Last week I spoke at the IAPP PSR conference in Seattle after spending a jam-packed day at the IAB Privacy Compliance Salon. Today’s newsletter will be focused on IAB and next week’s on IAPP.
I always return from the IAB event with pages of notes from fellow privacy pros and regulators.
Due diligence is moving from “should” to “must”
For years, vendor and third-party due diligence was something everyone agreed was smart, and plenty of companies quietly skipped it. That is changing. Delaware is leading the way by turning diligence into a real legal requirement, with some obligations taking effect on January 1, 2027. One speaker put it the way I often do about privacy assessments in California. It used to be “you really should.” Now it is “you have to.”
So what does that look like? A written questionnaire isn’t enough by itself anymore. Teams are being asked to do real technical diligence, which means looking at what a vendor’s code and pixels are really doing instead of taking their word for it. That includes knowing what a pixel even is. Is it JavaScript that can collect a lot, or a simple image pixel that collects very little? These are the details that require deeper digging on EVERY pixel.
If you don’t have a plan for both contractual agreements and documented due diligence, now is the time to get started (let’s chat!).
The word I heard all day was defensible.
You need a process you can point to. Lots of companies are scanning and monitoring already, but scanning without a process to act on what you find does not get you far. Who is your champion inside the company? Can your team do something with the results? For the companies that have big domains, the panel reminded them that they can create bigger risks, so scan often and make sure someone owns what comes back. (And a reminder to the smaller companies, you’re still at risk too. The panel highlighted that it was not always household names that have received enforcement actions).
The technology underneath all of this keeps moving. Every page load on the web can look different.
Apps make it harder because an embedded web view changes what happens when the browser loads a page (which can happen if a privacy notice loads inside the app and goes to the mobile browser). As a result, more and more of these trackers and cookies now sit inside the app itself.
Don’t forget your privacy policy has to match where the data actually goes today, not where it went two years ago. This is one more reason a privacy program is never a set-it-and-forget-it project.
Enforcement is up, and it is not just the big names
2026 is looking like a bigger enforcement year. California is still out front, Texas is catching up quickly, and Florida and Connecticut are busy too. With each enforcement, the penalties are going up. We were reminded that MANY more regulator inquiries are happening behind the scenes than we know about.
The easy targets are exactly what you would expect, and I have been saying this for what feels like forever. These really are the same discussion points that regulators continuously raise as they keep finding issues. Pixels that are misconfigured. Opt-outs that do not work when you test them. A banner where the only real choice is to say yes. A Global Privacy Control signal that quietly does nothing. A privacy policy nobody has updated in over a year. It is the first thing a tester or a regulator checks.
There was definitely discussion that companies DO need to work on the harder concepts like cross-device tracking or different brands and device types under one company.
Kids and teens were the center of everything
Children and teens are still the hot topic right now. Someone shared an estimate that around 45 percent of internet users are under 18, and the rules here are changing fast.
There are two things to watch. Age verification laws are spreading. And the definition of “actual knowledge” that someone is a minor is getting broader. Some states now treat any known minor very broadly, including information you inferred, attributed, or associated with a child, for almost any purpose. Parental consent requirements vary in Texas, California, and other states, and no one had a good predictor of which way more states will follow – more of TX, more of CA, and hopefully not something new.
The hard part is that most companies really don’t know how old their users are, and age doesn’t sit still.
An important reminder was shared – kids age. What your system might mark them as today is not the same as next year or the year after, and the requirements might change. Consider how your company can capture this real-time adjustment.
Sensitive data, and what a regulator told us
The sensitive data session kept coming back to one question. What is your defensible posture? With health and other sensitive inferences, context is everything. One URL going to a third party might not say much. The full URL journey can. Reading a couple of articles on a general news site may not let anyone infer much, but repeated visits to a specific niche site can say a lot.
One tip I really liked: run your press releases past legal, because announcing a new business practice can give away something with a privacy impact and invite a question you did not want. This might take a process change, so identify who is responsible for product press releases and how legal and privacy can be a part of them.
We also heard straight from Bret Finkelstein, Assistant Attorney General, Consumer Protection Division, Washington State Office of the Attorney General. These kinds of sessions are always my favorite at any privacy conference.
The office leverages its Consumer Protection Act, which is focused on unfairness and deception rules with penalties that can hit several thousand dollars per violation and climb fast.
He talked about my latest favorite topic – dark patterns, which they call deceptive design. These are fair game, so confusing opt-out toggles and buried choices are exactly what they go after. A lot of their investigations never become public, so remember that a quiet regulator is not the same as no regulator.
Washington’s health law came up a lot, and the message was simple. People expect their health information to stay private, and while privacy pros might know the nuances of privacy laws, consumers do not. They think health information is health data and that it’s protected.
Think from a consumer perspective for disclosures, data use, and consumer use.
Washington recently put out its own privacy report, and the consumer research had these highlights:
- People feel they have little control over their data
- They are not comfortable with sharing they did not agree to
- And they do not feel they can opt out
In the end, it comes down to relationships and process
Privacy is a people and partnership role. Privacy teams do need to work at the pace the business is moving. Be specific with IT and engineering teams about what is needed from them.
Build relationships up and down, at every level, not only with the people who already care about privacy.
The more interest you show in what other teams are trying to do, the more interest they will show in yours. A few people called privacy pros the voice of the customer inside the company, and I loved that.
All privacy pros agree that keeping up is hard. One privacy pro reminded the audience to read the actual enforcement actions and advisories, not just put them in AI to summarize. When you read the summary, you will miss the nuances and that’s where the details are. Those details are the important lessons to take away.
Still recovering from the red-eye home and multiple days of talking non-stop with my privacy friends and learning. Stay tuned next week for my takeaways from IAPP.
Wishing you a great week!
Jodi
💡 When you’re ready, here’s how we can help:
⚙ Privacy Advisory & Implementation: We help companies navigate privacy requirements with confidence. Our advisory support covers strategy, operations, and real-world implementation.
⚙ Fractional Privacy Services: We provide fractional privacy leadership tailored to your needs and pace. From program development to day-to-day support, we help you build and sustain a strong privacy program.