The IAB Tech Lab is proposing technical standards it hopes will ready its members for the fast-approaching California Consumer Privacy Act, or CCPA, legislation geared toward shining a light on data brokerage and giving consumers more control over how ad tech accesses data.
The trade org has established a working group to prepare for the enactment of CCPA in January.
The legislation will place stringent limitations on how publishers can grant third parties access to the consumer data of California residents for the purpose of ad targeting. The CCPA also requires that consumers can opt out of allowing such businesses to sell their information to third parties, which is the cornerstone of programmatic media trading.
Other trade orgs have attempted to ready their membership for the CCPA but now, as the California governor and attorney general prepare for the CCPA to go into effect, the IAB affiliate is making its own wide-ranging recommendations.
New privacy proposals
The IAB Tech Lab’s CCPA Technical Working Group is unveiling a solution that will allow publishers to pass consumers’ preferences, and whether or not they’re California residents, along to third parties in the ad-tech ecosystem. The proposals, which the organization will soon make available for public comment, will also contain guidance on how publishers can give explicit notice to website visitors on how their data is tracked, used and shared with third parties, and how they can opt.
In addition, the proposals recommend that publishers display a “do not sell my personal information” notice on their homepages, every subsequent page where user data is collected and in their stated privacy policies.
The success or failure of these measures will prove critical to the application of ad tech in California, as it would be extremely difficult, if not impossible for ad-tech players to forge direct relationships with consumers and gain consent.
GDPR similarly requires ad-tech players to gain consent from the public and prompted many U.S. companies to cease operations in Europe before it went into effect in May 2018. The IAB Tech Lab hopes a universally agreed-upon signaling system will prevent similar disquiet in California ahead of CCPA in January.
IAB contracts opt-out exemptions
Once a consumer opts out of having their data sold, ad-tech partners on a publisher’s webpage will have to agree to use personal information in a manner that cannot be classified as selling information to third parties. This is of particular importance, as the wording of CCPA grants publishers the legal right to share information with “service providers,” or “sub-processors,” to use IAB parlance, for purposes of measuring ad performance, even if users opt out of having their data sold.
For this to be permitted, however, CCPA also requires publishers to have a written contract with service providers as a condition of disclosing consumers’ personal information, according to law firm Davis & Gilbert. The IAB Tech Lab is also proposing a standardized contract that will prevent publishers’ service providers from profiling users or retargeting them with ads on third-party websites, per Davis & Gilbert.
“When a consumer opts out, the advertiser may receive personal information from the DSP (or directly from the publisher) only for the business purposes that relate to media buys on the publishers’ property–primarily, to measure performance,” according to a note on the law firm’s website. (Although, the what is and isn’t considered a service provider is still hotly debated.)
Questions over format
At a recent conference hosted by the IAB Tech Lab, Jill Wittkopp, senior product marketing manager, Rakuten Marketing, and a member of the working group, said, “The big questions are surrounding policy and what that front-end U/I will look like on our members’ websites. Those are the kind of things we’re getting a lot of questions about … especially from our publishers.”
Meanwhile, fellow panel participant Jennifer Kyla Derke, director of product, programmatic and data at IAB Tech Lab, said the proposals are “in flux” but that there is agreement on how consent signals would be passed between players.
Priorities
The timing of the rollout is likely to prove delicate for many members, as organizations seek to balance preparatory work with their core fourth-quarter activities—typically a peak time for ecommerce and online ad spend—because rolling out experimental lines of code could potentially jeopardize large amounts of revenue. However, as the panelists at the recent IAB Tech Lab conference noted, preparation efforts will require significant resources, or else participants risk censure from Californian authorities.
Privacy advocates IAPP recently published the results of a survey in which only 2% of participants deemed their organization 100% compliant with CCPA. Meanwhile, almost a third of respondents said it would be July 2020, six months after the legislation goes into effect, before their organization would be CCPA-compliant.
