The NAI

Trying to map digital ad data across 20+ different state privacy definitions of "sensitive health data" is an operational nightmare. From Washington to Connecticut to California, subtle statutory differences leave privacy and ad-tech teams paralyzed. But trying to manage 20 distinct legal thresholds internally only creates compliance gaps and operational bloat. Instead of drowning in legal hairsplitting, privacy teams need a heuristic approach: the "cluster concept." By focusing on the underlying policy goals regulators and lawmakers actually care about, organizations can "see the forest for the trees" and establish a clear, defensible classification process across their entire data stack. Streamline your health data classification strategy with the NAI Factor Analysis for Health-Related Sensitive Personal Information (HSPI): Link in comments #DataPrivacy #StatePrivacy #AdTech #PrivacyCompliance #HealthData #NAI #PracticalPrivacy

Trying to map digital ad data against 20+ different state privacy law definitions of "sensitive health data" is an operational nightmare. In Episode 2 of our Practical Privacy: Health & AdTech series, our VP & General Counsel Tony Ficarrotta explains why companies should shift from chasing individual statutory definitions to using a cluster concept. Key takeaways from the clip: 1️⃣ The Classification Trap: Why trying to create 20 distinct legal definitions for internal data flows creates unnecessary operational complexity. 2️⃣ The "Cluster Concept": How distilling core regulatory intent across state and federal enforcement helps privacy teams "see the forest for the trees." 3️⃣ Practical Heuristics: How focusing on underlying policy goals helps businesses make clear, defensible classification decisions. Watch the 1.5-minute clip now 🎬 #DataPrivacy #StatePrivacy #AdTech #PrivacyCompliance #HealthData #NAI #PracticalPrivacy

Believing "If it's not HIPAA, it's safe" is one of the most costly assumptions in digital advertising today. HIPAA’s protections are strictly tied to where data is collected—meaning a phone number or IP address captured on a commercial app or website falls completely outside its scope. Federal regulators evaluate commercial health data differently. Under Section 5 authority, the FTC looks beyond the clinical setting to focus on the nature of the data itself and the associated risk of consumer harm. Through enforcement actions like GoodRx, BetterHelp, and Premom, regulators have made it clear: standard advertising identifiers become sensitive health data the moment they are linked or linkable to a health condition or intimate browsing habit. Operating outside HIPAA doesn't shield ad-tech operations from regulatory scrutiny. Privacy and marketing teams need a practical, defensible methodology for classifying health-adjacent data across their ad stacks. That’s why the NAI developed the Factor Analysis for Health-Related Sensitive Personal Information (HSPI)—a practical framework designed to help organizations show their work and evaluate sensitivity based on data sources, contents, intended uses, consumer expectations, and potential harm. Assess your data classification process with our full Health Factor Analysis framework: Link in comments ↓ #DataPrivacy #AdTech #PrivacyCompliance #FTC #HealthData #NAI #PracticalPrivacy

🎬 Practical Privacy: Health & AdTech | Ep. 1: The HIPAA Myth Assuming digital ad data isn't subject to strict health privacy rules just because it falls outside of HIPAA is one of the most common—and risky—misconceptions in digital advertising. While HIPAA regulates data based on the context of collection by covered entities, federal oversight from the FTC takes a very different approach. Under Section 5 authority, regulators focus on the nature of the data point itself and the associated risk of consumer harm. In this 2-minute clip, Meaghan Donahue Giaccia Donahue (Associate at Kelley Drye & Warren LLP) breaks down the federal legal landscape: 1️⃣ Where HIPAA Ends: Why a phone number and a cancer diagnosis receive equal protection under HIPAA, but lose that coverage when collected outside a clinical setting. 2️⃣ Where the FTC Steps In: How Section 5 enforcement (in cases like GoodRx, BetterHelp, and Premom) expands health data concepts to include standard identifiers—like IP addresses—when linked to health insights. 3️⃣ The Compliance Shift: Why ad-tech teams must look beyond bright-line statutory definitions and focus on data context, consumer expectations, and potential harm. Evaluating health-adjacent data in your ad-tech stack? Explore the full framework in the NAI Factor Analysis for Health-Related Sensitive Personal Information. #DataPrivacy #AdTech #HealthData #PrivacyCompliance #FTC #NAI #PracticalPrivacy

We heard "kinda chic" was a thing. Here's our version:

In an era of accelerating state enforcement and rising compliance complexity, what does NAI membership actually offer? Four things: → Specialized, practical guidance that translates broad legal requirements into operational practice → Peer collaboration through working groups and task forces on the hardest emerging issues → An independent accountability framework — our members don't just talk about privacy, they undergo independent review → A voice in the policy conversations that shape your operating environment One member, AlikeAudience's CEO Bosco Lam, put it this way: completing the NAI review reinforced their dedication to privacy-first practices, because responsible data usage is foundational to long-term trust with partners and clients. Our value proposition has never been stronger. If your company is navigating this patchwork without a map, let's talk. #AdTech #DataPrivacy #PrivacyCompliance #Membership

Thank you to IAPP and Alexander LaCasse for covering the NAI's recently released guidance on the use of AI in ad-tech. I'm excited about the work the NAI is doing to help ensure AI is adopted responsibly while it moves the industry forward. Full guidance in comments. https://lnkd.in/dSc4NvsT

What's next for the NAI in 2026? Four priorities. 👇 Our 2025 review cycle shaped a clear agenda for the year ahead: → Continuously improve the Privacy Review Program — refining standards and building enhanced guidance around the common challenges we identified this cycle → Develop AI & advertising governance resources — practical frameworks for responsible AI in ad tech → Better inform public policy & enforcement — we heard the call for more direct engagement with policymakers, and we're heeding it → Advance the Consumer Choice Task Force — with the goal of publishing best practices for opt-out preference signals and universal opt-out mechanisms The challenges are real, the stakes are high, and the work continues. ↓ Find out more in the comments. ↓ #DataPrivacy #AdTech #SelfRegulation #PrivacyCompliance

🤖 AI is transforming advertising. The NAI's view: solve for it through privacy frameworks, not novel AI mandates. Agentic AI is poised to power the entire programmatic workflow — boosting efficiency and freeing teams for strategy. As policymakers grapple with regulating AI, we're encouraging an approach that applies existing privacy principles (transparency, data minimization, purpose limitation, consumer rights) to AI training, rather than building redundant, overlapping notice-and-choice architectures. We're watching three other shifts closely: → Privacy-Enhancing Technologies moving into practical deployment → Identity and signal evolution as third-party cookies fade and universal opt-out mechanisms grow → Emerging channels — connected TV, retail media, in-game — where existing privacy frameworks weren't always designed to fit Recent enforcement around smart-TV data practices is a reminder: compliance has to keep pace with where advertising actually happens. The NAI is actively building resources to help members govern AI within their existing privacy programs. #AI #AdTech #PrivacyTech #CTV #RetailMedia #DataPrivacy

🇺🇸 The center of gravity in U.S. privacy regulation has shifted decisively to the states. Here's what that means: With 20+ comprehensive state privacy laws now on the books and enforcement at unprecedented levels, treating privacy as a one-time compliance exercise is over. A few developments demanding attention: → California is launching its Delete Request and Opt-Out Platform (DROP), with significant per-violation penalties for noncompliance — and a reformed funding model where enforcement revenue replenishes the agency's budget. The CPPA has indicated it's pursuing hundreds of open investigations. → Texas has emerged as an aggressive enforcement jurisdiction, with privacy-related settlements exceeding $1 billion in 2025. → Multi-state coordinated enforcement — particularly around GPC compliance — became a defining trend, with bipartisan coalitions of state AGs running joint sweeps. Until Congress reaches consensus on a uniform national law, state-driven regulation will keep driving the compliance landscape. Helping members navigate exactly this patchwork is what our program is built for. ↓ Find out more in the comments. ↓ #DataPrivacy #PrivacyLaw #Enforcement #AdTech #CCPA