00:08
Adam Stofsky
Shannon, can you talk a bit about when companies are allowed to not just use data, but actually share it or even sell it or make money off of it? Broadly speaking, what are the rules that govern the issues of sharing and selling personal data? 

00:27
Shannon Yavorsky
So a lot of the rails around using data and sharing it with third parties come from the state privacy legislation, and they also come from the Privacy notice. So what does your privacy notice say about how you're sharing personal information with third parties? You'll often see in a privacy notice, it'll start out and say, this is the data we're collecting about you, this is how we are using the data. And then there will be a section called disclosure or sharing of personal information. And that section talks about the third parties with whom the company shares data and for what reason. So companies share data all the time. For example, with a CRM, like a salesforce or with a payroll provider, they're going to share that data. But that third party is just a service provider. You know, they're really just a platform service provider. 

01:24
Shannon Yavorsky
That's not, that third party is not using any of that data really for their own purposes. They're only using it to provide you with the service. And that's broadly permitted. And you think about companies use Google Cloud or AWS all the time and they're sharing data with those third parties, and that's broadly permitted. You have to have in some states, an agreement in place with that third party that says, thank you for providing the service. Third party AWS cloud service provider, you can use the data to provide the services, but you can't use it for any other purpose. You can't use, retain, or further disclose it for any other reason. And you certainly can't sell it. Another reason that people disclose data is when they do sell it, and that often happens in the context of the ad tech ecosystem. 

02:15
Shannon Yavorsky
So you'll often see on a website, there will be cookies, which are third party advertising trackers. That's the shoes that follow you around the Internet. And that's because of the targeted advertising cookie on the site. And largely, the privacy regulators have said that sharing of data with the targeted advertising company is a sale of personal information. And in some states, you have to give consumers the ability to opt out of that sale. And that's why we're seeing increasingly at the footer of websites, a little link next to the privacy notice that says my privacy choices, or it'll say, do not sell or share my personal information. And the reason for that is these state laws allow consumers to opt out of the sale of their personal information. In Europe, it's a different situation. 

03:10
Shannon Yavorsky
You have the, you'll often see in Europe those cookie banners that pop up and say, we're setting cookies for targeted advertising and analytics purposes and you have to click on, accept all, reject all, or manage cookies. And the reason for that is that Europe has an opt in regime. You have to opt in to that sale of personal information, that sharing of personal information, whereas in the US, we're still in this opt out regime where you have to give individuals the right to opt out of that data sale. So those are broadly some of the rules around sharing data with third parties, either to service providers or to parties with whom you're, to whom you're selling personal information. 

03:55
Adam Stofsky
I'm thinking about this. I just came back from three weeks in Europe. I did notice a difference, certainly the sort of quantity and how robust the cookie consent notices are. But I do see, I think I do see some opt in notices in the US. Am I making that up or do some companies choose to do this for some reason? 

04:16
Shannon Yavorsky
There are a few reasons we're seeing opt in notices creep onto us websites. Oftentimes people will, companies will geofence, which means they'll look at the IP address and they'll only serve that cookie banner to users that they see who are coming from Europe. And that's because the marketing folks don't like the impact to the user interface. They don't like how that looks on the website. So they, you know, if they don't have to have it, they won't have it. In the US, we're starting to see some cookie banners or similar opt in notices for a couple of reasons. One is that sometimes the website will have what's called session replay technology, which is where there's a tracker that follows your journey through the website. 

05:01
Shannon Yavorsky
And in order to mitigate risk there in relation to state wiretap law, you're asking people to opt in to that kind of tracking. Another reason we see opt in is that some of the state privacy laws require opt in consent for certain kinds of data. And an example of that is where they're collecting certain, in certain states, sensitive personal information, like health information or financial information, for example. And you're going to start seeing more of those opt in windows being surfaced to consumers in the US because of those two things, really sensitive personal information and then that wiretap risk that companies are trying to mitigate. 

05:48
Adam Stofsky
Okay, great. Thank you so much, Shannon. 

05:52
Shannon Yavorsky
Thanks, Adam.