The Ad Industry Wants a Delay to CCPA Enforcement As It Considers CCPA Cookie Compliance Frameworks and Ongoing Rulemaking
A letter penned by the top ad industry trade associations (the American Association of Advertising Agencies, the Interactive Advertising Bureau (IAB), the Association of National Advertisers, the American Advertising Federation and the Network Advertising Initiative) was sent on Jan. 29 to California Attorney General (AG) Xavier Becerra requesting a delay in enforcement of the California Consumer Privacy Act (CCPA) until at least six months from the final promulgation of the regulations called for by that new law, which became effective on Jan. 1. A first draft of the regulations was published on Oct. 10, 2019, the period for public comments on that first set of proposed regulations closed on Dec. 6 and the AG has yet to respond with revised rules. The legislature amended the CCPA back in 2018 to delay the AG’s enforcement until the earlier of six months from the finalization of the regulations or July 1, 2020. Given the state of the rulemaking, it is clear that July 1 will be the commencement of enforcement under the terms of the current statute, unless that date is pushed back. However, the problem, the letter points out, is that with no second set of regulations available, and accounting for the further comment, review and revision process that will follow them, it now appears likely “that the draft rules will not be finalized before, or only a short period prior, to the law’s July 1, 2020, enforcement date.”
The associations requested the further delay to allow companies more time to figure out how to implement the CCPA requirements given the “extraordinary complexity” of the law and the “wide range of open issues” in need of clarification. The letter goes on to explain that at least six months from the date final rules are available would be practically necessary to implement those rules. While the request is reasonable and would be sound policy for these reasons, it is unclear whether the enforcement date can be changed without legislative action, which is highly unlikely to occur. The CCPA gives the AG authority to “adopt regulations as necessary to further the purposes of this title,” and allowing sufficient time for businesses to design and implement compliance solutions that reflect the final regulations would seem to be in the spirt of that. In addition, the AG could exercise prosecutorial discretion to simply fail to take action on certain aspects of the law and regulations for a given period after the enforcement commencement date, to enable businesses reasonable time to implement the final regulations and any guidance that may accompany them. The AG’s office has stated that it received the trade associations’ letter, but that it will not be responding to anything outside the formal rulemaking process, so we will have to wait for the next version of the regulations to see if the AG adopts the associations’ reasoning. In any event, the AG has already stated that he does not believe the delay in enforcement is a safe harbor for noncompliance. Accordingly, businesses should be working expeditiously to implement their CCPA obligations based on the statute and the proposed regulations to the greatest extent practical.
Not directly mentioned in the ad industry letter, but the biggest open issue confounding the ad, retail and publishing industries, is the lack of consensus regarding, and differing ad industry compliance frameworks for addressing, cookies and interest-based advertising in the context of the CCPA’s requirements and restrictions. The first set of proposed regulations are silent on this issue. The IAB and Digital Advertising Alliance (DAA) have both developed frameworks for addressing the CCPA, and do so in differing ways. Google has its own approach that it recently rolled out. If the next version of the regulations sheds any light on the validity of one or more of these programs, it will give businesses more guidance on how to address tracking technologies, particularly those that enable digital advertising. In the meantime, businesses should review the IAB Framework and DAA Framework, and consult with the operators of cookies and other tracking technologies associated with their websites and mobile apps as to how those operators plan to address the CCPA with regard to their associated data collection activities. Businesses can then better determine how they, in turn, should do so. We will continue to provide updates on this issue.
For more on the CCPA, see our Consumer Privacy Resource Center.
This article originally appeared in JDSupra.
