California's new privacy law is slated to take effect in just a few weeks, but there is still significant disagreement between businesses and privacy advocates about how the measure will affect online behavioral advertising.
Privacy advocates say the sweeping law gives consumers the right to opt out of targeted advertising. Some businesses disagree.
Much of the dispute stems from the law's definitions. The Consumer Privacy Act gives state residents the right to opt out of the “sale” of their personal information -- including persistent identifiers, browsing history and other data used by ad tech companies to track consumers online and serve them with targeted ads.
The law broadly defines “sale” as including transfers and disclosures -- which would appear to cover transfers to ad tech companies. But the measure, somewhat vaguely, also provides that transfers made for “business purposes,” including advertising and marketing, are not sales.
Consumer advocates are now pressing California Attorney General Xavier Becerra to make clear that the “business purposes” exception doesn't apply when ad tech companies engage in behavioral advertising.
“The Attorney General should promulgate regulations reflecting that the transfer of data between unrelated companies for any commercial purpose falls under the definition of sale, so that consumers can opt-out of the sharing of their data for targeted advertising,” Consumer Reports, the ACLU, Center for Digital Democracy and other groups write.
They add that the regulations should specify that when consumers opt out, data can't be shared for targeted advertising -- even when the company receiving the data is a “service provider."
Their comments about the issue come in response to the Interactive Advertising Bureau's interpretation of the new law. The IAB's draft compliance framework, as well as a final version released last week, suggests ad tech companies can serve targeted ads to consumers who have opted out of the sale of their data, in certain circumstances.
“The IAB framework claims to offer publishers options to circumvent that primary purpose of the CCPA,” the advocacy groups write to Becerra. “The regulations should resolve the matter conclusively: circumvention efforts from the adtech industry do not comply with the law.”
The IAB isn't alone in taking a controversial interpretation of the law.
Facebook has reportedly told advertisers it doesn't need to change how its trackers operate, according to The Wall Street Journal.
“In private conference calls with major advertisers in October, Facebook stated its data collection qualified for the law’s exemption for sending data to 'service providers' and didn’t count as a 'sale' of data under the law,” the Journal reported, based on an account of someone who listened to a call.
Chris Hoofnagle, a professor at University of California, Berkeley, disputed Facebook's take on the law.
“The Facebook pixel is a sale because it’s a transfer of data to a third party, and the purpose is for identity and attribution,” he told the Journal.
Facebook said in a blog post that other advertisers and publishers will have to decide for themselves whether their data transfers to the company are “sales.”
“The CCPA recognizes that many common activities are not 'sales,' such as if a consumer directs a business to share their information, or if a consumer’s information is transferred for a business purpose with certain limitations on the recipient’s use,” Facebook writes.