Center for Digital Democracy, Consumer Federation of America, Consumer Reports, Media Alliance, and Oakland Privacy write to comment on the Interactive Advertising Bureau’s (IAB) recently-published draft compliance framework for the California Consumer Privacy Act (CCPA), the landmark privacy legislation set to go into effect in January 2020. The undersigned groups are disappointed that IAB appears to adopt contorted legal interpretations of the CCPA in order to avoid making any meaningful changes to the ad tech data sharing practices that were the fundamental motivation behind the law.
At the very least, consumers should expect that sending a “Do Not Sell” instruction would turn off third-party behavioral advertising based on that publisher’s data on that device. But the IAB framework offers publishers several options to circumvent that primary purpose of the CCPA. Instead, IAB purports to send consumers to existing failed self-regulatory mechanisms to exercise choices about targeted advertising—despite the fact that the ineffectiveness of those programs was the reason for regulatory intervention.