With CCPA looming, publishers are confused and consumers are unlikely to share their data

In practice, however, programmatic transactions can still occur even after someone opts out of sharing their data.

“You could receive that cookie information to serve an ad,” said Jessica Lee, an attorney at Loeb and Loeb, “but you couldn't continue to use it to build for profiling purposes, which would make programmatic more challenging but it could still happen.”

Lee, who co-chairs the firm's privacy, security and data innovations practice group, said Wednesday at a breakfast event in New York that the “do not sell” restriction happens on a go-forward basis once a consumer opts out.

“Starting from that point when someone says, ‘Do not sell,’ that publisher is no longer able to share data for a sale purpose. So programmatic can still happen with respect to data collected prior to that point.”

Jim Spanfeller, chief executive officer of G/O Media, said at the same event that it’s “impossible to predict” how CCPA will impact publishers and add that ideally, it will level the playing field among smaller publishers and data-rich giants such as Google and Facebook.

“There seems to be a higher likelihood near-term that the confusion will, as confusion usually does, lead to a higher barrier to profits,” said Spanfeller. “But if I had to sit here and make a prediction... I would say that after three quarters, four quarters [or] two years, that actually publishers will be in a much better place than they are right now.”

What is a sale?

Lee said that in theory, once a consumer opts out of being tracked, marketers can only transact programmatically against that person for the lifespan of that person’s cookie, or internet tracking tool.

“You can use the information for a business purpose, and advertising and marketing is still considered a business purpose,” said Lee. “You just can't sell. This is the challenge of there's still no unified definition of what a sale means.”

CCPA defines a sale of data very broadly, going beyond the typical framework of buying or licensing of data to include any sharing or disclosing of data for “monetary or other valuable consideration,” Lee said. This can include data that’s used to improve a company’s algorithms.

Regardless of the definition, consumers seem to be unlikely to share their personal data.

Britepool, which hosted the breakfast event, ran a study with Annenberg Research that found 87% of consumers are likely to select “Do Not Sell My Personal Information,” with only 8% continuing to the website. Plus, 77% of those surveyed said that they’re either strongly or somewhat unhappy that companies are profiting off of their personal data.

Britepool chief operating officer Bob Perkins said consumers are open to changing their minds if they’re presented information, control and rewards.

The survey found that if a website included the option to “Reward Me for My Personal Information,” then 61% of visitors would choose to disallow the sale of their information, with 21% choosing to continue to the site with the promise of a reward. Only 7% would go onto the site without any reward.

Lee said CCPA encourages publishers to rethink how they message consumers on why they shouldn’t opt-out, and look to encourage log-ins or subscriptions to bolster their first-party data sets.

What to do about Facebook and Google?

Facebook and Google dominate the digital advertising market partly because they’re embedded within many publishers.

Facebook, for example, embeds pixels – or codes – within the ads they run on publisher sites that track conversion and build audiences. Publishers also connect to Facebook if they include a like button on their page.

Lee said CCPA should force publishers to rethink their relationships with the likes of Google and Facebook in ways that don’t make them wholly dependent on those platforms to reach consumers.

“All the widgets on your sites, all the third-party trackers on your site… [that are] collecting anything on your site, whether it's a like button or something else, can potentially be a sale,” said Lee.

Publishers should also take this as a chance to get their house in order, with Spanfeller noting that the amount of trackers on any publisher site is “probably well outside their understanding".

“This is what happened with GDPR,” said Lee. “You go to a publisher and they have no idea the pixels that are left on their site, or something that was put up from a campaign that was never taken down, or someone in the ad group let some advertiser put something up and there's just no way to track it. I think companies now are going to have to get their arms around this a little bit more and have a little bit more governance.”

Lee added that the parameters of CCPA will probably play out through enforcement, much like GDPR, which will likely begin six months after the bill is signed into law.

“It’ll be those first enforcement actions that give us an eye to what this law really looks like,” said Lee. “The goal is to just not be that company that's on the front line.”