The California Consumer Privacy Act (CCPA) is a landmark consumer privacy bill that took effect on January 1, 2020, though the California Attorney General cannot bring enforcement action until July 31, 2020. The intention of the act is to enhance the privacy and consumer protection rights of California residents. The penalties for noncompliance are significant, and on the heels of GDPR and other international privacy regulation, we expected some disruption in our ecosystem. Interestingly, the issues we identified in advance of the deadline have not yet materialized in the programmatic ecosystem.
Initial reaction to CCPA regulations in ad tech
In our consequences of GDPR post, we highlighted the 25-40% drop in inventory volume that occured on GDPR enforcement weekend. Publishers and ad tech vendors were rightfully cautious about GDPR enforcement given the huge fines, and the common interpretation that GDPR data subjects are opted out of personal data sharing by default.
Under CCPA, this drop did not occur. This may be because users are opted in to the sale of their data by default under CCPA and must take action to stop the sale. Since January 1, 2020, we’ve only seen a small fraction of a percent of users opt-out from publishers utilizing the IAB CCPA Framework, and we haven’t had a noticeable drop in traffic from California. This is consistent with other industry reports.
For example, a Digiday report identified that “one publisher that deposited the opt-out notice in the footer said that that less than 1% of site visitors click on the notice and, of those visitors, only 10% opt out of the sale of their personal information.”
Uncertainty remains ahead of the final regulations
It may come as a surprise that the CCPA regulations are not technically final. While the California AG has issued guidance several times, the final enforcement regulations are still going through the last phases of review. This type of uncertainty makes it especially difficult for businesses to comply with the law.
According to an economic assessment report, CCPA implementation is expected to cost $55bn. Having regulations in a draft format, but that are still subject to penalty, increases this cost and generates confusion. However, according to Bloomberg Law (paywall), “California Attorney General Xavier Becerra doesn’t plan to make major changes in [the] rules he proposed in October[…] before issuing a final set of regulations.” Because of this guidance and the wording within the draft for public comment from February, we don’t expect major changes and are proceeding with our previously determined compliance efforts.
Willingness to comply and effort will be looked upon “kindly”
There is good news for those of us that take data privacy and regulations seriously. Similar to some whispers in the lead up to GDPR, companies that can show they’ve made an effort to comply with the law will have a much better chance of avoiding negative enforcement action.
In an interview with Reuters, California Attorney General Xavier Becerra said:
“we will look kindly on those that … demonstrate an effort to comply. If they are not (operating properly) … I will descend on them and make an example of them, to show that if you don’t do it the right way, this is what is going to happen to you.”
If publishers properly disclose information about advertising as required by law, and ad tech vendors honor user preferences for personal data sale, such as by utilizing the IAB CCPA Framework, the risk of fines is reduced and consumer trust should increase.
Consumers are aware of data privacy issues
Despite the limited initial impact of the law on personalized ad inventory availability, we can’t sit back as an industry. One of the most positive effects of the many recent data scandals beyond increased security and disclosure requirements is that consumers are more aware of how their data is used. 65% of consumers believe it’s a risk to give up their data to brands. This is an opportunity for publishers and brands that have relationships with consumers to differentiate themselves by building trust and transparency. If you’re asking a consumer to take what they deem to be a risk by letting you use and control their data, it’s important to provide value and to demonstrate your proper stewardship of that data.
It is also a good time to educate consumers on the value exchange that advertising represents. Most US consumers don’t realize the amount that advertising subsidizes the content they consume. A Vox analysis found that to replace the amount currently spent on digital advertising, every US adult would need to pay $420 per year. This amount is clearly untenable for most people, and they may simply not realize the value that this advertising brings them. A 2016 study found that 85% of consumers would choose an ad supported internet instead of paying for online content, so if consumers were properly educated, it stands to reason they would choose to continue the model of the ad supported internet.
What’s next for ad tech? Industry standards for CCPA compliance
We remain hopeful that the ad tech industry will adopt a standardized solution like the CCPA Framework and we’ve seen increasing adoption from publishers and buyers, but it is still far from ubiquitous.
We strongly suggest any affected partners join this industry-standard framework, sign the agreement, and implement the technical specification.
If you’re interested in learning more, contact our privacy task force or read our CCPA blog series:
- What You Need to Know About CCPA, California’s New Privacy Measure
- An introduction to the CCPA Industry Framework
- Who Does the California Consumer Privacy Act (CCPA) Apply To: Penalties and Impacts on Ad Tech
This article was written by Eric Shiffman, Director of Product Marketing at SpotX