On March 8, 2024, the California Privacy Protection Agency (“CPPA” or “Agency”) Board (“Board”) will consider draft regulations that set forth how automated decisionmaking technology (“ADMT”) and profiling will be regulated under the California Consumer Privacy Act (“CCPA”). The proposal includes the regulation of a new concept of “behavioral advertising” that is deemed “extensive profiling” and thus a form of “automated decisionmaking” that has a significant impact on consumers, justifying both a complex, advanced notice and ability for consumers to opt-out. These would overlap with similar notice and opt-out requirements already in place for “sharing” of personal information for “cross-context behavioral advertising”, which involves use of personal information from more than one party (e.g., cross-site/app/service browsing information, or combinations of first- and third-party data). The proposal would make cross-context behavioral advertising a subset of the newly defined behavioral advertising, and bring within the scope of these proposed regulations any practice that involves the use of personal information, even exclusively first-party data, for advertising or marketing communications (with limited exceptions, such as where the communication is based solely on a current interaction). So, presenting a contextual ad or other content about cigars when a site user is reading an article about cigars would seemingly not be behavioral advertising, but remembering that the user is interested in cigars, to later recommend cigar-related products (think e-commerce site recommendations), would be.
In an op ed article published by Law360, we break down how this diverges from the approach of 12 newer state privacy laws, conflicts with current CCPA provisions (e.g., the current exception from “share” restrictions when the data is made available pursuant to a consumer’s direction) and creates CA-specific burdens for businesses that do not create offsetting benefits for California consumers that would justify the approach.
We will keep you informed on the Agency’s and the Board’s ongoing consideration of this issue and their other CCPA rulemaking activities. For more information, contact the authors.
Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only and is not intended to constitute or be relied upon as legal advice.