Data serves as a key factor for successful business functioning. However, advancements in information technology, which came to the scene during the last decade, have drastically reduced control over it. Only the first quarter of 2020 brought us a couple of loud, privacy violation cases.
The first one is unauthorised recordings of video calls on Zoom, and the second is the scandalous information leakage in the Marriott hotel database that disclosed the passport data of 500 million guests. Both cases prove that even giant corporations can fall prey to privacy breaches and data threats.
Because of this, the topic of data privacy has gone through rapid transformations in a short period. European GDPR, UK GDPR, the CCPA in California, upcoming implementation of the CPRA in California in 2023 and the COPPA proved that the era of data privacy has begun. The ad tech sector, which almost entirely relies on user data, will have to learn how to protect customer data in this new reality. What are those privacy standards and how should ad tech companies adapt to them? This ultimate guide will explain all.
Why compliance is paramount for digital advertising
By the end of 2021, we will have 4.66 billion active internet users in the world, accounting for 60% of the entire global population. Smartphones are used by 9 out of 10 internet users. Two-thirds also report that they frequently utilise laptop and desktop computers for internet browsing. The lockdown caused an even greater increase in online content consumption and shopping. Today, we normally spend 48 hours per week browsing the internet, accounting for 42% of our waking hours.
The average person normally owns different gadgets, each of which explicitly or implicitly tracks information about the owner: gadget usage stats, search engine queries, cookies, etc. Ad tech platforms have mechanisms that allow brands and advertisers to target those users whose interests, lifestyles and preferences correspond to the campaign criteria. Still, growing concerns about digital security pose a great challenge for the advertising sector – they oblige ad tech companies to develop new, safer mechanisms for collecting, storing and processing personal data. Substantial fines for non-compliance are not the only threat that companies need to avoid – prevention of potential damage to reputation should be a major concern for all businesses involved in the advertising industry.
According to the current regulations, what should ad tech companies know to protect customer data? Currently, we can speak about four major international privacy legislation frameworks that have international (extraterritorial) legal force. Let’s review each of them one by one.
So, what regulations should ad tech companies comply with?
● GDPR. In 2016, the European Parliament and Council of the European Union adopted a General Data Protection Regulation (GDPR). GDPR provides European residents with the right to provide data collection consent or restrict companies from collecting their personal data. GDPR applies to any organisation that deals with the data of EU citizens.
● CCPA. California law on consumer data protection was created in 2018. Its regulations are quite similar to GDPR but deal with the privacy protection of California consumers. The CCPA applies to for-profit businesses with an annual profit of over $25 million (or if it sells the data of 50,000 or more California residents). With the implementation of CPRA in California as of 2023, there will be major changes in regard to the treatment of personal information of California consumers.
● COPPA. The Children’s Online Privacy Protection Act, called COPPA, that was signed in 1998, came into force on April 21st 2000 and updated in 2013, has been developed to protect the data privacy rights of US children under 13 years of age. The law applies internationally to every company that deals with data of US children who haven’t reached the age of 13.
Main privacy principles of GDPR
Before a company can collect and process the personal information of European residents, it needs consent. This is the main basis of GDPR. If you compare GDPR with any other privacy regulation, you will find that this personal data definition is broadest and includes any type of info that can be used for user identification, including IP address, operation system, history of browser search or social media activity data.
Under the GDPR, EU citizens have the right to consent or reject the collection of data. Additionally, users can delete and control the personal information that companies collect for business purposes. In general, the regulations give users more freedom and control over the information they share with companies. The following are eight main rights that EU users obtain with GDPR:
The GDPR approach to personal data protection is based on eight principles that were documented back in 1980:
If the violation of fundamental privacy rights are proven, GDPR sets forth fines of up to 10 million euros or up to 2% of the company’s entire turnover of the preceding fiscal year. For especially severe violations, the fines for the companies can reach up to 20 million euros.
Main privacy principles of CCPA
The CCPA defines personal data as information that identifies (relates, describes or characterises – directly or indirectly) a particular consumer: real names or nicknames, postal addresses, social security, driver’s license and passport number, biometric data (height, weight, fingerprints), geolocation, browsing data and so on. Worth pointing out is that cookies are also considered personal data and therefore are subjected to the law.
According to the CCPA, entities that collect, use, process and sell personal information must:
According to the European directive, companies need to obtain user consent to process personal data. Under California law, however, an organisation is only required to process requests from users if they require the aforementioned information. Upon request, the company should satisfy such requests within 45 days. If the user’s data was lost, stolen or disclosed, the company has to pay $100 to $750 to each user who was affected.
Main privacy principles of COPPA
According to the main principles and provisions of COPPA, the operators of websites and internet services have no right to request and store the personal data of children without obtaining the official consent of their parents or guardians. The definition of “personal information” under COPPA has been expanded in the last law revisions. Now, this definition includes full name and contact details, including address, telephone number, email, Skype number, photo, video of the child and recording of the voice. The data contained in the cookies, such as IP address, device ID, as well as geolocation, can also be considered personal data.
The Federal Trade Commission (FTC), which is responsible for law enforcement, distinguishes between sites aimed at children and sites with a “broad audience.” The latter should follow COPPA only when they know that a certain proportion of their visitors haven’t reached 13 years of age.
According to the core principles of the law, the data operators that deal with information of minors should:
It’s worth noticing that the law provides several ways for consent obtaining. Still, the majority of sites (such as Facebook and Twitter) prefer to limit the access to users under the age of 13.
This is because the fines per one case of COPPA violation can reach up to $43,792.
Key differences among the laws
Although the above-mentioned laws may seem similar, they have many drastic differences, and that’s why preparing for them requires an in-deep approach with the involvement of professional lawyers. For instance:
How ad tech companies can adjust
It is clear that the future of ad tech (and all other industries) will be defined by transparent technologies. Sure, users might be more willing to agree with personal data collection and processing if data controllers clearly explain every step of the data processing in simple terms. However, compliance to GDPR, CCPA and COPPA constitute so much more than transparent, consent-giving mechanisms. They require compliance on every level of business functioning, including technologies, internal processes and dealing with partners.
In order to meet the requirements, the IAB (international advertising bureau) developed special GDPR and CCPA compliance frameworks and released a guide to navigating COPPA. Google uses a list of rules and regulations to protect personal data, which must be followed by the organisations and partners that work with automated advertising. Apart from these, here are a couple of practices that they deem worth following:
- Hire lawyers. Make sure privacy practices comply with all current laws. Perform internal audits regarding how those laws can affect your business
- Create a clear privacy policy that is easy to update. Explain to users what they will receive in exchange for their data and how you will apply this information and protect it. Give people answers to all of the questions regarding their data usage and protection
- Minimise data collection. Only collect and process information that is necessary for accomplishing certain purposes. As soon as data is no longer needed, delete it for safety reasons
- Make sure your partners comply. Audit your partners and the technology they use. They must adhere to the principles of confidentiality and take all necessary measures to comply with the laws.
- Implement a consent management platform when relevant. Make sure that users can control the use of their personal data. The consent request platform allows obtaining user permission directly from the site or app which streamlines personalised ad serving for publishers.
The bottom line
For any business, personal data serves as fuel for developing useful insights about existing and potential customers. However, the new era of privacy brings new challenges to businesses, especially those working in ad tech. On the one hand, the company should still be able to personalise advertising, and on the other hand, it should remain true to the principles of confidentiality and protection of personal data. International privacy frameworks are different and they continue to evolve. In relation to this, it is worth preparing beforehand and investing in mechanisms and procedures to ensure that your organisation is fully compliant.
