“Data-Driven Thinking” is written by members of the media community and contains fresh ideas on the digital revolution in media.
Today’s column is written by Gary Kibel, a partner in the privacy/data security and advertising/marketing practice groups at Davis+Gilbert.
The digital media industry has been absorbing punches to its business model under the guise of privacy. Privacy advocates, including regulators and lawmakers, indiscriminately throw around the term “surveillance advertising” without acknowledging the many benefits of data-driven advertising to businesses, consumers and our economy. They also do not recognize the many different advertising and marketing practices employed by the industry.
But we all agree that merely measuring the effectiveness of online advertising is a benign and harmless activity, right? Not so fast.
The California Privacy Rights Act (CPRA), which takes effect on January 1, 2023, and replaces the current California Consumer Privacy Act (CCPA), throws a curveball to measurement and analytics practices.
Combining data will be a no-go
The CCPA already has restricted the activities of “service providers” that process personal information on behalf of businesses. Under the CCPA, service providers can use a business’s personal information to serve authorized business purposes and for internal purposes like improving the quality of their services, detecting fraud and complying with laws. But they cannot use such data to build or modify consumer profiles.
The CPRA creates additional limitations on what service providers can do with personal data, and these are somewhat troubling. Under the CPRA, service providers will now also be prohibited from “combining the personal information, which the service provider receives from or on behalf of the business, with personal information, which it receives from or on behalf of another person or persons, or collects from its own interactions with the consumer.”
But here’s the problem: Measurement and analytics are all about combining data. When an ad is served on a website, the advertiser will want results from that campaign to be combined with results from serving the ad on another website, too. That way, the advertiser can get a fuller picture of the effectiveness of the campaign. But if this is no longer allowed, then measurement becomes a major hurdle.
The IAB is working on solutions to provide a path for businesses to navigate this and other challenges that new laws will impose on the ad tech industry. But time is running out.
The new California Privacy Protection Agency charged with enforcing the CPRA is working on implementing regulations. The first draft, which was released on May 27, did not provide any relief on this combination issue. But these regulations are not yet final and will certainly be revised at least one more time. In fact, much like what occurred with CCPA, they may be finalized on the eve of the law’s effective date, or even afterward, further complicating compliance efforts.
In the meantime, the industry finds itself in an all-too-common position: explaining how the ad tech industry works to lawmakers and regulators who mistakenly view all activities through the same lens.
Follow Gary Kibel (@GaryKibel), Davis+Gilbert LLP (@dglaw) and AdExchanger (@adexchanger) on Twitter.
For more articles featuring Gary Kibel, click here.
