CCPA Enforcement Begins: What Every Publisher Needs To Do To Comply

AdExchanger | July 6, 2020 CCPA enforcement is no longer an eventuality: it’s here.

AdExchanger | July 6, 2020 - California Consumer Privacy Act (CCPA) enforcement is no longer an eventuality: it’s here.

In an article for AdExchanger, Julie Rubash, Nativo VP of legal, addresses the risk publishers run if they choose to eschew the attorney general’s final CCPA regulations, precautions they should take for protection and the potential impact enforcement could have on publisher business models.

The Enforcement Deadline is Here

The California Attorney General’s office submitted its final draft of CCPA regulations—six months after the new legislation’s effective date—and ambiguities still remain. Although the regulations are not yet effective, the enforcement deadline of the underlying law has arrived, and the regulations are a helpful guide to anticipate the Attorney General’s interpretation and enforcement efforts. We recommend that publishers looking to shore up compliance efforts read the finalized regulations and statement of reasons to ensure that current plans are in line with the Attorney General’s interpretation. For publishers that haven’t yet endeavored to comply, there has never been a better time than the present.

Proactive Protection

Tools like the IAB CCPA Framework are a step in the right direction to prepare for an inquiry and limit revenue disruptions. Publishers that leverage the IAB CCPA Compliance Framework tool and sign the limited service provider agreement are unlikely to experience a significant impact to their business models. Of publishers in the Nativo marketplace that have implemented the IAB CCPA Compliance Framework, only 0.91% of their inventory contains an explicit opt-out.

The Biggest Potential Threat

Section §999.315(d) of the regulations requires businesses to treat user-enabled global privacy controls that signal the consumer’s choice to opt out of the sale of personal information as a valid “Do Not Sell My Personal Information” request. This setting effectively takes the power from users to make informed decisions on data collection and sharing, and places that power in the hands of the browsers. While it doesn’t appear that any browsers have implemented such settings yet, if they ever did the impact on publisher ad revenue could be significant.