California Privacy Rights Act to define and limit “cross-context behavioral advertising”

Following a court decision on Friday (22 June 2020), it is now highly likely that California will introduce legislation that curtails “cross-context behavioral advertising”.

A court decision on Friday (19 June 2020) makes it highly likely that Californians will vote on the California Privacy Rights Act (CPRA), the successor to the CCPA. Disclosure: I have contributed to the text of this bill.

The Californians for Consumer Privacy campaign, led by Alastair MacTaggart, has On Friday a decision at the Sacramento County Superior Court cleared a bureaucratic hurdle that would have delayed a referendum on the California Privacy Rights Act for two years.[1] The Act will now be voted on in November 2020, as planned.

Polling conducted by Mr MacTaggart in late 2019 shows that 88% of Californians say they will vote in favor of the ballot initiative.[2] Only 4% say they would vote to oppose it.

Impact on “adtech”

A “yes” vote in November will have a significant impact on the business of online advertising. The Act introduces a definition introduced of “cross-context behavioral advertising” for the first time:

“Cross-context behavioral advertising” means the targeting of advertising to a consumer based on the consumer’s personal Information obtained from the consumer’s activity across businesses, distinctly-branded websites, applications, or services, other than the business, distinctly-branded website, application, or service with which the consumer intentionally Interacts.[3]

This is significant, because the Act envisages a specific opt-out from cross-context behavioral advertising.[4]

In addition, the Act broadens the CCPA definition of “sale” of personal information by adding “collection” and “sharing”.[5] It also expands the CCPA right to opt out from the “sale” of one’s personal information. The CPRA will provide for a broader “right to opt-out of sale or sharing”.[6]

The definition of “sharing” covers conventional tracking-based advertising technology methods such as syncing and the broadcasting of RTB bid requests:

“Share,” “shared,” or “sharing” means sharing, renting, releasing, disclosing, disseminating, making oval/able, transferring, or otherwise communicating orally, In writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and o third party for cross-context behavioral advertising for the benefit of a business In which no money is exchanged.[7]

Advertising technology businesses and their partners will have to disclose what they are doing. Personal information sharing must be disclosed.[8] People may be particularly alarmed when they learn of the sharing of “sensitive” personal information, which would also have to be disclosed under the Act.[9]

(Sensitive personal information is broadly similar to the GDPR’s “special category personal data”. It includes geolocation, ethnicity, race, political leaning or creed, health data, sex life, and so forth, unless the information also happens to be publicly available.[10])