Ad industry requests delay on CCPA enforcement

Insufficient time to prepare was the argument invoked by five advertising trade bodies this week when requesting enforcement of the CCPA be delayed until at least six months after the law is finalized. In a letter to California Attorney General Xavier Becerra, the five advertising and marketing associations—the American Association of Advertising Agencies (4A’s), Interactive Advertising Bureau (IAB), Association of National Advertisers (ANA), American Advertising Federation (AAF), and Network Advertising Initiative (NAI)—point out the draft rules still need to be revised based on input received during the initial comment period from December.

At the time, businesses impacted by the law submitted more than a thousand pages of comments. Once those revisions are made—whenever that may be—there will be another subsequent comment period that could last anywhere from 15 to 45 days.

After that still-undetermined time period, the Office of Administrative Law will also need its turn to review the rules before they become final. Beyond that point, how much reasonable time remains for businesses to prepare and adjust their compliance efforts is unknown.

“The limited and quickly shrinking time before the existing enforcement deadline … will place businesses in a nearly untenable position. Without final regulatory requirements, businesses will be unable to make operational changes to their systems, further delaying finalization of their compliance programs,” the letter states.

While the trade bodies are lending their voice to the matter, they are correct that many businesses are deeply concerned. Last December, nearly half of 100 polled compliance practitioners in a joint survey by Compliance Week and ACA Aponix admitted feeling largely uneasy about their company’s CCPA-readiness.

Another point the letter makes is amendments made by the California Legislature in October introduced new significant and unprecedented requirements, around which businesses are still struggling to wrap their hands. For example, the draft regulations introduced the requirement that when a California consumer invokes an opt-out request, the business must notify all third parties to whom it has sold that consumer’s personal information (PI) within the last 90 days that the consumer has opted-out and that they must not further sell that consumer’s data. This requirement poses a thorny and potentially uphill battle to businesses working with innumerable third parties.

Like Google, for instance.

Back in September, Google and other technology firms lobbied for legislative approval to continue collecting user data for targeted advertising, in some cases even if the consumer opted out, according to the Los Angeles Times. Among other things, the proposal sought to create a loophole for companies when users requested access to their own data or requested their PI be deleted—two central tenets of CCPA.

Given the state of purgatory in which businesses find themselves, whether Google’s proposed amendments to the CCPA will fail in the long run remains to be seen. In the meantime, the tech giant has laid out language to assist advertisers in complying with CCPA vis-a-vis its online advertising platform, Google Ads.

In addition, just last week Justin Schuh, director of Google’s Chrome engineering, announced plans to phase out support for third-party cookies in Chrome (Google’s popular web browser) within the next two years.

“Users are demanding greater privacy—including transparency, choice and control over how their data is used—and it’s clear the web ecosystem needs to evolve to meet these increasing demands,” Schuh wrote on his Chromium Blog.

While Google is trying to get ahead on managing its third-party providers, other companies cannot say the same. Sixty-nine percent of respondents surveyed by CW and ACA Aponix reported they had not yet started investigating how third-party providers collected and managed consumers’ PI.

Which gets us back to the ad industry’s letter to the California AG. While businesses “are still contending with the proposed regulations’ new mandates,” the letter states, “and … working earnestly to adjust their systems and build new processes to facilitate compliance,” they are still behind the eight ball and could benefit from more time.

The letter to Becerra was signed by Dave Grimaldi, IAB executive vice-president for public policy; Dan Jaffe, ANA group executive vice-president of government relations; Alison Pepper, the 4A’s senior vice-president; Christopher Oswald, ANA senior vice-president of government relations; David LeDuc, NAI vice-president of public policy; and Clark Rector, AAF executive vice-president of government affairs.