Happy Nice Mall

SANDY SPRINGS, Ga. — In 2018, California lawmakers mandated that consumers be able to request their personal data from companies via a toll-free number. Then a group of lawyers, engineers, and salespeople got hired for a company in Atlanta.

A start-up called OneTrust, now located in a suburb of the city’s slums, produces software for businesses trying to stay on the right side of an increasing number of internet regulations. In response to the new California law, OneTrust has made it easy for companies to set up a number to manage claims.

In a bid to rein in tech giants like Facebook and Google, governments around the world in recent years have passed new laws regulating how websites must handle consumer data, treat competitors, and protect youth. The European Union has a data privacy law that governs the entire bloc. California has approved two privacy measures in recent years, and other states have done the same.

Something else has emerged from these regulations: an industry that will help companies navigate the increasingly fragmented rules of the global internet.

This is a thriving market. OneTrust, a leader in its field, was valued at $5.3 billion by investors. One competitor, BigID, raised $30 million in April at a valuation of $1.25 billion. TrustArc, another company targeting privacy regulations, raised $70 million in 2019. Yoti, a startup that provides the kind of age verification services that regulators are increasingly turning to to protect children from harmful content, has raised millions of dollars since its inception. It was established in 2014.

The emergence of these companies shows just how complex the regulations governing the web have become and how complex they are expected to become. Various privacy laws will come into effect around the world in the coming years, and more countries and states are expected to consider their own proposals.

“They’re all responses to an underlying problem – and they all have their own flavor, they all have their own interpretations and they all have their own focus,” said Bart Willemsen, analyst at market research firm Gartner. “These regulatory changes are encouraging organizations – perhaps in addition to the ethical concerns they may have – to really up their game here.”

Most new companies owe it to the introduction of the General Data Protection Regulation, a European Union law passed in 2016 that forces websites to ask their users if they agree to be tracked online. It also obliges companies to catalog the personal data they hold.

European rule was a turning point in breaking internet regulation and put Europe well ahead of Washington in creating railings for technology.

“We are definitely a kind of child of GDPR,” said Dimitri Sirota, CEO of BigID, which was founded the year the law was passed. In its early days, BigID helped companies map their data assets so they could respond to requests under privacy laws. The company currently has offices worldwide, including in Australia, Israel and Switzerland.

OneTrust also owes its birth to European law. The company’s CEO, Kabir Barday, started the company in 2016 when he saw that companies were preparing to comply with the rules.

Under European rules, websites must largely obtain permission to use cookies, which are small pieces of code that can be used to track people as they browse the internet. In practice, this means that visitors to a website are often presented with a drop-down menu or banner asking if they should agree to be tracked.

OneTrust helps companies add these banners to their sites. His clients include pocket tool maker Leatherman, furniture giant Herman Miller, and California fashion designer James Perse, who sells $70 white T-shirts favorites of Snapchat creator Evan Spiegel.

In 2018, lawmakers in California passed their own privacy rules that give users in the state the right to request their personal data from websites. Mr Barday said demand from companies competing to meet California law was strong.

“A client would say, ‘Kabir, we have to start today’,” he said. “I just said, ‘Customer, at that time, about a quarter of us had a thousand customers who came to us and said the same thing.’

Today, OneTrust and its competitors advertise that they can help their customers comply with privacy laws in multiple countries such as Brazil and US states such as Nevada. OneTrust distributes spiral bound texts of California and European laws as loot.

OneTrust spokesperson Gabrielle Ferree said its biggest customers often prefer products that “run in the six- to seven-figure annual range.”

Experts said that products to meet new internet regulations may vary in how effectively they actually protect the privacy of people browsing the internet.

For example, a website might nudge a visitor to agree to be tracked by using a more distinctive color for the button that accepts cookies than the button that rejects them. Or they may present a user with an unequal choice: agree to one-click ad tracking or disable it using the complex settings menu on a different page.

“I really think it’s up to businesses, and it’s within the power of consumers to make it easier to opt out or join,” said Maureen Mahoney, policy analyst at Consumer Reports.

Mr Barday said the interests of businesses using his products are aligned with those of their customers. Companies want to reach consumers who want their products or engage them. And consumers prefer a personalized internet experience based on them and their interests, as long as websites are open about collecting their data.

“What we love about this market is that capitalism and business interests don’t conflict with doing good for the world and for people,” he said.

“If a business can demonstrate that they are trustworthy, respectful and transparent about how they collect this data, guess what?” said. “Consumers provide them with data.”

The business faced setbacks: At the start of the pandemic, OneTrust laid off 10-15 percent of its 2,200 employees. Some of these employees threatened to sue the company in the UK last year and said they were fired en masse for poor performance despite never receiving poor performance reviews. Employees also told the media that the layoffs came after Mr Barday told his employees that no jobs were at risk.

OneTrust spokesperson Ms. Ferree said the company “is not immune from the impact of pandemic-related uncertainty in 2020”.

“Ultimately, we had to make tough employment decisions and tried to preserve jobs in the long run,” he said.

But OneTrust and other companies in the industry continued to grow. OneTrust, which is not yet profitable, says it now has more than 10,000 customers. It also introduced products aimed at helping companies comply with other regulations, such as new protections for whistleblowers in Europe.

OneTrust has recently moved outside of Atlanta’s city limits to a typical tech office in the nearby suburb of Sandy Springs, with glass-walled conference rooms, outdoor ducts, and large sales areas.

Last Thursday, a group of employees gathered to watch part of OneTrust’s annual conference for its clients. They touched their laptops as they played a warm-up game, a British duo consisting of a man playing live music from a set of turntables while his wife played music on the saxophone in the background.

The DJ and saxophonist hugged and Mr. Barday appeared on the screen. He laid out the company’s priorities in a stylish, pre-recorded video.

“Number 1: Don’t focus on privacy because it’s complicated and it’s getting more and more complex,” he said.