For more than a year advertisers and publishers had few clues for detecting how California regulators would enforce the state’s privacy law. Now, subtle and not-so-subtle indicators are emerging in enforcement letters and case examples from the state’s Office of the Attorney General.
Another fresh revelation: companies cannot rely on blanket digital ad opt-out tools from trade groups to satisfy compliance with the California Consumer Privacy Act. In other words, popular opt-out tools from the Network Advertising Initiative and Digital Advertising Alliance won’t cut it.
When a media and entertainment conglomerate directed people to a third-party trade association’s digital ad opt-out tool, it wasn’t an appropriate opt-out, said the state’s OAG, which said it amounted to a failure to allow people to opt-out from the sale of their personal information. And, when a pet industry site forced people to use a trade group’s digital ad opt-out tool, the OAG alleged the company was not in compliance with the law.
‘What you see on many companies’ sites’
The CCPA requires that companies notify people of data sales and give them a choice to opt out from it. Some companies have responded to that demand by simply directing them to tools from the ad trade groups the NAI and DAA, both of which provide methods for opting-out from digital advertising tracking and targeting, said Alysa Hutnik, partner and chair of the privacy and security practice at law firm Kelley Drye and Warren. “That is what you see on many companies’ sites as a way to operationalize do-not-sell, and that’s still prevalent,” she said.
California Attorney General Rob Bonta’s office unveiled in mid-July several examples of CCPA enforcement cases, allaying some lamentations about a lack of rules and guidance associated with the law, which went into effect in January 2020. “As a law enforcement agency, the OAG does not generally release information to the public about its investigations,” wrote the AG’s office when it released nearly 30 industry-specific case examples scrubbed of actual company names and other revealing details. “The OAG provides the information below as illustrative examples of situations in which it sent a notice of alleged noncompliance and steps taken by each company in response,” the OAG continued.
The case examples make it clear that merely employing existing methods for opt-out from data collection for California residents via an industry group process is not enough, said Odia Kagan, chair of the GDPR compliance and international privacy practice group at Fox Rothschild, adding that the case examples bring welcome clarity to companies navigating how to comply with the law. “That’s more instruction that we can take in and align compliance practices around,” she said.
But questions remain as to whether the OAG accepts tools developed by industry groups specifically to comply with CCPA as compliant. For instance, the DAA — a consortium of large ad industry groups — offers a CCPA Opt-Out Tool built in conjunction with its pre-existing WebChoices platform that is intended to stop the sale of personal information, including in relation to online behavioral advertising. The Interactive Advertising Bureau also developed a framework for compliance with the California law; however, it is not clear from the case examples what specific tools were determined to be out of compliance. The DAA, NAI and California Attorney General’s Office did not respond in time to comment for this story.
Because the DAA’s CCPA opt-out sends people to a third-party site to opt out of interest-based ads, said Hutnik, it addresses only the companies participating in that program, rather than providing a direct way to address someone’s request to opt out from data sales occurring on a publisher’s site itself. “Put another way, there is nothing in the CCPA enforcement summaries or regulations that supports this approach as a compliant way to operationalize do not sell opt-outs,” she said.
Put simply, said Hutnik, companies have to provide people with options that are “more specific to a CCPA opt-out.”
Bloomberg Media will debut five new podcasts with iHeartMedia this year
Bloomberg Media and iHeartMedia are releasing five podcast shows this year, part of a three-year co-production and distribution podcast deal to create over a dozen new original shows.
Member ExclusiveMedia Briefing: What publishers’ latest earnings reports say about the state of the media business
In this week's Media Briefing, media editor Kayleigh Barber analyzes the latest quarterly earnings reports from BuzzFeed, IAC's Dotdash Meredith, News Corp's Dow Jones, Future plc, Gannett and The New York Times.
The pluses and pitfalls of team-led return to office approaches
Publishers like Dotdash Meredith, Dow Jones, theSkimm and NBC News are adopting team-specific RTO policies, designed to make the return to in-person work more accommodating. But they can also create complications.
SponsoredHow companies are improving career mobility to mitigate the Great Resignation￼
Matt Bartels, principal and media practice lead, Alexander Group The pandemic left an indelible mark on businesses around the world. This abrupt market force challenged leaders to reevaluate their business model, think creatively, work collaboratively and aggressively invest in their future or risk becoming obsolete. Unexpectedly, the global workforce reevaluated their lives while re-envisioning their […]
The Rundown: As e-commerce grows, the eCommFronts address data and communication issues
Night Market, which specializes in guiding clients through e-commerce and retail media offerings and inventory, hosted its third annual eCommFronts beginning Tuesday through today.
Q&A: How Vox Media’s branded content studio is working to integrate its podcast ad capabilities post-merger
Three months after Vox Media and Group Nine’s branded studios merged, the newly combined Vox Creative is using the different podcast ad formats it offers to integrate audio advertising into advertisers' campaigns, according to svp Yosef Johnson and executive producer of audio Annu Subramanian.