Part 1 of this blog post discussed CCPA obligations if you use ad networks like Google or Facebook for interest-based advertising.
Part 2 of this post is a discussion of the specific language in the CCPA that led us to conclude that interest-based advertising is a “sale” of information under the CCPA.
Let’s begin with the text of the law.
“Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.
As you can see, the definition of “sale” is incredibly broad. Does that mean every disclosure of personal information is a sale?
No.
Luckily, CCPA goes into more detail to define what is not a sale. Here are a couple of key exclusions:
A service provider meets the following requirements:
There are two benefits:
A business that discloses personal information to a service provider shall not be liable under this title if the service provider receiving the personal information uses it in violation of the restrictions set forth in the title, provided that, at the time of disclosing the personal information, the business does not have actual knowledge, or reason to believe, that the service provider intends to commit such a violation. A service provider shall likewise not be liable under this title for the obligations of a business for which it provides services as set forth in this title.
It depends.
The CCPA doesn’t draw a clear line between a “sale” of information and other types of sharing. However, it makes clear that a vendor is NOT considered a service provider if it uses the information your business shares with it to build profiles on consumers, which the vendor then uses to provide services to other businesses.
Some could argue that building profiles is a key part of the business model and services offered by ad networks like Facebook and Google, which collect information not only in their capacity as ad networks but also as a provider of other services, including social media platforms and analytics tools.
If your business uses one of these profile-building ad networks to serve interest-based ads to consumers, your sharing of consumer information with them for this purpose likely constitutes a “sale” under the CCPA. Unless, of course, the ad network has assured you that it is not using that information to build profiles and instead acts as a “service provider” to your business.
No, not necessarily. In the wake of the CCPA’s enactment, ad networks like Google and Facebook began offering solutions to businesses looking to be CCPA compliant. Google offers Restricted Data Processing (RDP). If turned on or operating by default for a particular ad service, RDP means that Google is restricting its use of the data you share with it such that the sharing should not be considered a “sale” under the CCPA. Facebook has a similar mode, called Limited Data Use (LDU). Ad networks may be updating their options and terms as CCPA enforcement kicks in, so be sure to understand your sharing practices with respect to each ad network and other third party.
As noted in Part 1 of this blog post, if you sell information under the CCPA, you are required to follow certain guidelines to give consumers the Right to Opt-Out of the sale of their information.
Need help thinking through it?