• by Laurie Sullivan , June 3, 2024

Compliance changes to Google's ads and analytics products roll out with each new state that adopts privacy laws.

The policy may have begun with California in 2023, but more individual state laws around restricted data processing (RDP) will go into effect this year.

RDP is when Google limits how it uses data to only show non-personalized ads in states that have enacted this policy.

Practices in Florida, Texas, Oregon, Montana and Colorado are being adjusted as new data privacy regulations are implemented this year.

Google, in states that have enacted RDP, no longer can act as a service provider. For example, under the California Privacy Rights and Enforcement Act of 2020 for cross-context behavioral advertising, restricted data processing is no longer offered for impacted functions. This includes the use of customer-provided data for personalized advertising.

Florida’s Digital Bill of Rights takes effect on July 1, 2024. The FDBOR applies to persons that conduct business in Florida or produce products or services used by Florida individuals or households, and process or engage in the sale of personal data. 

It also includes unique provisions around facial recognition and substantial provisions regarding children’s online safety. It will permit consumers to opt out of the collection of personal information specifically obtained through voice or facial recognition systems.              

Montana passed the Montana Consumer Data Privacy Act in 2023, and it goes into effect October 1, 2024. The law gives residents of the state the right to request a copy of personal information that businesses have collected about them.

An individual will have the opportunity to request that a business correct inaccuracies and delete personal information a company might have collected about them, as well as opt out of businesses selling the individual’s personal information to advertisers and other third parties.

Google will update its ad terms to enable RDP for the above states as their laws take effect. The laws let Google act as a data processor rather than a controller for partner of data.