Home Online Advertising The IAB Finalizes CCPA Framework As Industry Readies For More Regulators

The IAB Finalizes CCPA Framework As Industry Readies For More Regulators


The IAB on Thursday released its California Consumer Privacy Act (CCPA) compliance framework, the legal and technical mechanism for using ad-targeting data or first-party publisher data in programmatic advertising.

It also released a legal agreement meant to accompany the compliance framework. Get it all here.

The finished framework comes only two weeks after it first published draft specs for industry comments. The rush order was necessary so publishers and technology companies have time to implement the framework before the law goes into effect in January.

The CCPA framework is broadly similar to the Transparency and Consent Framework (TCF), the system developed by the IAB Europe and IAB Tech Lab in light of Europe’s General Data Protection Regulation (GDPR), for passing consent signals in the RTB ecosystem.

But the CCPA framework is a much easier sell for vendors, largely because of how much more rigorous GDPR standards are than the CCPA.

The EU law created data processors and data controllers, with strict regulation of data collection and consent for each impression – that’s why people browsing the web in Europe see so many site pop-ups.

The CCPA framework creates a new service provider relationship between publishers and tech companies that contractually establishes how consumer data can or cannot be used by the vendor. However, it applies primarily to publishers that sell data (data onboarding and identity-matching companies, for instance, that buy publisher audience data) or that use publishers’ first-party data in programmatic, like some ad tech vendors.

An important indicator of the relative ease for successful compliance with the CCPA is that Google already announced this week that it will integrate the technical specifications of the IAB’s CCPA framework when the law goes into effect in January.

Google committed to implementing the TCF by the end of Q1 2020, about two years after the IAB Europe debuted the program, and more than a year after other ad tech companies expected Google to sync its consent signals with the industry standard. Strict regulatory scrutiny in the EU and the severe penalties under the GDPR law upped the stakes for Google and kept it from adopting with the TCF, but the CCPA implementation is promptly on track.

Michael Hahn, IAB SVP and general counsel, told AdExchanger last month that the CCPA framework will likely require an updated version sometime next year, similar to how a second version of the TCF was released this year that addressed publishers’ concerns with the original.

The IAB said in its CCPA compliance framework announcement that the law presents a “tremendous opportunity” for the digital media and advertising industry to demonstrate a commitment to privacy – without heavy-handed oversight.

“The digital advertising industry … recognizes the importance of privacy and data protection, and the clear message it is receiving from the market and consumers in particular.”

Must Read

It’s Open Season On SaaS As Brands Confront Their Own Subscription Fatigue

For CFOs and CEOs, we’ve entered a kind of open hunting season on martech SaaS.

Brian Lesser Is The New Global CEO Of GroupM

If you were wondering whether Brian Lesser was planning to take some time off after handing the CEO reins of InfoSum to Lauren Wetzel last week – here’s your answer.

Comic: S.P. O'Middleman's

TripleLift CEO Dave Clark Abruptly Exits After Setting The SSP On A New Trajectory

Dave Clark, who’s led TripleLift for the past two years, is stepping down, effective immediately, and is being replaced by a coterie of TripleLifters.

Privacy! Commerce! Connected TV! Read all about it. Subscribe to AdExchanger Newsletters
shopping cart

Moloco Invests In Its Competitor Topsort As The Retail Media Stakes Go Up

Topsort can lean into Moloco’s algorithmic personalization, while Moloco benefits from Topsort’s footprint with local retailers in the US and in Latin America.

CDP BlueConic Acquires First-Party Data Collection Startup Jebbit

On Wednesday, customer data platform BlueConic bought Jebbit, which creates quizzes, surveys and other interactive online plugs for collecting data from customers.

Comic: The Showdown (Google vs. DOJ)

The DOJ’s Witness List For The Google Antitrust Trial Is A Who’s Who Of Advertising

The DOJ published the witness list for its upcoming antitrust trial against Google, and it reads like the online advertising industry’s answer to the Social Register.