Proposed Solution Will Help Publishers & Supply Chain Partners Comply with Complex California Consumer Privacy Regulations
NEW YORK — IAB, the trade association for the digital media and marketing industries, and its affiliated standard-setting organization, the IAB Technology Laboratory, released for public comment the IAB California Consumer Privacy Act Compliance Framework for Publishers and Technology Companies to help digital publishers and their supply chain partners comply with California’s data privacy legislation.
“Hundreds of thousands of companies support their businesses with advertising on the internet, because it enables them to effectively reach new and existing customers at scale. Publishers bear the brunt of responsibility for compliance because of their direct relationship with consumers.”
IAB and the IAB Tech Lab are asking publishers, technology intermediaries, ad agencies, brands, data companies, and all other participants in the digital advertising supply chain to provide input on the draft framework by November 5, 2019, after which the trade bodies intend to release a final version for companies to adopt, before the California law takes effect on January 1, 2020.
The CCPA Compliance Framework was developed by the IAB Privacy and Compliance Unit, which over four months brought together more than 350 legal, public policy, and technical experts from publishers, agencies, brands, platforms, advertising technology companies, and law firms to craft a compliance mechanism that will advance consumers’ privacy rights under the new California law, while enabling the tens of thousands of web publishers and intermediaries that comprise the open internet to continue to provide free advertising-supported content and services in the state.
CCPA was passed in June 2018 without public hearings. Its aim is to provide California consumers with greater transparency and control over how their personal information is collected, used, and sold. Earlier this month, California Attorney General Xavier Becerra released draft regulations to enable the legislation. Because of the law’s complexity and lack of clarity, IAB member companies and other stakeholders asked the trade bureau and the Tech Lab to collaborate on a standardized solution that would help them comply with the law’s provisions, even as those specifications continue to be revised.
Because California is the largest state, its regulations are often seen as a surrogate for Federal regulation, and as a model for other states to follow.
The proposed IAB CCPA Compliance Framework establishes a process for publishers and their partners to comply with new regulations regarding the sale of consumer data to technology companies. It focuses on:
- How publishers communicate information about California residents’ rights, including the ability to opt-out of the “sale” of their personal information
- How to communicate to partners across the open internet supply chain that a California resident has opted out of the sale of his or her personal information
- How partner companies must operate after a consumer has opted out of the sale of their personal information
The IAB CCPA Compliance Framework consists of two components: a master contract that binds supply chain partners to specific behaviors that meet the law’s provisions; and a set of technical specifications that guide companies on how to implement the contract mechanically in their operations. The “Industry Limited Service Provider Contract” defines what a publisher and its partners must do when a consumer clicks “Do Not Sell My Personal Information” on a website or app. The use of this new contract will enhance consumer protection by reducing hundreds of separate contracts to only one that imposes meaningful guardrails concerning the use of data. IAB will provide the legal agreement to companies across the advertising landscape later this quarter.
“The IAB CCPA Compliance Framework is designed to help publishers protect consumers’ privacy, while fueling the free internet,” said Michael Hahn, Senior Vice President and General Counsel, IAB and IAB Tech Lab, who led the IAB Privacy and Compliance Unit working groups that designed the framework. “Hundreds of thousands of companies support their businesses with advertising on the internet, because it enables them to effectively reach new and existing customers at scale. Publishers bear the brunt of responsibility for compliance because of their direct relationship with consumers.”
“IAB has been a strong advocate for increasing consumer trust and transparency, and this framework is another example of that commitment,” said Dave Grimaldi, Executive Vice President, Public Policy, IAB. “What IAB is creating will help companies, both large and small, comply with the CCPA legislation in a manner that allows them to continue to innovate and offer the products and services that consumers love.”
“CCPA will become a reality in the new year and this framework will deliver a real solution for the industry and for consumers,” said Dennis Buchheim, Executive Vice President and General Manager, IAB Tech Lab, which has been designing the technical specifications for implementing the framework in companies’ operations. “Tech Lab is at the center of developing standards and technologies that improve the digital marketing supply chain and promote the responsible use of data. The partnership with IAB on the CCPA solution has been similar to our work with IAB Europe and respective member companies on the Transparency and Consent Framework for GDPR, and we’re committed to evolving privacy solutions in the U.S. and globally.”
This framework provides an initial solution for publishers and other parties to comply with CCPA in a timely manner, given the January 1st deadline. CCPA regulations are still being finalized by the California Attorney General. As rules evolve, IAB and IAB Tech Lab will work with stakeholders across the industry to adjust the framework and continue to iterate the approach as needed to meet any revised requirements, ensuring that there are comprehensive solutions for CCPA and other forthcoming privacy laws. Once the final version 1.0 of the IAB CCPA Compliance Framework for Publishers and Technology Companies is released, the trade groups will provide educational support to encourage rapid marketplace adoption.
IAB and the IAB Tech Lab have been developing industry standards and best practices since the organizations’ founding in 1996. Among the industry standards now embedded in the operations of the open internet ecosystem are the VAST standards for digital video advertising distribution, the ads.txt standard helping internet publishers and advertisers identify and eliminate fraudulent inventory, the IAB Europe GDPR Transparency and Consent Framework, the OpenRTB protocols for managing programmatic advertising transactions, and more solutions to enable brand safety, consumer privacy, and transparency.
To review the proposed framework and provide feedback, please go to iab.com/CCPA. The final framework will be released next month to prepare the ecosystem before CCPA goes into effect.
About IAB
The Interactive Advertising Bureau (IAB) empowers the media and marketing industries to thrive in the digital economy. Its membership is comprised of more than 650 leading media companies, brands, and the technology firms responsible for selling, delivering, and optimizing digital ad marketing campaigns. The trade group fields critical research on interactive advertising, while also educating brands, agencies, and the wider business community on the importance of digital marketing. In affiliation with the IAB Tech Lab, IAB develops technical standards and solutions. IAB is committed to professional development and elevating the knowledge, skills, expertise, and diversity of the workforce across the industry. Through the work of its public policy office in Washington, D.C., the trade association advocates for its members and promotes the value of the interactive advertising industry to legislators and policymakers. Founded in 1996, IAB is headquartered in New York City.
About IAB Technology Laboratory
Established in 2014, the IAB Technology Laboratory (Tech Lab) is a non-profit consortium that engages a member community globally to develop foundational technology and standards that enable growth and trust in the digital media ecosystem. Comprised of digital publishers, ad technology firms, agencies, marketers, and other member companies, IAB Tech Lab focuses on solutions for brand safety and ad fraud; identity, data, and consumer privacy; ad experiences and measurement; and programmatic effectiveness. Its work includes the OpenRTB real-time bidding protocol, ads.txt anti-fraud specification, Open Measurement SDK for viewability and verification, VAST video specification, and DigiTrust identity service. Board members/companies are listed at https://iabtechlab.com/about-the-iab-tech-lab/tech-lab-leadership/. For more information, please visit https://iabtechlab.com.
