• by Michael Hahn , Gary Kibel , October 7, 2020

The California Consumer Privacy Act (CCPA) may have only been the beginning. Now the California Privacy Rights Act (CPRA), if passed by the state's voters in November, will up the privacy ante by expanding consumers' data opt-out rights.

CCPA, which became effective on January 1, 2020, caused the digital advertising industry to rapidly implement new transparency procedures to align data collection and data-sharing practices with the regulation's requirements.

Many of these new obligations were driven by the breadth of the definitions in the CCPA -- including, most notably, the broad definition of “sale.”

For privacy lawyers accustomed to the nomenclature of the General Data Protection Regulation (GDPR), CCPA's definition of “sale” to include acts of selling, renting, releasing, disclosing, disseminating, making available, and transferring personal information for monetary or other valuable consideration was decidedly different, to put it mildly.

This forced the industry to initially examine whether data collected from pixels on publisher pages qualified as personal information, and then whether sharing that data in the ad-tech ecosystem amounted to a "sale" under the CCPA. 

The industry rose to the occasion by acknowledging and recognizing these new obligations, and putting in place self-regulatory programs such as the IAB CCPA Compliance Framework and its Limited Service Provider Agreement, as well as the IAB Tech Lab’s U.S. Privacy String specification.

It is now common for consumers to see links on publisher pages with the CCPA-required “Do Not Sell My Personal Information” link.

However, the industry must now apply the same focus, collaboration and commitment to a new compliance hurdle that may be coming.

CPRA -- aka 24 -- seeks to expand the scope of CCPA.  Among the many changes that will confront the industry, should California voters approve CPRA, is a new concept of “sharing.”

This defined term has similarities to “sale," but specifically targets "sharing, renting, releasing, disclosing, disseminating, making available or transferring personal information for behavioral advertising (defined in CPRA as “cross-context behavioral advertising”).

The CPRA then adds “share” to every obligation from the CCPA that addresses a “sale.”

Therefore, consumers would not only have a right to opt out of the sale of their personal information, but also to opt out of the sharing of their personal information.

And those home page “do not sell” links would have to be updated to read “Do Not Sell or Share My Personal Information.”

It is safe to say that publishers and advertisers were initially uncomfortable -- and some still are -- with the “do not sell” link mandated by the CCPA, because they feared that the broad statutory definition of sale can mislead consumers, nearly all of whom have a colloquial understanding of that term.

These publishers and advertisers were concerned that until the use of the “do not sell” link became ubiquitous, it would give the false impression that they function as data brokers.

A link that says “Do Not Sell or Share My Personal Information” will likely further confuse consumers about the activities and data-sharing practices of publishers and advertisers by implying that they are exercising rights far broader than what the CPRA actually provides for.

Clicking this link will not require publishers and advertisers to stop sharing personal information with vendors, suppliers, affiliates and others, including those who may be assisting with marketing efforts. Rather, it will simply provide an opt-out for data sharing used to drive cross-context behavioral advertising (or behavioral advertising).  

Notwithstanding the potential for consumer confusion in the use of share and sale, the digital advertising industry will adapt if the CPRA is approved by voters. 

The industry should begin by doubling down on educational efforts designed to explain to consumers the value of free content and services through an ad-supported ecosystem. Perhaps we can even turn the word “share” into a positive instead of the negative that the CPRA implies. 

Even when new laws have the potential to confuse consumers and frustrate business models, the industry can and must take decisive action to enable all members of the digital advertising ecosystem to adapt.

In the case of CPRA, with an effective date of January 1, 2023 if enacted, such decisive action must begin now.