California, Colorado, Connecticut, Virginia, and Utah will take on new data-protection laws in 2023. The laws apply to the collection and processing of personal information.

Whether this is based on the Internet Protocol (IP) address coming from the computer or mobile phone or device is not entirely clear.

Inside Performance reached out to Chris Coomer, vice president of data analytics and insights at NP Digital, in November. 

“The laws created by each state usually only apply to legal residents of that state,” Coomer said, adding that his comments come from an organizational perspective, not a legal one. “Most, if not all, businesses will err on the side of caution, seeing as it can become incredibly complex and expensive to determine who is a resident of each state. In addition, there is a lack of clarity on whether or not data housed in California is subject to CCPA/CPRA, even if you aren’t a California resident.”

NP Digital will be one of the organizations that errs on the side of caution, he said, and will take the most restrictive and therefore protective approach to data privacy, along with dozens of other organizations. NP Digital is based in San Diego, California.

Google already offers publishers data-protection terms related to the General Data Protection Regulation (GDPR) in Europe.

Now it will offer service provider terms to supplement those existing laws, effective January 1, 2023. The service provider terms will be incorporated into Google’s existing contracts via the data-protection terms, with no action required by the advertiser.

Data processing in Ad Manager, by default, is not restricted, and personalized ads will be shown to users on publishers’ sites or apps.

In order for the ads to adhere to CCPA guidelines, settings will need to change to restrict data processing and only show non-personalized ads to eligible users in California.

The settings do not control data marketers may be sharing outside of accounts through processes such as mediation.

If marketers choose “Don’t restrict data processing,” it selects the advertising partners that are eligible to receive bid requests for users that Google determines are located in California. It’s not entirely clear how Google does this, especially for people who travel from one state to another or have a residence in California, but do not live in the state full-time, like myself.

When publishers enable restricted data processing, Google will limit the ways it uses data and begin serving non-personalized ads only.

Non-personalized ads are targeted using contextual information, such as city, but not ZIP or postal code, geo-targeting based on current location, and content on the current site or app or current query terms.

Google disallows all interest-based audience targeting, including demographic targeting and user list targeting when in restricted data processing mode.

Google did not respond to a request for additional information at the time this post was published.

Publishers will need to decide when and how to enable the restricted data-processing mode, based on the company’s compliance obligations and legal analysis, according to Google. (More details here on two common scenarios.)

This column was previously published in Inside Performance on November 17, 2022.

 

California, Colorado, Connecticut, Virginia and Utah will take on new data-protection laws that apply to collection and processing of personal information.