Glasser. I think the answer is really it depends. I 
think it depends on what your end goal is as far as what data 
will be most valuable.
    I think it also depends on who you're trying to reach and 
what type of company you are. Again, I think all of us at least 
up here--I can't speak for everyone else--are true believers in 
data minimization, transparency, and principles along those 
lines.
    So as far as data minimization you only collect what you 
need and that would not typically fall into the area of 
egregious practices.
    Mr. Cardenas. Anybody else?
    Mr. Zaneis. Yes, I would be happy to answer that, and it 
relates very well to Congressman Guthrie's question just a 
second ago.
    Obviously, some of your web browsing behavior is going to 
be collected and so if you go to another website and we are 
talking about the real-time bidding, somebody then thinks since 
you want to buy dog food may think that you're worth, you know, 
20 cents for that impression--somebody then knows that you just 
went to a--to autodealer.com or something like that--may think 
you're worth $20. And so that kind of information is very 
valuable.
    But I also want to make sure we don't lose focus and get 
too myopic just on advertising because this kind of information 
is collected for all sorts of purposes.
    At TAG, we collect from our member companies' IP addresses 
and we use them to fight fraud. We have something called a data 
center IP list and it has 40 million IP addressed that generate 
fraudulent nonhuman traffic.
    This is incredibly valuable tool to fight criminal activity 
globally and it only comes from companies. So if companies are 
restricted from collecting that kind of information, perhaps 
under GDR-like restrictions or the California privacy 
initiative, that's going to harm law enforcement and industry's 
efforts to fight crime.
    Mr. Cardenas. Yes, go ahead.
    Mr. Brookman. Yes. So the question of, you know, what 
information is collected, I mean, I think my main thing would 
be that more and more information is collected from more and 
more devices in confusing and often in transparent ways.
    So if I am with Congressman Guthrie watching a basketball 
game I think I am likely to expect some ads targeted to the 
content to what I am watching, right? I am going to see ads for 
trucks and for beer, and that's contextual and that's fine. I 
think people appreciate that.
    What I might not expect is then for my ISP to then tie what 
I do on a connected computer, right, and maybe I am looking for 
wedding rings and suddenly I am watching the game and a big ad 
for wedding rings comes up based on what I did on a different 
device and watching the game with my girlfriend.
    This is the thing I think people are confused by and it's 
increasingly capable, rights. I mean, TV ads used to be not 
targeted to individuals. Increasingly, they can do that, right, 
and tie it to your behavior online or they can tie it to the 
email address that you give them, and that's the sort of thing 
that I think people--we are all kind of grappling with.
    You know, how do you put in place, you know, because it is 
valuable, right? I mean, yes, I suddenly need to spend a lot of 
money on the diamond ring right now.
    But I think people still wish they had autonomy and control 
over the things they own.
    Mr. Cardenas. Thank you. My time has expired.
    I yield back. Thank you, Mr. Chairman.
    Mr. Latta. I thank you very much. The gentleman's time has 
expired.
    The Chair now recognizes the gentleman from Indiana for 5 
minutes.
    Mr. Loebsack. Thank you, Mr. Chairman.
    I guess this could be one of those things, be careful what 
you wish for.
    I remember 25, 30 years ago, you know, people thought this 
would be great. And it is. It really is. It's transformational 
to our world, but also there some downsides. It's a serious 
issue.
    And Mr. Zaneis, you point out it's not only about ads, it's 
about national security. It's about all kinds of law 
enforcement. And so that's why we have to really strike a very 
good balance here about what we do regulatory-wise or 
legislatively as it relates to this issue.
    I also think do you--does any--do we think that there's a 
generational difference in concern over this? Because I have 
some sons who are in their 20s and my son has an Alexa.
    You know, I went to this apartment and he had it. I am, 
like, don't you--they just don't seem to be concerned about it. 
Do you think that's a problem? Do we need to--do we need more 
education maybe of people who are now--have never grown up with 
the internet?
    I mean, anyone--Mr. Zaneis--about why this is actually a 
legitimate serious question that it's just not about--just not 
about turning on some jazz music, which he did, which was 
really cool.
    You see what I am saying?
    Mr. Zaneis. Absolutely, and I will say that there are--of 
course, there are generational differences. Without a doubt, 
folks that are, you know, digital natives and folks are not.
    I will say this. Everybody cares about privacy, and 
sometimes you hear folks say, oh, young people don't care about 
privacy.
    It's not that they don't care about privacy. It's that they 
understand the trade-off a little bit better in order to get 
services and they are more willing to trade off certain privacy 
and data in order to receive the services that they are sort of 
entrenched in.
    So there are studies. I will just say that I am sure Mr. 
Brookman has some great numbers. Anybody can show you a study 
that says either 90 plus percent of people are really concerned 
about privacy or, you know, 90 percent of people love the 
digital services they get and are willing to trade off.
    Mr. Loebsack. Sure. I understand.
    Briefly, Mr. Brookman, because I've got several questions.
    Mr. Brookman. I think--I think young people actually do 
probably care about privacy just as much. They tend to be a 
little more tech savvy so they----
    Mr. Loebsack. Do you think they're just resigned to the 
fact that it's not going to happen?
    Mr. Brookman. I actually don't because, like, for example, 
you think about who uses ad blockers, right? It tends to be 
millennials and younger people.
    Mr. Loebsack. OK.
    Mr. Brookman. They have the ability--they feel they have 
more control to take back their privacy, I think.
    Mr. Loebsack. This is a general question. You know, so I 
don't generally quote from the media but there was media person 
here in town that walked around town with a couple of 
smartphones.
    One phone had all the things that was, like, on airplane 
mode, all the Wi-Fi and Bluetooth was off, and the other phone 
was hard turned off. I mean, it wasn't just--you know, they had 
it completely turned off.
    Walked all around to different locations around DC--this is 
actually very fascinating--then went back to studio and then 
turned these phones back on, and had a tech person be able to 
monitor what happened once they turned them back on.
    And all this meta data from everywhere they had been on 
both devices, by the way, even the one that was hard turned 
off, was--showed up on the screen and was jettisoned out to the 
world.
    And so location--I think the location stuff is really 
important, because they had stopped at a park bench by the 
cathedral and went to a Starbuck's and all that, and all that 
was known.
    Do we know--Consumer Reports would maybe answer this--do we 
know--was this a media--was this just the media that did it or 
do we know that phones do this?
    Because it becomes a hardware issue, right? It's not a--
this is a national security thing, because some of our--we 
have, you know, hardware that's been imported from all around 
the world that's in some of our devices, and our devices are 
made in other parts of the world.
    I mean, do we know that this can happen?
    Mr. Brookman. So I've seen reports that Android phones, 
when location services are turned on, do collected a lot of 
information which I would personally find surprising--collect 
barometric information, seem to know what floor you're on and 
they guess whether you're on a train or on a bike or walking 
around--in ways that I think that a lot of people would object 
to.
    I don't know that they do that when the phone is hard 
turned off. I think that would be bad, if that were the case, 
because it is an issue of security. Location information is 
very sensitive.
    I get Google uses location for, like, really useful things 
like Maps, which I use all the time, right, and I believe they 
probably have some protections on the back end to anonymize it.
    But, I mean, as a user, like, how do you know, and it is 
disturbing when you do find out the raw feed that does get 
uploaded, I don't know if it is quite as extensive as what 
you're talking about but it is extensive and surprising.
    Mr. Loebsack. Yes. I mean, I just want to bring that point 
up that, you know, we are talking about apps and websites and 
everything. But for all the other reasons that Mr. Zaneis 
talked about other than advertising, we have to be concerned, I 
think, also about whether our hardware is that's in our devices 
and computers.
    You know, we can turn everything--they turned everything 
off and it didn't matter. And whether that's true or not I 
don't know because it was a media report, but it's concerning.
    I yield back.
    Mr. Latta. Thank you. The gentleman's time has expired and 
yields back.
    The Chair now recognizes the gentlelady from California for 
5 minutes.
    Mrs. Walters. Thank you, Mr. Chairman.
    Mr. Beales, this first question--it's a three-part 
question. It's actually for you.
    What steps can be taken to enhance competition in the 
market for online advertising and what are some of the 
advantages and disadvantages of the way the market and the ad 
tech works today?
    And are reports that Google and Facebook control 90 percent 
of the market true?
    Dr. Beales. Let me start at the end. I don't really know 
what the markets shares are, but I don't think 90 percent is 
remotely right.
    I would think it's more like 50 or 60 percent. But that's a 
fairly well-establishable number that is not hard to find out.
    And one of the interesting things about the online 
ecosystem is we don't know what's the most efficient way to 
organize this, and people are trying lots of different things 
and it's changing on a very regular basis.
    I mean, the whole idea of ad exchanges is probably not 10 
years old yet as a way to distribute this content, and people 
are finding out the pros and cons of different approaches and 
then trying alternatives because it's a very innovative space 
and that is the engine of competition.
    What got Google and Facebook to where they are was better 
mousetraps, if you will--different mousetraps in each case--and 
the competitive pressure in this market is in part from the 
third-party providers that don't have sign-in but do get some 
of the same information in indirect ways, and it's really 
important to preserve that competition.
    Mrs. Walters. OK. Ms. Glasser, as someone who went to law 
school and studied privacy, do you believe that there's an 
adequate understanding or amount of training on data privacy by 
entrepreneurs, engineers, coders, and et cetera who build these 
products?
    Ms. Glasser. I can really only speak from some of my 
experience and what I've seen, and I don't think that there's 
enough education.
    I am very fortunate where I kind of fell into privacy by 
accident where I was a law student at night working full time 
so I had to take what was available to me, and that was 
typically the privacy stuff because I guess no one else was 
interested in it.
    But it turned out to be quite fruitful for me so I am 
grateful. I've always said that I am a firm believer in 
education and even if it's education about privacy or how to 
code or how computers work, I think education on how the 
internet literacy period is also extremely important, whether 
it comes to children, advertising, you know, how to help 
elderly people recognize scams or fraud.
    Absolutely, I don't think--I don't think that we could do 
ourselves wrong if we encourage more education in this field.
    Mrs. Walters. OK. Thank you, and I yield back the balance 
of my time.
    Mr. Latta. Thank you. The gentlelady yields back.
    The Chair now recognizes the gentleman from Florida for 5 
minutes.
    Mr. Bilirakis. Thank you, Mr. Chairman. I appreciate it.
    Professor Beales, you mentioned in your testimony that 
advertising is particularly important to less advantaged 
groups, particularly minorities and single parent households.
    I am also curious as to your perspective on the senior 
population. How would regulation in the advertising space 
affect these particular groups?
    Dr. Beales. Well, the--what the academic research shows 
about the impact of advertising is there are some people who 
are better at either using information or have more time to use 
information, and that's where those people who are good at 
information and have the time use information that's available 
from other sources and they're less dependent on advertising.
    The people who don't have those advantages need the 
information in an easily digestible form and that's what 
advertising does is it boils it down to a very simple 
proposition of buy my serial, and I don't know where the 
elderly would fit on that.
    On the one hand, they got a lot of market experience and 
that would tend to mean they're not going to be all that 
dependent, and on the other hand, they also have a lot of time 
in many cases and can use other information sources in ways 
where they're less dependent on advertising.
    I don't know of anybody that's looked at that question 
specifically.
    Mr. Bilirakis. OK. Fair enough.
    You talk about the importance of transparency in digital 
advertising. This question is for Ms. Glasser. You talk about 
the importance of digital--importance of transparency in 
digital advertising but suggest that a choice mechanism I snot 
always required.
    Yet, one of the reasons we were holding this hearing is due 
to our constituents' concerns and the need to raise awareness 
about privacy.
    Do you believe that the FTC has the tools it needs to 
effectively protect privacy and do you have suggestions for my 
constituents to prevent websites from collecting information 
about them?
    Again, personal information--how do we protect personal 
information? And then, Mr. Guthrie mentioned that particular 
example but also Mrs. Dingell mentioned the example of the 
opioids.
    Give me another example of a bad thing that can happen. I 
think our constituents need to know. So this question is for 
Ms. Glasser, please.
    Ms. Glasser. I think--that's correct. Not every instance 
requires and opt out. So what I meant by that, for example, if 
I own a website and I want to know how the behavior of users is 
on my website specifically, I want to know what features of my 
website users like to interact with.
    I like to know what content they like to interact with, and 
this helps me build a better website. This helps me build a 
better platform for users to come to.
    And I am not necessarily using this data for advertising or 
marketing purposes. It's really to help me understand the 
behavior of my business, essentially, and in those instances an 
opt-out is not always required.
    However, I do think that transparency is absolutely key to 
all of this, whether you--whether you're using tracking pixels 
for analytics or you're using it for more engaged advertising 
and more engaged data collection.
    I think it's absolutely critical that these things are 
explained to the end user and the consumer so that they do 
understand, OK, I see a tracking pixel on this website, but 
they're not using it for advertising--it's being used for 
analytics--I don't have to worry. Or if it's being used for 
advertising, I can expect to see the red shoes I am looking for 
show up on the next website I go to.
    Only through our transparency can we even begin to expect 
consumers to understand what's happening.
    Mr. Bilirakis. Again, link this back, for example, Mrs. 
Dingell's situation with the opioids, doing her research--and I 
commend her for it, doing the research late at night because I 
do it, too--and then maybe years down the road they might link 
her personal information to possibly being a drug addict or 
what you.
    Is that the case? Can that happen?
    Ms. Glasser. I mean, anything is really possible, right?
    Mr. Bilirakis. Yes.
    Ms. Glasser. It absolutely can happen. But I think it's 
also important to point out that within the industry--and we've 
talked a lot about responsible actors, legitimate companies, 
the self-regulatory groups--there are restrictions on using 
that type of information for targeting and behavioral 
advertising.
    The NAI, for example, has very specific provisions on 
whether you can use health-related data--sensitive health-
related data about sensitive categories--thing like drug abuse, 
drug addiction, mental health issues, cancer, sexually 
transmitted diseases, reproductive issues, all of those things 
are really off limits unless you have opt-in consent, which I 
don't know anybody who even actively goes after those types of 
segments just because of the sensitivity of it.
    And I think when we put ourselves in our consumer shoes, 
none of us want to be targeted with those types of ads either.
    So, again, I think it comes back to some of the points that 
Dr. Beales made and Mr. Brookman made about making sure that, 
you know, we hold the bad actors accountable and we continue to 
push these standards forward and we continue to try to enforce 
these standards so that we are using the right type of data to 
target the right type of advertising--the right type of people.
    Mr. Bucshon. All right. Very good.
    Thank you, Mr. Chairman. Thanks for holding the hearing as 
well.
    Mr. Latta. Well, thank you very much. The gentleman's time 
has expired.
    And seeing that there are no other Members here wishing to 
ask questions, I again want to thank our panel for being here 
today and presenting before us. Very, very informative.
    But before we do conclude, I would like to include the 
following documents submitted for the record by unanimous 
consent: two documents from Oxford BioChronometrics, two 
documents from Interactive Advertising Bureau, a blog post from 
MPAA.\1\
---------------------------------------------------------------------------
    \1\ The Interactive Advertising Bureau documents have been retained 
in committee files and also are available at  https://docs.house.gov/
Committee/Calendar/ByEvent.aspx?EventID=
108413.
---------------------------------------------------------------------------
    And pursuant to committee rules, I remind Members that they 
have 10 business days to submit additional questions for the 
record. I ask that the witnesses submit their responses within 
10 business days upon receipt of the questions.
    And without objection, the subcommittee will stand 
adjourned.
    Thank you very much.
    [Whereupon, at 12:02 p.m., the committee was adjourned.]
    [Material submitted for inclusion in the record follows:]
    
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    
                                 [all]