California, Colorado, Connecticut, Virginia, and Utah will take on new data protection laws in 2023. The laws apply to the collection and processing of personal information.

Whether this is based on the Internet Protocol (IP) address coming from the computer or mobile phone or device is not entirely clear.

While Google did not respond to a request for additional information, Insider Performance reached out to Chris Coomer, vice president of data analytics and insights at NP Digital. 

“The laws created by each state usually only apply to legal residents of that state,” Coomer said, adding that his comments come from an organizational perspective, not legal. “Most, if not all, businesses will err on the side of caution, seeing as it can become incredibly complex and expensive to determine who is a resident of each state. In addition, there is a lack of clarity on whether or not data housed in California is subject to CCPA/CPRA, even if you aren’t a California resident.”

NP Digital, which is based in San Diego, California, will be one of those organizations that errs on the side of caution, he said, and take the most restrictive, and therefore protective approach to data privacy, along with dozens of other organizations.

Google already offers publishers data-protection terms related to the General Data Protection Regulation (GDPR) in Europe.

Now it will offer service provider terms to supplement those existing laws, effective January 1, 2023. The service provider terms will be incorporated into Google’s existing contracts via the data protection terms, with no action required by the advertiser.

Data processing in Ad Manager, by default, is not restricted, and personalized ads will be shown to users on publishers’ sites or apps. For the ads to adhere to CCPA guidelines, settings will need to change to restrict data processing and only show non-personalized ads to eligible users in California.

The settings do not control data marketers may be sharing outside of accounts through processes like mediation.

If marketers choose “Don’t restrict data processing,” it selects the advertising partners that are eligible to receive bid requests for users that Google determines are located in California. It’s not entirely clear how Google does this, especially for people who travel from one state to another or have a residence in California, but do not live in the state full time, like myself.

When publishers enable restricted data processing, Google will limit the ways it uses data and begin serving non-personalized ads only. Non-personalized ads are targeted using contextual information, such as city, but not ZIP or postal code, geo-targeting based on current location, and content on the current site or app or current query terms.

Google disallows all interest-based audience targeting, including demographic targeting and user list targeting when in restricted data processing mode.

Google did not respond to a request for additional information at the time this post published.

Publishers will need to decide when and how to enable the restricted data processing mode, based on the company’s compliance obligations and legal analysis, according to Google.  (More details here on two common scenarios.)

 

California, Colorado, Connecticut, Virginia, and Utah will take on the new data protection laws that will apply to the collection and processing of personal information. Google will offer service provider terms to supplement existing data-protection laws, effective Jan. 1, 2023.