CCPA Compliance Options for Publishers
What is the CCPA?
The California Consumer Privacy Act (CCPA) is intended to enhance privacy rights and consumer protection for residents of California in the United States. (We expect other states to follow with similar legislation in the future.) The CCPA provides consumers with the ability to opt-out, the right to ask advertisers to disclose what data they possess on the user, and the right to request deletion of that data.
What does CCPA require?
Unlike the GDPR (General Data Protection Regulation), there is no opt-in notice required so consent management platforms (CMPs) are not the prevailing solution for CCPA. The law requires that consumers from California have the right to:
- Opt-out of the "sales" of their personal information
- Access what information has been collected on them
- Request to have their data deleted
What do publishers need to do?
Publishers will need to make their own determination on whether CCPA applies in their situation. However, regardless of a publisher’s assessment of their status under CCPA, Rakuten Marketing has determined that it, (Rakuten Marketing), qualifies as a business that collects information that may be sold to third parties. As such, Rakuten Marketing is required to provide explicit notice and an opportunity to opt-out at, or before, the point of data collection. This means that a California resident needs to be presented with explicit notice and an opportunity to opt-out of Rakuten Marketing tracking on the page that the publisher places Rakuten Marketing provided tracking.
The Publisher Membership Agreement has been updated to include the CCPA requirements, and you will need to accept the new agreement to continue as a publisher in our network, or decline and delete your publisher account.
Beginning January 1, 2020, Rakuten Marketing will require that publishers implement a privacy rights link to a page (either Rakuten Marketing provided or Digital Advertising Alliance [DAA] provided) that provides the necessary disclosures and the opt-out. See the mock-up image of the privacy rights link and page below.
In addition, if a publisher has implemented Rakuten Marketing tracking pixels, we will require that the publisher also send signals indicating the consumer’s opt-out status consistent with the IAB Signals Framework.
A publisher will be relieved of this obligation if they can demonstrate that they geo-block California-based traffic or otherwise suppress California-based traffic from Rakuten Marketing’s tracking processes.
Publisher Rollout and Enforcement
CCPA laws go into effect on January 1, 2020 with enforcement beginning July 1, 2020. Given this timeline, the Rakuten Marketing network quality team will begin auditing implementation in Q1 2020. Failure to meet compliance requirements may result in:
- Suspension of payments for publishers with California user transactions.
- Potential termination of publisher relationship.
Publishers Have Three Options for CCPA Compliance
Option 1: Affiliate Link Opt-Out Signals (Preferred Option)
Publishers must also collect an opt-out signal from the consumer and pass consent information to Rakuten Marketing using the consent parameter “cnst.” Instructions are available in the attached technical document, "Passing CCPA Opt-Out in Affiliate Links".
Mock-up of Privacy Rights Link and Page
Option 2: CMP Integration
If you are already using a consent management platform (CMP) for GDPR, there may be integration opportunities with your existing tool, depending on your CMP. You can contact the publisher support team at firstname.lastname@example.org to determine if there are integration opportunities with your existing CMP tool.
The quick reference chart below may help you understand how your CMP tool handles CCPA requirements.
Option 3: Rakuten Marketing Disclosure and Opt-Out Link
Include a “Your Privacy Rights” link on each page of your website, which directs to a page that provides the following disclosure:
“The below companies may collect personal information when you interact with our digital property, including IP addresses, digital identifiers, information about your web browsing and app usage and how you interact with our properties and ads for a variety of purpose, such as personalization of offers or advertisements, analytics about how you engage with websites or ads, and other commercial purposes. For more information about the collection, use and sale of your personal data and your rights, please use the below links.”
Mock-up of Privacy Rights Link and Page
Custom Option: This is a Rakuten Marketing-provided option and has some flexibility to be adjusted to a publisher’s preferences. You can use or adapt the text and table format below on your website:
"The below companies may collect personal information when you interact with our digital property, including IP addresses, digital identifiers, information about your web browsing and app usage and how you interact with our properties and ads for a variety of purposes, such as: personalization of offers or advertisements; analytics about how you engage with websites or ads; and other commercial purposes. For more information about the collection, use, and sale of your personal information and your rights, please use the below links."
As well as a link to our user rights / opt-out page: https://rakutenmarketing.com/legal-notices/subject-requests
Please reach out to email@example.com with any additional questions.
Still have more questions? Use the SUPPORT tab at the top of the page or this link to find the email or phone Customer Support contacts for your location.