The Interactive Advertising Bureau ("IAB") has released its California Consumer CCPA Framework") for public comment. The Framework is intended to assist publishers and intermediaries, such as SSPs and DSPs, to comply with the new requirements imposed by the CCPA.
The purpose of the Framework is to create service provider relationships between publishers and technology companies, such that limitations on the use of data can be easily imposed when the consumer opts-out of a sale of personal data pursuant to the CCPA. The Framework will have functionalities, including when the data subject clicks on the "Do not Sell My Personal Information" link, that is mandatory under the CCPA, and in which case, the Framework will then send a digital signal to all participants in the transaction, informing them that the consumer has opted-out. This will enable users to opt-out from all related Real- RTB personal data by one click.
Under the CCPA, third parties are prohibited from further selling personal information, previously sold to them by the data controller (as "business") without providing the consumer with an explicit notice and an opportunity to opt-out. The Framework will provide a Yes/No signal indicating if the user was provided with such an explicit notice and an opportunity to opt-out .
Every company that engages in or supports an RTB transaction in the digital advertising industry, is eligible to participate in the Framework, including publishers, SSPs, DSPs, ad servers, agencies and advertisers. The Framework will be enforced by a standard IAB agreement and apply only to RTB transactions, involving the sale of personal data of Californian resident, where all participants are signatories to such agreement.
Publishers will decide whether a particular bid request should be subject to the Framework. If a publisher chooses to use the Framework for a specific bid request, then downstream framework participants (i.e. SSPs), will be prohibited from sending the bid requests to DSPs or other downstream entities who do not participate in the Framework.
It should be noted that opting out of a sale of personal data does not mean that the user will cease to see ads or even interest-based ads. If a user opts-out of a sale on the publisher's domain, but does not opt-out of interest-based ads, or does not require that their personal data will be deleted, they may still receive ads tailored to their interests. Such tailored ads can be based on personal information that was collected more than 90 days prior to opting out; or on data that was collected from other sources, from which they did not exercise the right to opt-out.
Under the IAB Framework agreement, publishers and advertisers will be required to warrant that they: (i) meet the requirements of a business, as defined in the CCPA; (ii) have included a "Do Not Sell My Information" link, together with an explicit notice for further sales; and (iii) will use the Framework's signals. Rather than preventing the downstream transfer of personal data for advertising purposes, once the consumer optsout, the agreement will require that downstream entities shall only process consumer's information for limited business purposes, in accordance with the CCPA. In addition, the agreement will require signatory entities to submit audits to confirm that they have complied with their obligations, both under the agreement and the CCPA. The agreement itself, is intended to be published for review during the first quarter of 2020.
