IAB Tech Lab Releases Data Deletion Spec Ahead of CCPA Enforcement

California is set to begin enforcing its sweeping privacy law in less than a month

the state of california in pink
Enforcement of CCPA begins July 1. Pixabay, Unsplash

With enforcement of the California Consumer Privacy Act on the horizon, the IAB Tech Lab has released a new spec to address a core issue of data deletion.

CCPA gives internet users the right to request a publisher or vendor to delete the data that has been collected on them. The publisher or vendor has 10 days to respond to confirm receipt of that request, and 45 days delete the data from the moment it received the request.

“A publisher who utilizes ad-tech vendors to be ‘service providers’ (as defined in the CCPA) can use the new spec to signal that a user exercised her right to deletion. This could easily come in the form of explanatory text and button hosted on a publisher page designed to handle those requests,” said Alex Cone, senior director of product management at IAB Tech Lab, in a blog post.

The spec also allows vendors that provide any service for a publisher a standard way to listen for deletion requests coming from that publisher’s webpage, Cone explained.

CCPA defines a service provider as a for-profit business that performs a service, like processing information, for another business, and shares consumer data with that business.

California’s digital privacy law was implemented Jan. 1, and enforcement begins July 1. The state’s attorney general’s office submitted the final proposed regulations of the act to the California Office of Administrative Law (OAL) on June 1.

The OAL has 30 working days to review the regulations, plus an additional 60 working days if necessary under an executive order in response to the coronavirus pandemic.

The IAB, which operates separately from the Tech Lab, released a CCPA compliance framework in December, and in January it joined in a call with other advertising trade bodies to delay enforcement of CCPA.

There is no plan to delay enforcement, however. The Tech Lab hopes its spec will help the industry prepare both operationally and financially for the privacy law.

“Avoiding one-off, proprietary builds per partnership and policy—or just as bad, manual processes to reach out to partners for deletes—can save the industry real money and reduce room for error,” Cone said.

@andrewblustein andrew.blustein@adweek.com Andrew Blustein is a programmatic reporter at Adweek.