Concerned about the impending effective date of the California Consumer Privacy Act (CCPA)?
With advertisers scrambling to meet the requirements of the new privacy law, the Interactive Advertising Bureau (IAB) has partnered with industry members to create the CCPA Industry Compliance Framework.
Pursuant to Section 1798.115(d) of the CCPA, third parties are prohibited from selling behavioral data involved in digital advertising that has been sold to them unless explicit notice and the opportunity to opt out from the sale are provided to the consumer pursuant to Section 1798.120 of the CCPA. In short, the IAB framework addresses the fact that various participants in the interest-based advertising ecosystem sell personal information but do not have the ability to provide the explicit notice required by the law.
Recognizing that many participants in the digital advertising industry engage in the downstream sharing of consumer behavior data as part of interest-based advertising, the IAB Tech Lab asked for help from advertisers, publishers and other stakeholders to create an approach to CCPA compliance.
Recently, the IAB unveiled a possible technical solution. Under the framework, publishers would pass signals about the sale of personal information to downstream participants, with the creation of a limited service provider contract between the downstream participants and an IAB entity in order to establish a contractual relationship between the parties. To do so, IAB is developing a limited service provider contract, with which downstream participants must enter into with an IAB entity.
The IAB plans to release the technical specifications of the CCPA Industry Compliance Framework in the coming weeks, followed by the publication of a draft industry compliance framework for public comment.
Following the comment period, the IAB hopes to finalize the framework in November to begin technical education and support in time for the CCPA’s January 1, 2020, effective date.
Why it matters: The IAB said it plans to tweak the framework as necessary after the publication of the attorney general’s regulations, which AG Xavier Becerra recently said he expects to release in October. The IAB Tech Lab, together with the Network Advertising Initiative, also recently announced ideas for other technical solutions in the CCPA context, including an encrypted, revocable token that permanently attaches a consumer’s privacy preferences to an identifier that ad-tech companies can use to target ads, as well as a joint accountability system that would rely on multiple sources of reporting to verify that advertisers and marketers are compliant with consumer privacy choices. We will continue to monitor the IAB’s solution and the release of the upcoming draft regulations by the California attorney general and be available to help you get ready for January.