Cybersecurity Policy Report, AdTech Providers Shouldn’t Burden Users With State Privacy Law Compliance, Wyden Says, (Sep 2, 2026)
Organizations Mentioned:Pay'd
Small organizations bear the burden of complying with state privacy laws because top ad technology firms haven’t configured their products for privacy-by-default, according to Sen. Ron Wyden (D., Ore.).
“Millions of everyday small businesses rely on your platforms to survive and compete in the digital marketplace,” Sen. Wyden noted in a letter sent yesterday to the chief executive officers of Alphabet, Inc., Meta Platforms, Inc., and TikTok, Inc.
To measure the effectiveness of their online advertising and marketing efforts, “businesses embed your tracking scripts deep into their websites to capture exactly what pages consumers visit, what products they view, and what sensitive information they enter,” he told the CEOs.
“This raw user data is funneled directly back into your proprietary algorithms to refine the behavioral profiles you maintain on hundreds of millions of Americans, rendering ordinary business owners the unwitting extraction agents for your advertising empires,” he said.
The companies have made it possible for businesses to disable “specific privacy-invading” features of their platforms, but that forces small organizations to navigate “complex” configurations to comply with privacy laws in states where they operate, Sen. Wyden observed.
“[I]nstead of enabling the features that comply with state privacy law by default for customer websites using your tools, your companies bury these compliance features deep within complex developer menus and technical documentation, leaving them completely deactivated in standard installations,” he said.
“Compounding this failure is your platforms’ refusal to natively and automatically honor Universal Opt-Out Mechanisms, most notably the Global Privacy Control (GPC),” he added.
“By refusing to support GPC natively within standard installations, your platforms actively pass the engineering and compliance burden onto small businesses, leaving them legally exposed when standard configurations ignore a consumer’s clear directive to stop tracking,” he said.
“By making privacy-invasive tracking that is banned in several states the default, your platforms shift the entire burden of legal compliance onto small businesses, non-profits, and local organizations that lack the specialized legal teams or engineering resources to recognize their legal peril,” he told the CEOs.
“Your platforms must transition to a strict privacy-by-default framework where your tools automatically restrict data collection in accordance with applicable state laws,” he said. He asked the CEOs to respond to his letter by Sept. 29 with their plans for making their products and services private-by-default.
News: FederalLegislation DataPrivacy