There are still a lot of ad tech companies out there that assume “data broker” is a label that applies to someone else. Well, Tom Kemp, executive director of CalPrivacy, suggests that they take a closer look at the statute.
CalPrivacy is the official nickname for the California Privacy Protection Agency (CPPA), the only dedicated privacy enforcement agency in the US. It was formed in 2020 under the California Privacy Rights Act to oversee and implement the state’s data privacy laws, and its mandate has only expanded since then.
The most recent example is the DELETE Act, California’s new data broker law, which creates a statewide broker registry and a CPPA-run portal called DROP (short for “Delete Request and Opt-Out Platform,” very clever) that allows Californians to send bulk data deletion and opt-out requests to every registered broker at once.
More than 300,000 state residents have already signed up for DROP, Kemp says on this week’s episode of AdExchanger Talks, which he sees as a clear data point that “there’s hunger out there for people to take control of their personal information.”
That hunger has real implications for ad tech. Any company that collects, aggregates and sells personal information about people they have no direct relationship with meets California’s definition of a data broker.
Which means a significant chunk of the ecosystem – onboarders, ID vendors, audience extension platforms and other intermediaries – are, in fact, data brokers under California law, whether they’ve embraced the label or not.
“The law itself defines what a data broker is,” Kemp says. “In the regulations, we provide further clarification of the concept of what a direct relationship is, [although] everything, of course, is fact-specific.”
In other words, not knowing is not a defense – and, while you’re at it, don’t lose sight of the fact that there’s a real person on the other side of the screen.
“Walk a mile in the consumer’s shoes,” Kemp says. “What we find is that people have kind of forgotten to do that.”
Also in this episode: What recent dark pattern and data minimization cases signal for enforcement, don’t sleep on CalPrivacy’s rules regulating automated decision-making technology and how Kemp’s Silicon Valley past shapes his approach as a regulator.
