The IAB on Thursday released its California Consumer Privacy Act (CCPA) compliance framework, the legal and technical mechanism for using ad-targeting data or first-party publisher data in programmatic advertising.
It also released a legal agreement meant to accompany the compliance framework. Get it all here.
The finished framework comes only two weeks after it first published draft specs for industry comments. The rush order was necessary so publishers and technology companies have time to implement the framework before the law goes into effect in January.
The CCPA framework is broadly similar to the Transparency and Consent Framework (TCF), the system developed by the IAB Europe and IAB Tech Lab in light of Europe’s General Data Protection Regulation (GDPR), for passing consent signals in the RTB ecosystem.
But the CCPA framework is a much easier sell for vendors, largely because of how much more rigorous GDPR standards are than the CCPA.
The EU law created data processors and data controllers, with strict regulation of data collection and consent for each impression – that’s why people browsing the web in Europe see so many site pop-ups.
The CCPA framework creates a new service provider relationship between publishers and tech companies that contractually establishes how consumer data can or cannot be used by the vendor. However, it applies primarily to publishers that sell data (data onboarding and identity-matching companies, for instance, that buy publisher audience data) or that use publishers’ first-party data in programmatic, like some ad tech vendors.
An important indicator of the relative ease for successful compliance with the CCPA is that Google already announced this week that it will integrate the technical specifications of the IAB’s CCPA framework when the law goes into effect in January.
Google committed to implementing the TCF by the end of Q1 2020, about two years after the IAB Europe debuted the program, and more than a year after other ad tech companies expected Google to sync its consent signals with the industry standard. Strict regulatory scrutiny in the EU and the severe penalties under the GDPR law upped the stakes for Google and kept it from adopting with the TCF, but the CCPA implementation is promptly on track.
Michael Hahn, IAB SVP and general counsel, told AdExchanger last month that the CCPA framework will likely require an updated version sometime next year, similar to how a second version of the TCF was released this year that addressed publishers’ concerns with the original.
The IAB said in its CCPA compliance framework announcement that the law presents a “tremendous opportunity” for the digital media and advertising industry to demonstrate a commitment to privacy – without heavy-handed oversight.
“The digital advertising industry … recognizes the importance of privacy and data protection, and the clear message it is receiving from the market and consumers in particular.”
