When the California Consumer Privacy Act takes effect in January, visitors to websites will be asked whether their personal data can be sold. Publishers of those websites will have to determine how the law applies to their ad business and whether they will still share data with advertising technology partners—even when users have opted out of selling their data. 

“What we’re trying to do as an industry is say what are the analytics and measurement type services that we can still provide,” says Daniel Sepulveda, senior VP for policy and advocacy at MediaMath, a programmatic marketing technology platform. “This is what everybody is trying to figure out­, how to come into compliance with the California law.” 

According to digital ad industry trade groups like the Interactive Advertising Bureau (IAB), there is flexibility under the California privacy law, so publishers can still coordinate with ad-tech partners for certain services that are crucial to digital advertising, such as being able to measure when an ad has been viewed.

At the same time, Google is constructing a framework for the millions of publishers who use its ad platform, Google Ad Manager. In some cases, Google will limit the online sale of ads when a consumer chooses to restrict data collection. 

The California Consumer Privacy Act comes at a time when a number of other states are also crafting similar legislation, and the federal government debates a single unifying law for the digital ad industry and online publishers. The privacy push in the U.S. comes on the heels of General Data Protection Regulation in the EU.  

The problem 

Ads could generate reduced revenue when they are served to consumers who have chosen to not sell their data. Those ads could have less targeting sophistication, diminishing their value, according to digital publishing industry leaders. 

The IAB has developed guidelines about what should be in publishers’ notices when they ask consumers to permit the sale of their data, but they will all have to come up with the language that suits them best. “It’s hard to have a one-size-fits-all notice for every single company,” says Michael Hahn, senior VP and general counsel for IAB and IAB Tech Lab. 

Under the California law, there could still be ways to use data to tailor ads to deliver personalized ads to users who opt out. “We have as a requirement to say in the notice that there is a difference between opting out of the sale of personal information and opting out of interest-based advertising,” Hahn says. 

Sharing data with a “limited service provider” does not constitute a sale of that data according to the legislation, Hahn says. So the IAB came up with a framework that designates partners in the online ad auctions “limited service providers.” 

Google—which has even stricter protocols in place for when a consumer opts out of selling data—has not yet signed on to the part of IAB’s playbook that allows ad inventory to be sent into open auctions. The company declined to comment for this story, and there are still some uncertainties about how it will fill ad space when a consumer has chosen to limit data sharing. 

The solution 

There are a few ad technology options publishers should consider, including using consent management platforms to keep track of visitors who have placed restrictions on their data. Companies like Quantcast, Tealium and Sourcepoint offer services that manage digital ads. “You have to have a mechanism if someone clicks on the button to say ‘Do not sell my data,’ that has to have some action behind it,” says a publishing executive who is still working on plans to comply with California’s privacy law. 

For consumers that choose the stricter data options, publishers might need to think of new ways to reach those viewers with ads, says Field Garthwaite, CEO of Iris.TV, a video advertising platform. More publishers are turning to contextual advertising, meaning the targeting is based on what a user is looking at and not their personal data. “If you don’t know the audience data, if under CCPA half the audience opts out, then there’s nothing else to target without context,” Garthwaite says. “A big swath of this audience starts to disappear.” 

As for Google, it will help publishers institute what it calls “restricted data processing” standards, which will apply to visitors and users who opt out of selling data. Ads for those users will not go through the typical process of bidding to fill them. 

What publishing experts suggest is that if a website still wants to auction ads for those users under IAB’s framework they would need an alternative supply-side partner other than Google. “When a consumer opts out, the downstream companies will become service providers of the publisher, which means they can only use personal information for very limited uses,” IAB’s Hahn says. 

That will still allow for some of the basic services provided by the ad-tech ecosystem, Hahn says, such as allowing publishers to audit ads to measure their effectiveness and reporting on viewability. “What ‘do not sell’ should mean is that this person’s information cannot be used for that given transaction, but there are services that we can deliver within the scope of that transaction that should be allowed,” Sepulveda of MediaMath says.