The Interactive Advertising Bureau’s IAB Tech Lab has unveiled the Global Privacy Platform (GPP) to standardize U.S. and global privacy preferences for digital ads and wants input on the plan.

Getting the privacy part of targeted advertising right could be crucial to the continued health of what has been a booming online ad market. Statista.com predicted that digital ad spending in the U.S. alone will top $200 billion by 2025.

The fruits of Protect Rearc and two years in the making, the GPP is a single protocol for transmitting privacy, consent and consumer-choice preferences from websites and apps to advertising tech providers. The idea is to mitigate privacy risks and square those protections with Europe’s Transparency and Consent regime and the California Privacy Rights Act (CPRA) — the U.S. has no national privacy framework, but one of the reasons for coming up with GPP is the threat of a balkanized system of differing state (and international) approaches.

“Regulations are hitting the books faster than we can build individual solutions for,” said Andrea Giannangelo, CEO of Iubenda, which provides privacy compliance services.

“Privacy regulations such as the GDPR, CCPA, CPRA, PIPEDA and numerous new local privacy laws, create immense complexity and fragmentation in the market," IAB Tech Lab senior director Jason Raqueno said. "The GPP is intended to enable participants across the advertising supply chain to navigate the complexity of numerous overlapping global privacy laws through a single platform and consent signaling protocol."

Rearc was launched in 2020 in response to the limitations of third-party cookies and other targeted ad identifiers.

Also: IAB Says National Privacy Regime Is Job One

According to IAB Tech Lab, which is the digital ad industry’s standard-setting body, the GPP “enables advertisers, publishers, and technology vendors in the digital advertising industry to adapt to regulatory demands across markets," cuts the cost of managing privacy compliance, and helps reduce risk by "a single framework to encode and transmit consumer privacy preferences, which they can leverage globally and across all platforms and channels.”

IAB Tech Lab CEO Anthony Katsur said the GPP is ready for global adoption, but IAB is first seeking comment (it will give interested parties 60 days). IAB is looking for input from “publishers, brands, media companies and legislative officials.” ■

The ad industry is telling California officials that the state is layering confusion upon confusion when it comes to trying to comply with new privacy laws, which they suggest are a moving target that is virtually impossible to hit.

That came in comments to California Attorney General Xavier Becerra on a third set of modifications to the California Consumer Privacy Act, modifications on top of changes proposed in a Nov. 3 ballot initiative that is likely to pass, the ad groups concede.

Related: CCPA Enforcement Begins Without Final Rules

The groups claim the modifications threaten businesses' free speech rights because they "(1) unreasonably restrict consumers from receiving important information about their privacy choices, (2) prescriptively describe how businesses must provide offline notices, and (3) unfairly fail to hold authorized agents to the same consumer notice standards as businesses."

Related: Consumer Groups Have Issues with CCPA

They argue that the changes would do nothing to help consumers, while impinging on businesses' free speech rights. They want the modifications further modified, including by "clarify[ing] that businesses communicating with consumers via telephone may direct them to an online website containing the required opt out notice as an acceptable way of communicating the right to opt out."

Related: Ad Agencies Say California Law Threatens Commercial Speech

Joining in the comments were the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, Network Advertising Initiative, American Advertising Federation, and the Digital Advertising Alliance.

ANA's Dan Jaffe said the new modifications on top of the old modifications on top of the ballot initiative will lead to a "never-ending fight to comply with privacy law in California."

Almost three dozen trade associations including the Association of National Advertisers, American Advertising Federation and the Association of Magazine Media, are invoking the coronavirus pandemic in asking California to delay enforcement of a new privacy law, the California Consumer Privacy Act (CCPA), until Jan. 2, 2021. 

The California Consumer Privacy Act (CCPA) went into effect Jan. 1, but the state has yet to finalize rules to enforce it, rules that have to be in place by mid year.  

Some of the same groups, including ANA and the IAB, argued for a similar delay back in January, citing the "extraordinary complexity of the law and the wide range of open issues to be clarified" as the reason for seeking a similar six-month delay from July 1, 2020. 

In a letter to California Attorney General Xavier Becerra Thursday (March 19) , they said that "given current events and the presently unfinished status of the regulations implementing the CCPA, businesses will not have the operational capacity or time to bring their systems into compliance with the final regulatory requirements." 

They argue that coming up with "innovative business procedures" to comply with the new law and enforcement regime is a formidable task, and too tall an order when many of those workers are at home and all are "doing their best to manage their personal and professional lives in the face of uncertain times." 

They say they support privacy--though many including ANA were not fan of how the bill tries to secure it--but want the extra time to "understand and effectively operationalize" the new rules. 

ANA has also argued that the law as approved could damage the California economy, an economy that, like all state economies, faces tough times ahead without that added issue.

Even as the California Attorney General was asking Congress to use the state's consumer privacy law as a template for federal privacy legislation, advertisers were trying to get the state to clarify/adjust that template so they can continue to place the targeted ads that support free online content. 

The California Consumer Privacy Act (CCPA) went into effect Jan. 1, but the state is seeking input on just how to enforce it. Rules to do that have to be in place by midyear. 

Related: Ad Groups Seek Delay of California Privacy Law 

In comments filed with the attorney general's office, according to a draft supplied to Multichannel News, the Association of National Advertisers said it was all about working to make the bill better, but a bill it clearly still has issues with the CCPA, which it calls a "novel, operationally complex, and, in many ways, confusing law" with "significant and detrimental impacts on consumers and businesses" if those shadows remain unaltered by future tweaks. 

But ANA says working to make the bill "better" is imperative, because the law as it stands could damage the California economy. 

"We and our members strongly support the responsible use of data and the underlying goal of enhancing consumer privacy that is inherent in the CCPA and its implementing regulations," ANA told the AG's office. "We are encouraged that the updated rules provide a degree of enhanced clarity surrounding some ambiguous provisions in the law. Nevertheless, the regulations remain significantly unclear in several areas of vital importance to both consumers and businesses."  

That "several" comprised at least 15 clarifications/asks, which it leant the gravitas of imposing roman numerals: 

I. "Provide Businesses a Reasonable Period of Time to Implement the New Regulations 

II. "Clarify Requirements Surrounding Loyalty Programs So Businesses May Continue to Offer Such Programs to Californians" 

III. "Clarify that Businesses May Choose to Honor User-Enabled Global Privacy Controls or Provide Consumers Another, Equally Effective Method for Opting Out of Personal Information Sale 

IV. "Update the Household Definition to Better Reflect Appropriate Business Practices

V. "Add a Provision Clarifying that Information Businesses Collect, Use, and Share for Fraud Prevention Purposes is Not Subject to Certain CCPA Rights

VI. "Enable Flexibility for Providing the CCPA-Required Notice at Collection toConsumers Through the Telephone and in Person

VII. "Remove New Duplicative and Unclear Transparency Requirements

VIII."Remove the Limitation on Service Providers’ Internal Use of Personal

IX. "Clarify the Requirement to Obtain Parental Consent for Minors “in addition to” Verifiable Parental Consent Under the Children’s Online Privacy Protection Act (“COPPA”) 

X. "Remove the Requirement to “Permanently and Completely” Erase Personal Information

XI. "Remove the Requirement to Provide a General Toll-Free Contact Number to Receive Consumer CCPA Requests 

XII. "Clarify How Businesses Must Respond to CCPA Requests When They Maintain Personal Information In A Manner that Is Not Associated With An Identifiable Person 

XIII."Clarify and Alter the Disclosures Required of Businesses that Buy, Receive, Sell, or Share Personal Information of 10 Million or More Consumers

XIV. "Affirm that Required Notices May Be Provided in a Privacy Policy

XV. "Grant Online Businesses that Do Not Maintain Personally Identifying Information Flexibility to Provide Effective Opt Out Mechanisms" 

Major advertising associations have called on California Attorney General Xavier Becerra to delay enforcement of the state’s tough new privacy law, the California Consumer Privacy Act, which went into effect Jan. 1, though a formal enforcement framework has yet to be hammered out.

The Association of National Advertisers (ANA), American Association of Advertising Agencies, American Advertising Federation (AAF), Interactive Advertising Bureau (IAB), and Network Advertising Initiative (NAI) told Becerra that the thousands of companies they represent need more time to review and implement the final regs once they are released.

RELATED: IAB Floats CCPA Compliance Framework

The industry groups argued that even though the law went into effect, how it will be overseen and enforced has yet to be determined so it is unclear what the compliance obligations will be.

"Given the extraordinary complexity of the law and the wide range of open issues to be clarified from the draft guidance, there will not be sufficient time for many businesses to effectively implement the final regulations prior to the anticipated enforcement date of July 1, 2020," they said.

There could be even less clarity if the rules change between now and when they are finalized, the groups added.

They say the law should not be enforceable until six months after the final rules are released, rather than the current July 1 trigger date.

The new year has brought new action on the privacy front as states and the federal government try to figure out how to protect user data while allowing it to be monetized to support the free internet content model the country has come to rely on.

The alternative could be a Balkanized internet with sites charging for access and users asked to determine for themselves what information they want to share and when they want to share it.

While access and choice was once the mantra — and access still is — privacy activists are concerned that choice could become a synonym for putting the onus on users to figure it all out. For their part, websites would simply provide transparency about all that collection — likely in slightly larger type or in less Byzantine privacy policies.

Platforms big and small are concerned that if an approach like the tough California privacy law that just went into effect becomes a road map for federal legislation — which many Democrats looking to capture both House and Senate in the fall would like — the free online model could definitely be in trouble.

Amazon is no fan of the California Consumer Privacy Act (CCPA), particularly of its broad definition of personal information. The bill established a consumer right of privacy based on disclosure, the right to opt out of data collection or third-party sharing and the right to have data deleted if a user so chooses.

One site dedicated to providing info on where to find radio stations on the internet (StreamingRadioGuide.com) closed its doors at the end of the year, citing the California privacy law. “I have decided to cease operations rather than face the potential legal threats from the California Consumer Privacy Act (CCPA), which goes into effect at midnight on January 1st, 2020,” Fred Stiening, the site’s founder, said in a note to former users.

All of that comes against a backdrop of tension and suspicion aimed from inside the Beltway toward Big Tech in general over breaches and data over-sharing and under-informing, not to mention “real” fake news, election ad issues, accusations of bias and attacks from both the right and the left at web platforms’ current shield from legal liability over third-party content.

Looking to steer that model toward self-regulation, the Trump administration’s National Institute of Standards and Technology (NIST) has released a guide to privacy best practices.

The idea is to continue to get the benefits of data collection while mitigating the privacy risks and avoiding a one-size-fits-all approach, an approach which deregulatory types often associate with "heavy handed" government regulation.

The self-regulatory framework is not binding, but is instead meant to be a tool for privacy-by-design practices that put privacy risks on the same level as other risks.

It is billed as supporting:

• “Building customers’ trust by supporting ethical decision-making in product and service design or deployment that optimizes beneficial uses of data while minimizing adverse consequences for individuals’ privacy and society as a whole;

• “Fulfilling current compliance obligations, as well as future-proofing products and services to meet these obligations in a changing technological and policy environment; and

• “Facilitating communication about privacy practices with individuals, business partners, assessors and regulators.”

NIST said the framework is the result of input from public and privacy stakeholders and the product of three workshops, requests for info and comment, five webinars and hundreds of stakeholder meetings.