\n<\/p>\n
California: land of sun, surf, Redwoods, Hollywood and, of course, consumer privacy regulations.<\/p>\n
The Golden State was a US pioneer when it passed the California Consumer Privacy Act (CCPA) back in 2018, giving California residents the right to know what personal information a business collects about them and how it is used and shared, the right to delete personal information collected from them (with some exceptions), the right to opt-out of the sale of their personal information, and the right to non-discrimination for exercising their CCPA rights.<\/p>\n
But today, there\u2019s a new regulatory act in town: the California Privacy Rights Act (CPRA). Building upon the CCPA, the CPRA adds some new rules, clarifies some old ones, and introduces dedicated resources for regulatory enforcement to help ensure California consumers\u2019 control over their personal data. The CPRA also ushers in a year that will see\u00a0five new state-level data privacy acts\u00a0take effect, with regulations also debuting in Virginia, Colorado, Connecticut, Utah.<\/p>\n
To get a better understanding of the latest laws and see how they could impact the digital advertising industry, we spoke with Derek Zolner, General Counsel at Basis Technologies, about the CPRA\u2014the most expansive of the acts.<\/p>\n
Here are some highlights from that conversation, including how the CPRA builds off the CCPA, what companies have to do to comply, and how it will impact the programmatic advertising industry:\u00a0<\/p>\n
California\u2019s initial foray into the world of consumer privacy regulation was 2018\u2019s California Consumer Privacy Act (CCPA). That was really the first stake in the ground for privacy legislation here in the US. Prior to that, we had some self-regulation for our industry, and good citizens were already doing a lot of the stuff that the CCPA required\u2014for example, in our ads and on our website, we have long allowed people to opt out of targeted ads based on cookie use\u2014but the CCPA\u00a0requires<\/em>\u00a0you to give people a right to opt out.<\/p>\n And now we have the CPRA, aka the California Privacy Rights Act, and that does a couple of things. One, it gives California some broader enforcement rights, creating a\u00a0California Privacy Protection Agency\u00a0that\u2019s dedicated to (and responsible for) enforcing the act. That, to me, indicates we\u2019re probably going to see more enforcement actions coming down the pike.<\/p>\n But it also builds upon the foundation laid by the CCPA in a few ways. The biggest part for our industry? The CCPA had a requirement that if you were selling data, then you had to have an opt-out on your website that said \u201cDo Not Sell My Personal Information.\u201d A lot of people in the digital advertising industry read this definition of \u201csale\u201d very technically, arguing that if you weren\u2019t actually bundling up data, giving it to somebody, and saying \u201cPay me for this data,\u201d then it wasn\u2019t a sale. At Basis, we didn\u2019t take that point of view, electing instead to honor the spirit of the law\u2014i.e. giving consumers the right to opt out of things like what we do with cookie data, mobile ID data, and IP address data.\u00a0<\/p>\n But the CPRA eliminates any ambiguity around how to interpret this aspect of the law by now requiring companies to give consumers the opportunity to not only opt out of the sale of their personal information, but also of\u00a0giving or<\/em>\u00a0sharing<\/em>\u00a0that data with someone else, including a third party that might use it for cross-context behavioral advertising.\u00a0<\/p>\n Essentially, the CCPA, CPRA, and the other data privacy acts that are popping up around US are establishing legal enforcement mechanisms around personal control of one\u2019s personal data and codifying many of the core principals of our industry\u2014namely, transparency, notice, and the right to opt out. Only now, instead of the industry self-regulating these matters, state governments are intervening to take control of that enforcement.\u00a0<\/p>\n The aforementioned opt-out message (ex. \u201cDo Not Sell or Share My Personal Information\u201d, \u201cOpt Out\u201d, \u201cYour Privacy Rights\u201d) has to be conspicuous on a company\u2019s website and easy for consumers to access\/use. Since any company currently operating in California should already have a \u201cDo Not Sell\u201d option on their site, many are choosing to simply add \u201cor Sell\u201d to the same link and give consumers the option to do both on the same page.<\/p>\n At Basis, we made updates to our website so that visitors from California have enhanced opt-out rights. One of the main thrusts of CCPA and CPRA is that California consumers can come to organizations like Basis and say, \u201cHey, what personal information do you have about me? What are you doing with it? And, if I want you to, please delete it or correct it or limit your use of it.\u201d So we offer that to visitors from California through a link on our website, and then we then have 45 days to respond and let them know we\u2019re doing so. Additionally, for CPRA, there are some enhanced requirements for contracts between parties that clarify what their relationship is, and so we\u2019ve retooled some of our contracts with customers and vendors to include what we believe to be those necessary requirements. It\u2019s all about being clear, accurate, and truthful about what your relationship is.<\/p>\n The truth is, we were already doing most of what CCPA required\u2014which was, in essence, having a privacy policy that tells people what you\u2019re doing with data in clear and understandable language, and then giving people the right to opt out of the use of that personal data. We\u2019ve been doing those things for a really long time, and so I didn\u2019t see CCPA as a huge shift or change for us.\u00a0<\/p>\n But even with any of the minor changes that we might have to make, I don\u2019t view them as changing anything core or fundamental to how we operate, nor do I view it as unnecessarily burdensome for to us to allow people to have access to information about what\u2019s going on with personal data for them.<\/p>\n When CCPA came into effect, there was some concern that the sky was going to fall. The fear was that everybody was going to click on that \u201cDo Not Sell My Personal Information\u201d link and that cross-contextual behavioral advertising was going to go kaput\u2014at least as it related to California consumers\u2014because everybody was going to opt out.\u00a0<\/p>\n In fact, that\u2019s not been the case. The opt-out rates are very, very low, because (and this is not a legal explanation, but just sort of my intuitive opinion) people tend to take the easy way. What people want when they visit a website is the content, and whatever they think is the easiest way to get to that content, they\u2019re going to do. I think people are conditioned to just click accept on the website or whatever it is they need to get to the page they want so they can either watch the video that they\u2019re looking for or read the article or whatever it is. And so I don\u2019t perceive that these requirements are going to have a significant impact on our ability to continue to conduct cross-contextual behavioral advertising with programmatic buying.<\/p>\n If anything, I think the main impact of this is on compliance teams and lawyers, in that everybody that operates a website in California with any amount of volume is going have to do some compliance work to make sure they\u2019re adhering to the regulations. But beyond that, I don\u2019t think it\u2019s going to result in a in a meaningful economic change to how our business operates and works.<\/p>\n Until you have a fundamental change like you have in the EU, where you require \u201cOpt-In\u201d consent (vs. somewhere like California that only requires an \u201cOpt-Out\u201d), I don\u2019t think it\u2019s going to have a material impact on the amount of data that companies can use for behavioral advertising. What\u2019s likely to have a much greater impact is a technical change, like if third-party cookies ever go away from Google Chrome. That, in my opinion, would be a much more significant event than this legal change.<\/p>\n I would say our general guidance always is to be clear about what you\u2019re doing and give people the right to opt out of it. That means explaining as much as you can in your privacy policy, detailing what data you\u2019re collecting and what you\u2019re doing with data, and then giving people the right to opt out of that usage in some meaningful and conspicuous way.<\/p>\n Generally speaking, at Basis, we we\u2019re in favor of anything that gives consumers more control of their personal data. Personally, I would be strongly in favor of having one point of reference for that\u2014namely, a federal act\u2014rather than 50 state acts that set up this sort of regional patchwork of compliance, and I think that aligns with where we sit as a company.<\/p>\n \u2014<\/p>\n Looking for guidance on how to effectively connect with consumers while respecting their privacy rights? Check out\u00a0Beyond Third-Party Cookies: Your Guide to Overcoming the Identity Crisis.<\/p>\n<\/p><\/div>\nQ: What Do Companies Have to Do to Comply with CPRA?<\/strong><\/h2>\n
Q: How Will CPRA Impact Programmatic Advertising?<\/strong><\/h2>\n
Q: What is Basis\u2019 POV on Personal Data and Digital Advertising Regulation?<\/strong><\/h2>\n