The first step to CCPA compliance is creating an information map and carefully evaluating how each of your vendors uses personal information your business shares with it. When you start this exercise, you may be surprised to find that under CCPA, you could be "selling" information when you share it with ad networks, data analytics providers, and possibly others.
Part 1 of this blog post provides tips on becoming CCPA compliant if you “sell” information.
Part 2 of this post is a discussion of the specific language in the CCPA that led us to the conclusion that interest-based advertising constitutes a sale under CCPA.
What Is Interest-Based Advertising?
Interest-based advertising is a form of digital advertising that uses information collected about a person’s online activity to display personalized ads. Using cookies and other tracking technologies placed on a business’s website, ad networks gather information about the online activity of web visitors, such as what products they viewed or purchased. The ad network uses that information to predict the products or services most relevant to that consumer, allowing more effective advertising from their business customers.
A related concept is retargeting, which also uses tracking technologies like cookies and pixels to follow which websites a consumer visits after landing on a business’s site, and displays interest-based ads in an attempt to “retarget” the consumer back to the business’s website--and back to the product they were viewing before they left it.
Tracking technologies track consumer online activity by browser, meaning that they identify the consumer electronically through the consumer’s device, as opposed to by the consumer’s name or other identifying information.
Interest-based advertising and retargeting can also occur through non-cookie-based sharing, such as when a business shares emails with ad networks. Using an email address, ad networks can identify people in their own database of profiles and advertise a business’s products or services on social media or other websites the person might visit.
What Are Common Examples Of Ad Networks That Offer Interest-Based Advertising?
Many ad networks offer interest-based targeting. Common ones include Facebook Ads, LinkedIn Ads, Microsoft Ads and Google Ads. Some of these ad networks also allow businesses to engage in retargeted advertising.
My Business Uses Interest-Based Advertising. What Are My CCPA Obligations?
Because interest-based advertising may constitute a sale under CCPA (we explain why in Part 2), you have a few options. If you choose to continue using interest-based advertising for California consumers, you must provide them the Right to Opt-Out.
Specifically, you must:
- Add a link to your homepage that reads: Do Not Sell My Personal Information
- Ensure the link directs the website visitor to directions for how to opt-out of any cookies associated with the advertisers.
Because there is no universal opt-out process, how you implement an opt-out depends on the particular ad networks your business uses. Some ad networks follow technical specifications established by the Interactive Advertising Bureau (IAB). Others respect settings established by the Digital Advertising Alliance (DAA). Some ad networks do not participate in either and may require more work to enable opt-outs.
If you provide email addresses of your customers directly to an ad network for purposes of interest-based advertising, a cookie-based opt-out will not effectively opt your users or customers out of that sharing of information.
If you need help, let us know. We have tools to assist businesses with their advertising opt-outs based on a wide range of information-sharing practices.
Not all advertising with ad networks is considered a “sale” under CCPA. Certain ad networks offer advertising services that are designed to avoid “selling” practices. For information about those types of services, see Part 2 of this blog post.
