New regulations were recently passed in California regarding consumer privacy on the internet. Here’s the breakdown on what it means for your company:
Currently “Do Not Track” settings in the major browsers are intended to give consumers control over who can capture their data by making a request readable by publishers and those companies that set first and third party cookies. The request is merely that – a request that their data not be collected. But current laws do not require publishers or data providers to honor the “Do Not Track” request – it is voluntary through programs such as AdChoices, which was launched back in 2009.
The new California law does not require companies to honor “Do Not Track” requests. Instead, it requires companies serving consumers in California to disclose in their privacy policy their stance on “Do Not Track”. In other words, the state of California wants consumers to know which companies honor “Do Not Track” requests and which do not.
The “Do Not Track” movement has had difficulty gaining traction since it was introduced by the major browsers. This is due to several reasons:
1. Browsers have “Do Not Track” enabled by default. Many consumers simply do not adjust or explore their browser settings (or fully understand them) largely negating consumer choice on privacy. Some marketers see “Do Not Track” as a blunt-instrument solution.
2. Marketers already provide cookie and data tracking opt-out options that provide consumer choice. These options provide greater flexibility in controlling which third parties can track a user’s behavior online.
3. Marketers fear losing access to large populations of online users and access to robust targeting options in delivering their campaigns. Publishers also risk losing out on ad revenue associated with their high-value audiences if they are unable to show the reach and scale of those audiences.
With the California law, the state is trying to give consumers a better understanding of who is collecting their data. Many publishers and data providers already provide disclosures and even require users to acknowledge their data collection policy when users visit their sites. Clearly publishers and data providers located in California may need to update their privacy policies. What’s more uncertain is what, if any, impact the California law will have on companies serving California consumers whose businesses operate outside of California. As of now, no other states have passed similar laws and the likelihood of a non-California company being sued based on California law is likely pretty low so the net impact of the new law on marketers and publishers remains to be seen.
Other than the browser opt-out options mentioned above, the typical user opt-out experience happens when they are served an ad on their mobile device or desktop, which contains the AdChoices icon, consistent with the DAA Self-Regulatory Program for Online Behavioral Advertising. A user will be shown an ad with the icon displayed. They can click the icon and choose to see their Privacy Policy or click to opt-out of behaviorally-targeted advertising.
If you review the AdChoices regulations however there are aspects that advise all sites (advertiser or publisher) who do any OBA or collect Personally Identifiable Information to be transparent on their site to opt out, not only through the privacy policy but also through things like the AdChoice logo. Below is a screenshot from www.Phoenix.edu which has the AdChoices logo at the bottom of their site, so you can see what an advertiser (not publisher) is doing to address this.
We would advise website owners to at least update their privacy policy to include the new laws. If your business is not in the state of California it will be difficult for anyone to enforce this law, however the current self-regulated system seems to be trending to increased regulation and it is better to adhere to these regulations before they become mandatory.
For more information regarding these changing laws visit the Information Law Group or the State of California’s Office of the Attorney General.