California Ballot Referendum on CCPA Will Have Significant Effects on AdTech



On Election Day, California voters approved a ballot measure, Proposition 24, known as the California Privacy Rights Act of 2020 (CPRA). Referred to by some as CCPA 2.0, the CPRA amends certain provisions of the paradigm shifting 2018 California Consumer Privacy Act (CCPA), which went into effect in January 2020 and became subject to enforcement in July 2020. Moreover, the CPRA will introduce a number of new provisions and concepts to a law that regulators are still fleshing out and businesses are struggling to understand. Like the CCPA, the CPRA will be supplemented by future regulations to be issued by a new privacy protection agency; however, the nature and the extent of the CPRA’s regulatory mandates far exceed those of the CCPA.

The CPRA will significantly impact consumer’s rights and business obligations in respect of interest-based advertising and other AdTech activities. The CPRA gives a nod to the GDPR and will regulate “profiling,” which it defines as “any form of automated processing…to evaluate…personal preferences, interests…[or] behavior,” though is also to be fleshed out in the Regs. Another one of the significant new terms implicating digital advertising is that of “cross-context behavioral advertising,” defined as “the targeting of advertising to a consumer based on the consumer’s personal information obtained from the consumer’s activity across businesses, distinctly branded websites, applications, or services, other than the business, distinctly-branded websites, applications, or services, other than the business, distinctly-branded website, application or service with which the consumer intentionally interacts.” This definition clearly covers traditional interest-based advertising activities and is directly invoked in the new concept of “sharing,” which includes the same transfer activities in the definition of sale (e.g., “making available”), but applies only in the context of cross-context behavioral advertising. There is no requirement for consideration for a transfer of PI to be considered to have been “shared.” Arguably, by creating a distinct regulated activity rather than clarifying that this activity is type of “sale”, many cross-context behavioral activities (i.e., those without valuable consideration provided directly in exchange for the data disclosure), would now be excluded from the definition of “sale” and implicate only sharing and not sales. In addition, the new definition and provisions regulating the use and disclosure of sensitive PI includes precise geolocation data and other data used in interest-based advertising.

As a result, as if businesses have not struggled enough with the vexing “Do Not Sell” right under the CCPA, in particular as it relates to digital advertising, they will have to grapple with four seemingly overlapping consumer rights under the CPRA: 1) Do Not Sell, 2), Do Not Share, 3) Do Not Profile, and 4) Limit the Use of Sensitive PI. Moreover, some consequential revisions open the door to a possible opt-in regime.

We will discuss the CPRA’s implications on AdTech in a series of future posts. For a detailed discussion of the CPRA, please visit our blog post.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© BakerHostetler | Attorney Advertising

Written by:


BakerHostetler on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.