New NAI Membership Criteria Distinguishes NAI Members as Trustworthy Stewards of Data in Light of New National Security Framework
As the leading self-regulatory organization dedicated to responsible data collection and use for digital advertising, the NAI is announcing a new membership requirement designed to ensure that working with NAI members meets a key element of the DOJ Rule on Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons (“DOJ Rule”).
This broad and complex rule requires companies to exercise caution when sharing U.S. data with business partners. Specifically, the DOJ Rule prohibits sharing covered data (which may include combinations of IP addresses and device IDs at scale) with any “covered person,” defined as a foreign person that has certain ties to a “country of concern.” In turn, countries of concern are defined to include North Korea, China, Russia, Iran, Cuba, and Venezuela. Beginning in 2026, the NAI membership agreement will incorporate new representations and warranties affirming that NAI members do not have those ties to a country of concern and are thus not covered persons under the DOJ Rule. In addition, the NAI will add elements to its Privacy Review Program starting in 2026 to confirm member adherence to those representations and warranties.
These updates to the NAI’s membership requirements and Privacy Review Program provide a clear signal to the industry that working with NAI members is consistent with important new data sharing limitations established by the DOJ. Companies that handle covered data are expected to prevent that data from being shared inappropriately under the DOJ Rule. Going forward, they will have additional assurance that they meet that expectation when sharing data with NAI members, based on both contractual assurances NAI members make as part of their membership and additional diligence conducted by the NAI staff during annual privacy reviews.
Membership in the NAI has always served as a powerful signal to the marketplace that member companies are committed to both consumer privacy and compliance with privacy laws and regulations. These new membership criteria reinforce that commitment by further identifying NAI member companies as trustworthy leaders on data governance and privacy practices. While the DOJ Rule raises additional complex and varied compliance issues for businesses, we look forward to continuing to evaluate how the NAI can help its member companies adhere to privacy laws and regulations, including those focused on national security, such as the DOJ Rule.
