• by Wendy Davis , Staff Writer @wendyndavis, November 7, 2019

Advocacy groups are blasting the Interactive Advertising Bureau for advancing a “bad faith” interpretation of California's new privacy law.

“We are disappointed that IAB appears to adopt contorted legal interpretations of the CCPA in order to avoid making any meaningful changes to the ad tech data sharing practices that were the fundamental motivation behind the law,” the Center for Digital Democracy, Consumer Federation of America, Consumer Reports, Media Alliance and Oakland Privacy say in comments sent to the IAB this week.

The groups are responding to the IAB and IAB Tech Lab's proposed compliance framework for California's sweeping new Consumer Privacy Act. That law, set to take effect in January, includes a provision giving consumers the right to opt out of the sale of their personal information, including persistent identifiers, browsing history and IP addresses. The measure requires web companies to offer opt-outs via links stating “Do Not Sell My Personal Information” or “Do Not Sell My Info.”

But the IAB's draft framework suggests some companies see a loophole -- one that hinges on the law's definition of “sale.”

The California law broadly defines “sale” as including transfers and disclosures. But the law also contains an ambiguity -- it says transfers made for “business purposes,” including advertising and marketing, are not sales.

The IAB's framework suggests that ad companies plan to rely on that business-purposes exception to argue that transferring data for ad-targeting purposes isn't a "sale." 

“Advertisers often disclose the personal information of consumers ... to DSPs, DMPs, agencies, and others for targeting purposes,” the IAB's draft document states. “Some advertisers are choosing not to 'sell' (as defined by CCPA) such personal information by entering into service provider agreements where personal information is disclosed pursuant to business purposes.”

The advocacy groups take issue with the IAB's language.

"This is a bad faith interpretation of the CCPA," the watchdogs write, adding that the law allows consumers to reject behavioral targeting.

"While the CCPA places no limits on websites’ abilities to advertise to their own visitors, it works to put limits on the tracking of consumer behavior across the web in order to show ads," they say.

The advocates add that the IAB's framework advances “dubious legal interpretations that run counter to the text -- and certainly the spirit" of the law.

“For many consumers, behavioral advertising is a serious abuse of their personal privacy. Not only does the widespread collection of data involved in this tracking leave consumers vulnerable to security breaches and inadvertent disclosure of damaging information, but it also reveals more about consumers than they might want to share with others: their sexual preferences, health issues, and political activities,” the groups write. “At the very least companies should be required to honor affirmative efforts to opt out of the ad tech ecosystem.”

The IAB and IAB Tech Lab responded Thursday by stating that the goal of the framework is “to provide the right transparency and control to consumers, as consistently as possible, and across a multitude of publishers.”

The organizations also said the framework “is intended to set a minimum standard for providing notices to consumers and for consumers to express their 'do not sell' right,” and that consumers “stand to benefit from the accountability mechanisms that the framework creates so that technology companies use certain data for only limited and permitted purposes.”

The groups added: “We are eager to work with all interested parties in our effort to ensure that the value exchange behind the ad-supported internet is maintained and user experiences are optimal, while consumer privacy is respected in alignment with CCPA."