Despite multiple requests, the California Attorney General has refused to clarify whether the use of an advertising cookie does, or does not, constitute the sale of personal information. Instead, the Attorney General has taken the position that the question requires a “fact-specific determination” and has suggested that the following three factors may be relevant on a case-by-case basis:1
- Was “monetary or other valuable consideration involved?”2 Presumably, the Attorney General is concerned with any transfers of money or “valuable consideration” from adtech partners to website publishers in exchange for the ability to track visitors to the website.
- Does the cookie provider qualify as a “service provider” under the Act. While the Attorney General has not provided guidance concerning which types of advertising cookies might be consistent with a service provider designation, presumably, an adtech partner that has contractually agreed to limit its use, disclosure, and retention of information obtained through a cookie would be considered a “service provider.”
For more information and resources about the CCPA visit http://www.CCPA-info.com.
This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes. You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.
1. FSOR, Appendix A at 13 (Response 47).
2. FSOR, Appendix A at 13 (Response 47).
3. FSOR, Appendix A at 13 (Response 47).