WTF is the CCPA’s definition of sale?
The California Consumer Privacy Act contains many ambiguities that have confounded companies in their compliance efforts. But considering the fact that the privacy law is centered on providing people control over how their personal information is sold, the CCPA’s most enigmatic element is also its most important: What is considered a sale of someone’s personal information?
What exactly represents a sale of personal information under the law, which went into effect at the start of the year, “needs to be more widely talked about because people are probably breaking the CCPA without knowing it,” said privacy consultant Debbie Reynolds, CEO of Debbie Reynolds Consulting. “They may be thinking about sale in the strict, traditional sense,” added Reynolds, who previously served as the data privacy officer at law firm Eimer Stahl.
WTF is the CCPA’s definition of sale?
The CCPA defines a sale as the exchange of someone’s personal information for money “or other valuable consideration.” In other words, its definition of sale is not as straightforward as stating that it is a literal sale in which personal information is directly traded for dollars.
What does “other valuable consideration” mean?
It’s unclear. The law does not define what is meant by “valuable consideration.” As a result, companies and their lawyers are left to interpret that language and how it might apply to their businesses. This poses a particular problem for companies that buy, sell or facilitate the sale of targeted advertising.
Why is the definition of a sale an issue for companies in the targeted advertising business?
Many of the types of data that publishers, ad tech companies and advertisers use to target ads are considered personal information under the CCPA. The law explicitly cites cookies, mobile ad IDs and IP addresses as forms of personal information. Therefore, if one company shares that information with another company in order to buy or sell a targeted ad impression, that activity could be considered a sale of personal information under the privacy law.
“There’s a clear fault line between the way the [online advertising] industry views cookie sharing, which is more like sharing and not a sale, and the way consumer groups are articulating their belief, which is, if the cookie is going to track the consumer across the internet on nonowned-and-operated properties, that would constitute a sale,” said Dominique Shelton Leipzig, co-chair of the ad tech privacy and data management practice at law firm Perkins Coie.
Does that mean a publisher selling targeted ads is technically selling personal information?
Maybe. Publishers have diverged in their interpretation of the CCPA’s definition of sale. Some publishers have adopted the strict interpretation that they do sell data under the law. But other publishers have asserted that the law is not clear enough about whether the use of tracking mechanisms like cookies constitutes a sale of people’s personal information.
“A lot of times when people are doing targeted advertising, they’re using other companies,” Reynolds said. “So the fact that there is an exchange or dissemination of that information and some monetary or valuable gain, [that] would, in my view, constitute a sale.”
What do companies that sell personal information under the CCPA need to do?
These companies are required to take several actions if they sell California residents’ personal information. These firms must display a “clear and conspicuous” link on their homepages titled “Do Not Sell My Personal Information” so that users can request that they stop selling their information. Additionally, these companies must provide users a list of the types of businesses where their data has been sold.
Is there a way for companies to share personal information with other businesses without this constituting a sale?
Yes, a company can designate another company as a service provider. This allows a publisher, for example, to share a California resident’s IP address with an ad tech company in order to sell a targeted ad. But the ad tech company would be able to use that IP address only to facilitate the sale of the targeted ad. The ad tech company would not be allowed to add that data point to its device graph that it uses to sell targeted ads for other publishers.
When will there be any clarity about what counts as a sale?
This is also unclear. “Ultimately certain things are not going to be made any more clear in the [regulations], and my prediction is we’ll be seeing this play out” in court, Shelton Leipzig said.
‘We’re not in advertising mode’: Anheuser-Busch CMO Marcel Marcondes on staying relevant
Last month, Anheuser-Busch announced that it would use its production lines to produce hand sanitizer to help consumers amid the coronavirus pandemic. But that’s only one way the world’s largest beer company is changing the way it operates during this crisis. As the situation has evolved, the company has developed initiatives aimed at helping consumers […]
It took a global pandemic, but Facebook Live is back in favor
With people at various levels of lockdown, Facebook Live has gone from being a back-up way to being at events to being one of the only ways during the pandemic.
‘Be helpful’: How marketers are adapting their messaging to a fraught environment
Using that tactic -- fostering a sense of community with some version of “we’re in this together” and making explicit how big businesses are trying to help -- is common in the new advertising.
SponsoredRegulations are prompting publishers to develop new strategies around user log-ins
In a post-GDPR and post-cookie world, more publishers are making concerted efforts to explain the value of their content to users and increase the volume of consumer authentication.
‘Right thing to do at the right time’: The definitive oral history of Hyundai’s assurance program
Here’s the story of how the Hyundai Assurance came to be and how it was revived in recent weeks.
Member ExclusiveFinance is the new creative: Balance-sheet crunch leads ad and media businesses to seek new liquidity avenues
This is the second of a weekly column about the big changes and challenges facing media and marketing leaders. Be sure to join Digiday+, our membership program, to get access to this column and all Digiday articles, research and more. First came the shock. Then came the bills. Eager to maintain positive free cash flow […]