A Marketer's Guide to the Key Differences Between the Statewide Privacy Laws

The continuing absence of a federal privacy bill means that the patchwork of statewide privacy laws, spurred by California’s privacy law (CPRA) in 2020, makes it increasingly difficult for nationwide companies to manage compliance on a state-by-state basis. The CPRA comes with a level of granularity that other states lack where they “leave it to the businesses to get to the details,” said Alysa Hutnik, chair, privacy and information at law firm Kelley Drye and Warren LLP. “There's 65% that is common among all the states,” said Hutnik. “But the 35% is important to engineering and figuring out how the business is going to do things.” A recent survey shows that 60% of C-suite executives found tracking the status of legislation—and understanding their differences—a prominent challenge, according to law firm Womble Bond Dickinson. With massive compliance costs of millions of dollars per state, plus fines to consider, understanding the differences is becoming more critical. With Colorado, Virginia, Utah and Connecticut having passed their own privacy legislations that take effect between 2023 and 2024, here are some of the differences between California and other states' privacy laws. What Advertisers Need to Know About the Federal Privacy Law Global privacy controls States impacted: California and Colorado What does it mean? Global privacy controls are an automated way for people to opt-out of selling, sharing or giving companies the use of their sensitive personal information for purposes, like ad retargeting. This provision is currently valid in California, but Colorado too will make it mandatory from July 1, 2024. However, there's confusion about whether this applies across all browsers. “If it's a signal sent through a browser, it may be able to block pixels or other tracking technologies," said Sundeep Kapur, senior associate at Orrick, Herrington and Sutcliffe’s. “But it may not work for other forms of personally identifiable information that are being shared or sold.” How does it impact ad tech? By giving people an easy way to opt-out of tracking, the global privacy control means an increase in signal loss for ad-tech vendors, while making it harder for advertisers to share information with demand-side platforms to create look-alike audiences for targeting purposes. “It’s [also] going to result in less monetization,” Kapur noted. Stricter limitations on service providers State impacted: California What does it mean? Advertisers rely on their ad-tech partners, service providers, to process data for ad targeting purposes. Under the CPRA, an advertiser can no longer disclose personal information to these partners, like a DSP, for targeting purposes since these service providers can no longer provide “cross-context behavioral advertising"—or target a person based on an ad network’s internal data, along with data received through a bid request from an exchange or a publisher ad server. This means the disclosure from the advertiser to the ad tech partner can be considered as a “share” of data. In that case, the advertiser would need to have an opt-out button for “sharing” personal information, which the law mandates. How does it impact ad tech? The limitation means “advertisers may very well have no choice but to put that link on their website or app,” noted Kapur. Once again, “having an opt-out link may decrease advertisers' targeting pool and decrease the amount of traffic that a publisher is able to monetize.” Scope of opt-out between California and other states States impacted: California, Colorado, Virginia, Utah and Connecticut What does it mean? Under the CPRA, the opt-out focuses on the disclosures of personal information for targeted advertising. For other states, it focuses on the opt-out of processing of personal information for targeted advertising. Simply put, the scope of the opt-out for target advertising is broader for other states than California. For example, a publisher who targets people based on their own first-party data and data received from other data providers (third-party data), outside of California will have to provide people an opt-out of targeting based off that combination of information. However, in California, the same publisher wouldn't be required to do so and “would just be limited from disclosing personal information for advertising purposes,” said Kapur. “But [the publisher] would still be able to target the user internally, such as with its own first-party data." How does it impact ad tech? Again, more people opting out means fewer monetization opportunities. Even though the scope of targeted advertising opt-out in the other states is broader, “California is such a huge market,” said Kapur. Indeed, the economic impact of opt-out in this state could still be greater compared to individual states like Colorado or Virginia. A New Bill Aims to Limit Collection of Intimate Reproductive Data