Daniel Pepper, partner, BakerHostetler (Courtesy photo).

Last week, Comcast's former vice president, deputy general counsel and deputy privacy officer Daniel Pepper joined BakerHostetler as a partner and member of the firm's privacy and data protection group.

Pepper said he moved back to private practice to help a wider array of clients that are struggling in a privacy and data protection space that is becoming more complex. Indeed, Pepper noted public and regulatory scrutiny is raising the stakes for companies and their vendors' data privacy protocols.

During an interview, Pepper discussed why companies are bowing out of behavioral advertising targeting children and how the patchwork of U.S. data privacy laws may soon resemble the California Consumer Privacy Act (CCPA).

This conversation has been edited for clarity and length.

Legaltech News: Did the Google-Federal Trade Commission (FTC) settlement provide any insights into how the FTC is regulating children's data?

Daniel Pepper: I think what we are seeing is that the FTC is now focused on targeted advertisements and the use of cookies and other persistent identifiers. Until this point, there hasn't been a lot of activity and attention given to that sort of technology for tracking users activity online and using that behavior for targeted advertisements is a very common practice. 

I think what it underscores is the importance [for] companies who are hosting these sort of platforms that are targeted to children to differentiate the type of targeted ads on these properties.

Do you think there are ways to safely collect children's data with consent, or are the risks too significant?

A lot of companies don't even bother to comply because the requirements are too burdensome. To get the parental consent, to incorporate the type of technology to comply is a challenge, and companies and advertisers recognize going through those steps can really reduce the amount of views, the amount of content consumption and at the end of the day the advertisement revenue.

Apple said it's deploying a new policy for training Siri's AI with user audio. Is this purely for public relations or are there any regulatory or litigation concerns with not having an opt-out option?

There's certainly regulatory and legislative concerns when this sort of information is asked [for], especially when it's asked for overseas. You have a lot of trans-border considerations and international privacy regulations to be considered.

It's also certainly an extremely large PR consideration. Companies like Apple and Amazon are already in the crosshairs either with the FTC, state attorneys general and certainly with the European Union. They have to tread very lightly and carefully; they're already being looked at extremely closely for any missteps.

The other piece of it involves notifying consumers with respect to how their information is being used, how it's being disclosed, what's being done with it … [and] getting the appropriate consent and also managing your third-party relationships with vendors and contracts to ensure what they're doing is also compliant. That's one step that is missed by a number of companies.

How are you seeing companies overlooking that third-party process?

Many of the regulations, either explicitly or implicitly, require that the restrictions that are placed upon the company that is collecting the information is also flowed down to these contractors or other suppliers. It's more than just putting language in a contract requiring that third party to comply with the underlying obligations. There's also a separate compliance obligation to follow up with those third parties to ensure they are actually doing it.

A review of the procedures [and] policies of the third party to ensure they are actually complying is an extremely burdensome and time-consuming process, but is increasingly becoming really necessary and part of the third-party contract management process. It's really something we see as critical, especially when dealing with large amounts of personal information that is being used in ways that may not be anticipated by individuals.

With the CCPA set to go into effect in January 2020, are companies looking toward one state's data privacy law as the standard they'll meet for consumers in all states?

From what I've seen the California Consumer Privacy Act has really set the bar. It's the most restrictive [and] has the most compliance obligations when you look at what's either been enacted or what's pending in the states.

I think companies are looking to that as the benchmark and what they need to comply with even if it's not clear if they have personal information from California residents because the assumption is that this will now spread in some fashion. And many states are likely to follow suit either capturing the entirety of what the CCPA does or at least major portions of it. Putting together compliance programs that map to what the CCPA requires is where a lot of companies are going or at least should be going.