WTF is CCPA’s service provider designation?
An open-ended definition of “selling data” in the California Consumer Privacy Act has put programmatic advertising in a precarious position ahead of the CCPA going into effect on Jan. 1.
The law provides people with the option to request that companies not sell their personal information and delete the information they have sold. This provision has the potential to eradicate the information that the programmatic advertising ecosystem relies on to target ads — at least to the 40 million people in California. The law’s definition for selling data is broad enough that some industry experts believe it may cover how companies across the programmatic supply chain use data to facilitate targeted advertising.
The ad tech industry is gravitating toward a stipulation in the law that would appear to enable programmatic advertising practices to continue, albeit with some limitations and at least as a stopgap measure until the enforcement picture becomes clearer. Similar to the GDPR’s “data processor” label, the California law provides a “service provider” designation that companies can adopt in order to process people’s personal information collected by another company without the sharing of that data being considered a sale under the law. “I think the industry is going to coalesce around it,” said Thomas Chow, general counsel and secretary at PubMatic.
WTF is a service provider?
The CCPA defines a service provider as a company that processes personal information collected by another company, but only for the purposes specified in a written contract between the companies. If a person requests that a company not sell their personal information — as the CCPA gives them the right to do — the company can still share that personal information with service providers for those specified business purposes.
How is this different from how companies already handle data collected by other companies?
The difference is that a service provider is limited in what it can do with the information it receives. For example, if an ad tech company receives device IDs collected by a publisher in order to serve targeted ads on the publisher’s site, the ad tech company cannot also use those device IDs to build a device graph in order to track people across the internet.
Will that prevent ad tech companies from sharing data with other ad tech companies to complete a programmatic ad sale?
Not necessarily. However, the various ad tech companies involved in a programmatic ad transaction would need to serve as service providers.
That sounds really complicated.
Definitely. To simplify matters, the Interactive Advertising Bureau and IAB Tech Lab have developed a CCPA compliance framework that is meant to facilitate this daisy chain of service providers. “Under our framework, what happens is companies downstream [in the programmatic supply chain] will be required to operate as service providers on the behalf of publishers,” said Michael Hahn, svp and general counsel at the IAB.
In early December, the IAB plans to release a Limited Service Provider contract that will detail the terms for ad tech companies serving as service providers under its framework. Chow has seen a version of the contract and said it lays out what service providers can and cannot do with the personal information collected by publishers “in a way that’s logical and reasonable to me.” Boiled down, the contract requires that ad tech companies have a way to isolate the personal information they receive from publishers so that the information is not used to enrich an ad tech company’s own data set.
Are ad tech companies okay with these restrictions?
They’re not wild about it. However, until Congress passes a federal privacy law that would preempt states’ privacy laws, ad tech companies have little choice but to figure out how to comply with the California law. Given the ambiguities that remain in the law, like what does and does not count as a sale of data, the service provider provision gives them some cover to continue to conduct their basic programmatic advertising businesses while they wait for more clarity regarding how the attorney general plans to enforce the law.
So programmatic advertising is saved?
No. For starters, the IAB framework only works for companies that adopt the framework. Apart from the framework, companies would need to sign service provider agreements with each company for which they process data for business purposes. Then there’s the trust required that service providers will abide the contracts and comply with the restrictions placed on their use of data. The attorney general’s office has yet to confirm whether ad tech companies operating as service providers to process data for targeted advertising would be compliant with the law.
‘Influencer deals are being paused’: As Facebook boycott begins in earnest, influencer marketing feels a sting
The latest move to pause influencer marketing comes as marketers are not only reconsidering where their ads appear and the kind of content they appear next to, but as they work to figure out how they can better support Black creators and Black-owned businesses following the Black Lives Matter (BLM) protests.
As Facebook boycott continues, here’s a look at what major marketers were spending on Facebook and Instagram
To get a sense of how much advertisers are pulling back from Facebook, Digiday reached out to ad-tracking firm Pathmatics. The company provided estimates for how much advertisers spent on the platform during July 2019 as well as from July 2019 to 2020.
Member Exclusive‘Performative posting’: As agencies share their equality values online, staffers say they have to do much more for Black employees than post
Agency employees and execs say agencies need to do more than make statements to be better for Black employees.
SponsoredFour ways to adapt to the changing publisher ecosystem in 2020
By Neal Sinno, general manager Americas at GeoEdge For marketers, 2020 started out with so much promise — but this changed rapidly as the industry faced a global epidemic head-on. Not only did our own daily routines come to a screeching halt, for many of us our professional lives did as well. Almost as quickly […]
‘Don’t want to piss off customers’: With manufacturing and exporting snarled, some DTC brands are adapting their advertising
Media buyers say that supply chain hiccups have caused them to pause or significantly reduce media spending anywhere from two weeks to five weeks for some DTC brands low on product inventory.
Beyond remote work: Bringing serendipity back to the office
This article is part of the Future of Work briefing, a weekly email with stories, interviews, trends and links about how work, workplaces and workforces are changing. Sign up here. Kai Micah Mills had been working in a different state from his work partner for years. More recently, though, his partner, Ben Adamsky, made the move […]