The letter responds to the California Consumer Privacy Act (CCPA), set to take effect January 1, and other states’ enacted or proposed laws that together could create a patchwork of conflicting statewide privacy laws.
While the industry has historically relied on a combination of self-regulation and compliance with existing sectoral privacy law, the explosion in recent years of new data collection and targeting techniques—many operating with little transparency to consumers—has changed the landscape.
The coalition’s letter to Congress urges a legislative framework at the federal level that would relieve consumers of the responsibility to sort through complex privacy policies and terms of use to protect their privacy, and would also set clear ground rules nationally for how data can be collected and used.
In advocating for a national privacy law, Privacy for America also seeks operating certainty for marketers and agencies. A recent detailed economic analysis from the California Attorney General’s office estimates CCPA compliance costs for businesses in California alone at more than $80 billion. If businesses need to create compliance systems on a state-by-state level, the final costs could be astronomical.
Led by the 4A’s, Interactive Advertising Bureau (IAB), Association of National Advertisers (ANA), Network Advertising Initiative (NAI), and the Digital Advertising Alliance (DAA), Privacy for America is the first cross-industry legislative effort of its kind in the digital advertising space.
California earthquake
As its enforcement date of January 1 inches ever closer, the CCPA is set to shake up all businesses operating within California. The California Attorney General’s newly proposed draft regulations give agencies more detail about compliance requirements.
Although draft regulations attempted to clarify who is defined as a service provider—an important distinction for agencies—the question remains unresolved. Draft regulations also introduced staff training and reporting requirements. (Final regulations will likely be issued in 2020, months after the January 1 deadline.)
California’s state legislature has passed several CCPA amendments, including one the 4A’s advocated for. Under CCPA, public records usage appeared to be restricted only to the purposes for which the public data had been collected: a limitation that would have restricted most access to public records as a data source. The 4A’s–supported amendment loosened these restrictions and permits the continued use of public records for data points.
For more information on CCPA compliance guidance for agencies, see The CCPA: California Consumer Privacy Act: What Agencies Need To Know.
CCPA compliance frameworks emerge
The programmatic environment is notoriously complex, and applying the CCPA to its Byzantine ecosystem is particularly tricky. Many questions have emerged, including how to define a “sale,” how to ensure a consumer opt-out takes effect downstream, and how access and deletion rights will be handled.
Two industry frameworks in development address such difficult compliance questions: the IAB CCPA Compliance Framework, developed by the IAB, the IAB Tech Lab, and other parties; and the DAA CCPA Compliance Solution, developed by the DAA with the 4A’s, ANA, NAI, DAA, IAB, and other groups.
While both frameworks seek to activate CCPA compliance in a programmatic ecosystem, they differ in approach.
The 4A’s will soon release guidance for the DAA CCPA Compliance Solution for review and feedback.
