Google, Facebook, and other tech advertising companies are seeking to avoid a new California requirement that they stop selling consumers’ data upon request.
The companies through their trade groups asked California Attorney General Xavier Becerra (D) to treat some of their business units as service providers, which would exempt them from the requirement, in rules for enforcing the California Consumer Privacy Act. Service providers, which process data on behalf of businesses, are exempt because they don’t sell consumer information.
The ad tech sector views itself “as one big neutral service provider,” said Adam Schwartz, senior staff attorney at the nonprofit Electronic Frontier Foundation, which opposes such an exemption for the companies.
The request before Becerra tests whether tech companies can avoid a potential flood of demands from consumers to stop selling their data when California’s privacy law takes effect Jan. 1. Companies such as
The California law, enacted last year, aims to empower citizens to stop companies from selling their data. Companies that meet the exemption standard as service providers include cloud computing firms, web hosts, and business-to-business services that don’t monetize data, privacy and advertising attorneys said.
If tech advertisers get themselves added to the list of service providers, they could share users’ data without the risk of being stopped by the consumer requests. That would protect their revenue streams, because tech companies make money by using data to place ads for companies based on consumer interests and spending habits.
If Becerra rejects the ad companies’ request, they likely will be subject to consumer opt-out requests, said Alysa Hutnik of Kelley Drye & Warren LLP. She represents advertising firms.
The International Advertising Bureau, a trade group with members including Facebook, told Becerra in a Dec. 6 filing its members are service providers because they share personal information for a “permissible business purpose.”
The Association of National Advertisers, with members including Google, told Becerra the advertising industry should be able to use personal data to “improve services.”
Becerra’s office declined to comment on the advertisers’ request. In early 2020, he will release rules for the California law’s enforcement, which will begin July 1.
An IAB representative didn’t immediately respond to a request for comment. Facebook didn’t immediately respond to requests for comment. Jose Castaneda, a spokesman for Google, responded by pointing to a Dec. 19 privacy blog post.
Opponents of the ad companies’ request say legislators didn’t craft California’s law to give advertisers a free pass. Labeling advertisers as service providers would be “contrary to the overall intent of the law,” said Joseph Lazzarotti of Jackson Lewis PC. He represents multinational companies on privacy, data security, and social media regulations.
Ad tech companies are bolstering their argument that they should be treated as service providers by saying on their websites that they don’t sell data. They share it, they say.
Facebook is “committed to clearly explaining how our products work, including the fact that we do not sell people’s data,” the company wrote in a Dec. 12 blog post.
Google doesn’t sell “personal information to anyone,” the company says on its website. Rather, it uses data to deliver “relevant ads in Google products, on partner websites, and in mobile apps,” the company said.
Google and Facebook are part of a “rolling wave of companies” that say they don’t sell consumer data, Hutnik said. Such assertions may not be persuasive because the companies “have been about data monetization and consumer data use,” she said.
Companies that want to be considered service providers should start acting like it, if they aren’t already, Hutnik said. As they look at their business practices, she said, “they may need to make changes.”