The California Consumer Privacy Act (CCPA) could disrupt audience-based TV advertising before it really has a chance to take off.
The law, which goes into effect on Jan. 1, 2020 – less than 140 days from now – is chock full of language and requirements that TV broadcasters and their data partners need to pay attention to.
Regulators at the federal level have already scrutinized consumer privacy concerns related to smart TV tracking. The Federal Trade Commission held a workshop on the topic in 2016 and settled with Vizio over alleged unauthorized automatic content data tracking in 2017. In July of last year, Democratic lawmakers wrote to FTC Chairman Joe Simons calling for further investigation into smart TV privacy policies and practices.
California regulators could take a clue.
And WarnerMedia, for one, isn’t taking any chances. The AT&T-owned company has created an ad hoc cross-disciplinary working group of people recruited from nearly every division and team within the company’s ranks which has been meeting multiple times a week for the past year to compare notes in the lead-up to CCPA.
Anyone who touches data at WarnerMedia is part of the group, which is made up of lawyers, marketers, technologists, data scientists, product people, privacy experts and business folks from HBO, Warner Brothers, AT&T corporate, Turner and, of course, AT&T’s addressable advertising unit, Xandr.
“To comply, we don’t just have to build a strategy, we have to engage with every brand and every area,” said Jesse Redniss, EVP of data strategy at WarnerMedia. “Everyone is working together to formulate how we approach this issue – and it’s a big one.”
But despite the fact that the hour is nigh to comply, not all TV buyers appear to be stressing compliance … yet.
“I expect we’ll start to get some questions [from clients], but, at least to date, a lot of people seem OK with the business-as-usual approach, probably because addressable itself is so new, and CCPA feels like something to deal with down the road,” said Marc Cestaro, director and addressable lead at Modi Media, GroupM’s advanced television buying unit.
“At this point, it’s still early days for a lot of advertisers just understanding how addressable even works,” Cestaro said.
Looking at the law
The CCPA applies to any entity that buys, uses, sells or shares the personal data of at least 50,000 consumers, households or devices within California. And personal information under the law is defined as any info that “identifies, relates to, describes, is capable of being associated with or could be reasonably linked, directly or indirectly, to a particular consumer or household.”
It remains unclear exactly how the CCPA defines a household, which could include roommates.
The CCPA’s broad definition of personal data makes it unique among privacy regulations globally, said Mitchell Noordyke, a Westin fellow for the International Association of Privacy Professionals.
“This is not just about individual consumers, it’s also about households, which has implications for addressable TV advertising, a lot of which is done at the household level,” he said. “Just because you’re not identifying an individual consumer doesn’t mean you can avoid compliance obligations.”
An amendment to the CCPA that would have tweaked the definition of personal information to make it less broad by changing the language from “capable of being associated” with an individual or household to “reasonably capable” of being associated failed to secure approval by the California State Senate in July.
Broadcasters, programmers and advertisers also have to be careful about who they work with. They could be on the hook if their third-party partners and service providers aren’t in compliance if they or collect or process data in a way that goes beyond what’s specified within the vendor contract.
Fear of running afoul could trigger a contraction in the number of third-party partners that publishers and advertisers choose to work with, similar to what happened in the lead-up to the General Data Protection Regulation in Europe.
“There are so many potential TV data assets out there,” said Anneka Gupta, president and head of products and platforms at LiveRamp, which has been buying its way into the addressable TV space with the acquisitions of TV analytics startup Data Plus Math and consent management platform Faktor.
“Instead of working with a thousand different data providers, it makes sense to pick a few that have high-quality assets where you know how the data has been collected, which also helps with data quality,” she said.
When it comes to CCPA compliance among TV companies, however, handling online identifiers and IP addresses, which qualify as PII, poses a real challenge, said WarnerMedia’s Redniss.
“Cross-platform identification, reach and frequency, attribution modeling – it’s all dependent on the utilization of device ID, IP address, cookies and other identifiers,” he said. “It’s daunting to think about all of the legacy infrastructure.”
But WarnerMedia is using the coming legislation as an opportunity to put its “infrastructure under the microscope,” Redniss said, and get a better understanding of where the data is and how it’s being used.
Preparing for privacy
It’s a hell of a lot of work, though.
There are thousands of customer touch points across WarnerMedia – CNN alone has 59 different modalities – and it’s got to manage opt-ins and consents for the whole shebang on a state-by-state basis.
But CCPA is the compliance North Star right now, since it’s the most developed state-based privacy law on the books. WarnerMedia is trying to explain the value exchange of data collection to customers now, so it doesn't have to retrofit products with consent agreements in future.
To even be in a position to do something like that, though, having a first-party relationship with customers is crucial, said David Levy, CEO of OpenAP, a consortium of TV broadcasters that’s working on standards for audience-based buying on television.
“Just trying to get consent to use an IP address highlights how having a direct line of communication with the consumer is incredibly important,” Levy said. “But it’s not always easy to be clear in how you communicate with the consumer about what you’re doing with their data – and that’s especially tough on smart TVs.”
“And we only have to deal with a single manufacturer,” McAfee said. “Other companies that aggregate this type of data from multiple OEMs, well, god help them.”
Unfortunately, consumers don’t spend a lot of time reading privacy policies when they’re setting up their smart TVs, said LiveRamp’s Gupta. So including an AdChoices icon or a “Why am I seeing this ad” button at the top right corner of an ad, for example, isn't easily translatable to a TV environment.
“TV is not typically an interactive experience where you’re talking about transparency and choice,” Gupta said. “Our big challenge is to make this into a consumer-friendly experience.”