How to Track and Manage Advertising Opt-Outs

how-to-track-and-manage-advertising-opt-outs

The California Consumer Privacy Act of 2018 (CCPA) provides California residents four rights—the Right to Know, Right to Delete, Right to Opt-Out, and Right to Non-Discrimination. The Right to Opt-Out is a consumer’s right to opt-out of a sale of personal information.

As a business, you will have to determine if you “sell” personal information under the CCPA. One common scenario that many businesses consider a sale under the CCPA is the use of interest-based advertising. You can read more about it in our two-part blog series. If you are “selling” information, you must provide California consumers with a way to opt-out of this sale.

Why You Need to Track Advertising Opt-Outs

If you use interest-based advertising, you’ll want to ensure web visitors can opt out of having their information shared with ad networks. Doing so helps you build trust with customers and web visitors through transparent consent-based privacy practices. Additionally, non-compliance with the CCPA may result in monetary penalties. Read about why it’s better to get compliant sooner rather than later.

Opt-out tracking isn’t just required by the law, it’s also good business practice. By recording the specific dates that requests were made, you can schedule a request to ask the consumer to opt-in again after 12 months.

How Do I Fulfill My CCPA Obligations?

There is no one perfect way to track opt-outs but you’ll want to consider a variety of methods to determine what works best for you.

  • Find out if your ad networks provide solutions to help you comply with the CCPA.

    For example, Facebook’s Limited Data Use (LDU), or Google’s Restricted Data Processing (RDP) can help you provide website visitors with a way to opt out. These settings, when enabled, change the way these services process data. The easiest way to learn about these solutions is to search the vendor or ad network name along with the phrase “ccpa opt out”.

  • Include a conspicuous link titled “Do Not Sell My Personal Information” on your website that leads to a form and/or directions that your customers can follow to submit a request to opt-out.

    You may need to provide multiple sets of directions for opting out depending on the type of "selling" that you do.

    • Opting Out of Cookie-Based Sharing
      • The most direct way way to track and manage cookie opt-outs is to use a custom plug-in or third party cookie opt out tool on your website. This is something that your website development team should review and implement. The plug-in or opt out tool should give the customer control over what information they share through the website and should provide you with a log of requests for your records.
      • You can provide a cookie opt-out by directing website visitors toward user-enabled global privacy tools like the Digital Advertising Alliance’s (DAA) opt-out tool: AdChoices (https://optout.aboutads.info/). This tool allows consumers to opt-out of cookie collection from participating ad networks. You’ll need to list out which ad networks you use that are participating DAA members so your website visitors can select your specific ad networks for the opt out.
      • Some ad networks require your website visitors to opt out through their own specific tools. For example, for LinkedIn Ads, a consumer would have to toggle settings on LinkedIn’s website in order to opt out. LinkedIn provides a special site for website visitors who do not have a LinkedIn account. It’s essential to make sure that all website visitors can opt out of having their information shared with each of your ad networks, not just those that have an account with the platform.

Important Note!

While the DAA tool and ad network-specific tools can enable California consumers to opt-out, it does not provide a way for your business to track and keep record of these opt-outs. Your next best option may be to keep a log of IP addresses and time stamps of web visitors that click on the opt-out links you provide.

    • Opting Out of Direct Sharing
      • Some types of interest-based advertising require that your business “sell” personal information, like a name and email address . Sharing names and email addresses with ad networks is common practice for advertising services like lookalike audiences. If you participate in this type of selling, you will have to create a process that removes people who have opted out from the list of names and emails you share with ad networks. You may need to email the ad network directly to understand how to best honor an opt out request.
    • Other Opt-Outs
      • Other methods of opt-outs you could offer include receiving requests through an email address or physical mailing address. Businesses also have the option to provide a toll-free number that consumers may call to make requests.

Need Help with Opt-Outs?

TrueVault offers businesses an easy solution to get CCPA compliant. If you need help, schedule a call with us!

Schedule Call