Advocacy groups are blasting the Interactive Advertising Bureau for advancing a “bad faith” interpretation of California's new privacy law.
“We are disappointed that IAB appears to adopt contorted legal interpretations of the CCPA in order to avoid making any meaningful changes to the ad tech data sharing practices that were the
fundamental motivation behind the law,” the Center for Digital Democracy, Consumer Federation of America, Consumer Reports, Media Alliance and Oakland Privacy say in comments sent to the IAB this week.
The groups are
responding to the IAB and IAB Tech Lab's proposed compliance framework for California's sweeping new Consumer Privacy Act. That
law, set to take effect in January, includes a provision giving consumers the right to opt out of the sale of their personal information, including persistent identifiers, browsing history and IP
addresses. The measure requires web companies to offer opt-outs via links stating “Do Not Sell My Personal Information” or “Do Not Sell My Info.”
But the IAB's draft
framework suggests some companies see a loophole -- one that hinges on the law's definition of “sale.”
The California law broadly defines “sale” as including transfers
and disclosures. But the law also contains an ambiguity -- it says transfers made for “business purposes,” including advertising and marketing, are not sales.
The IAB's framework
suggests that ad companies plan to rely on that business-purposes exception to argue that transferring data for ad-targeting purposes isn't a "sale."
“Advertisers often disclose
the personal information of consumers ... to DSPs, DMPs, agencies, and others for targeting purposes,” the IAB's draft document states. “Some advertisers are choosing not to 'sell' (as
defined by CCPA) such personal information by entering into service provider agreements where personal information is disclosed pursuant to business purposes.”
The advocacy groups take
issue with the IAB's language.
"This is a bad faith interpretation of the CCPA," the watchdogs write, adding that the law allows consumers to reject behavioral targeting.
"While the
CCPA places no limits on websites’ abilities to advertise to their own visitors, it works to put limits on the tracking of consumer behavior across the web in order to show ads," they say.
The advocates add that the IAB's framework advances “dubious legal interpretations that run counter to the text -- and certainly the spirit" of the law.
“For many consumers,
behavioral advertising is a serious abuse of their personal privacy. Not only does the widespread collection of data involved in this tracking leave consumers vulnerable to security breaches and
inadvertent disclosure of damaging information, but it also reveals more about consumers than they might want to share with others: their sexual preferences, health issues, and political
activities,” the groups write. “At the very least companies should be required to honor affirmative efforts to opt out of the ad tech ecosystem.”
The IAB and IAB Tech Lab
responded Thursday by stating that the goal of the framework is “to provide the right transparency and control to consumers, as consistently as possible, and across a multitude of
publishers.”
The organizations also said the framework “is intended to set a minimum standard for providing notices to consumers and for consumers to express their 'do not sell'
right,” and that consumers “stand to benefit from the accountability mechanisms that the framework creates so that technology companies use certain data for only limited and permitted
purposes.”
The groups added: “We are eager to work with all interested parties in our effort to ensure that the value exchange behind the ad-supported internet is maintained and
user experiences are optimal, while consumer privacy is respected in alignment with CCPA."