What Happened?

On February 2, 2022, the Belgian data protection authority (the “APD”) released a decision following its investigation of IAB Europe’s administration of the Transparency and Consent Framework (“TCF”).  The TCF is a set of technical standards and policies designed to help all parties in the digital advertising chain comply with the EU’S GDPR and ePrivacy Directive when processing personal data (or other information stored on a user’s device, such as cookies). The TCF works by encoding and signaling users’ privacy preferences in transparency and consent strings (“TC Strings”).

The APD’s decision asserts that for GDPR purposes, TC Strings are personal data and that IAB Europe is a co-controller of TC Strings (along with other entities that process TC Strings). Further, the decision orders IAB Europe to take certain steps to bring its processing of any personal data in TC Strings into compliance with the GDPR.

The IAB joins IAB Europe in disagreeing with this conclusion.

What does the APD’s decision order the IAB Europe to do?

The APD’s decision orders IAB Europe to take the following actions:

• Establish its own legal basis for processing TC Strings insofar as it is a controller of personal data in connection with TC Strings.
• Delete TC Strings with globally-scoped consents from servers IAB Europe controls (the current version of the TCF no longer supports globally-scoped consents, in any case).
• Make updates to the TCF, including:
  • Improving the technical and organizational measures used to ensure the integrity of TC Strings.
  • Implementing audit procedures for TCF participants to evaluate their GDPR compliance.
  • Removing legitimate interest as an available legal basis under the TCF.
  • Setting new standards for and increasing the uniformity of the user interfaces presented by participating consent management platforms (CMPs).
• Take procedural steps the GDPR requires of controllers of personal data, including updating records of processing activities, carrying out a data protection impact assessment, and appointing a Data Protection Officer.
• Pay an administrative fine.

The order provides IAB Europe with two months to develop an action plan for complying with the decision that can then be executed within a six-month time frame. IAB Europe is not prohibited from operating the TCF during this interim period.

What is the scope of the remedial actions ordered by the APD?

IAB Europe was the subject of the APD’s investigation, and the GDPR compliance issues identified by the APD are focused on the IAB Europe’s role as the Managing Organization of the TCF. Accordingly, the orders issued in the APD’s decision are limited to the IAB Europe in its role as the TCF’s Managing Organization.

Further, the decision clearly distinguishes its findings regarding the IAB Europe’s role in managing the TCF and TC Strings from other processing of personal data that may occur through OpenRTB advertising transactions. The Chairman of the APD’s litigation chamber, Hielke Hijmans, also emphasized that the decision is limited to the TCF, “not the whole real time bidding system[.]”

Every controller of personal data under the GDPR is responsible for establishing its own legal basis for processing personal data, but the APD’s decision does not order specific actions regarding any entity other than IAB Europe. For example, the decision states explicitly that the IAB Tech Lab merely acts as a provider of the OpenRTB system and is not a data controller for any personal data processed through OpenRTB.

How is the IAB Europe responding to the decision?

IAB Europe released a statement rejecting the APD’s findings, and have published a “FAQ” document available for download here. Specifically, IAB Europe disagrees with the conclusion that it is a controller of any personal data in TC Strings as a consequence of its administration of the TCF. IAB Europe is currently appealing the ruling.

In parallel with its efforts to challenge the APD’s novel conclusion that IAB Europe is a “controller” of TC Strings, IAB Europe will convene its TCF working group and develop an action plan for responding to the APD’s orders concerning updates to the TCF itself.

The IAB and The IAB Tech Lab are actively supporting IAB Europe in responding to the APD’s decision and in meeting the challenges posed by it. IAB Tech Lab is working to assist IAB Europe with incorporating new products and technical standards that will meet the new market requirements.

About IAB

The Interactive Advertising Bureau empowers the media and marketing industries to thrive in the digital economy. Its membership comprises more than 700 leading media companies, brands, agencies, and the technology firms responsible for selling, delivering, and optimizing digital ad marketing campaigns. The trade group fields critical research on interactive advertising, while also educating brands, agencies, and the wider business community on the importance of digital marketing. In affiliation with the IAB Tech Lab, IAB develops technical standards and solutions. IAB is committed to professional development and elevating the knowledge, skills, expertise, and diversity of the workforce across the industry. Through the work of its public policy office in Washington, D.C., the trade association advocates for its members and promotes the value of the interactive advertising industry to legislators and policymakers. Founded in 1996, IAB is headquartered in New York City.

IAB Media Contacts
Kate Tumino / Brittany Tibaldi
212-896-1252 / 347-487-6794
ktumino@kcsa.com/ btibaldi@kcsa.com

The post IAB Responds to Belgian DPA Ruling appeared first on IAB.

NEW YORK, NY (October 22, 2019) – IAB, the trade association for the digital media and marketing industries, and its affiliated standard-setting organization, the IAB Technology Laboratory, today released for public comment the IAB California Consumer Privacy Act Compliance Framework for Publishers and Technology Companies to help digital publishers and their supply chain partners comply with California’s data privacy legislation.

IAB and the IAB Tech Lab are asking publishers, technology intermediaries, ad agencies, brands, data companies, and all other participants in the digital advertising supply chain to provide input on the draft framework by November 5, 2019, after which the trade bodies intend to release a final version for companies to adopt before the California law takes effect on January 1, 2020.

The CCPA Compliance Framework was developed by the IAB Privacy and Compliance Unit, which over four months brought together more than 350 legal, public policy, and technical experts from publishers, agencies, brands, platforms, advertising technology companies, and law firms to craft a compliance mechanism that will advance consumers’ privacy rights under the new California law, while enabling the tens of thousands of web publishers and intermediaries that comprise the open internet to continue to provide free advertising-supported content and services in the state.

CCPA was passed in June 2018 without public hearings. Its aim is to provide California consumers with greater transparency and control over how their personal information is collected, used, and sold. Earlier this month, California Attorney General Xavier Becerra released draft regulations to enable the legislation. Because of the law’s complexity and lack of clarity, IAB member companies and other stakeholders asked the trade bureau and the Tech Lab to collaborate on a standardized solution that would help them comply with the law’s provisions, even as those specifications continue to be revised.

Because California is the largest state, its regulations are often seen as a surrogate for Federal regulation, and as a model for other states to follow.

The proposed IAB CCPA Compliance Framework establishes a process for publishers and their partners to comply with new regulations regarding the sale of consumer data to technology companies. It focuses on:

1. How publishers communicate information about California residents’ rights, including the ability to opt-out of the “sale” of their personal information
2. How to communicate to partners across the open internet supply chain that a California resident has opted out of the sale of his or her personal information
3. How partner companies must operate after a consumer has opted out of the sale of their personal information

The IAB CCPA Compliance Framework consists of two components: a master contract that binds supply chain partners to specific behaviors that meet the law’s provisions; and a set of technical specifications that guide companies on how to implement the contract mechanically in their operations. The “Industry Limited Service Provider Contract” defines what a publisher and its partners must do when a consumer clicks “Do Not Sell My Personal Information” on a website or app. The use of this new contract will enhance consumer protection by reducing hundreds of separate contracts to only one that imposes meaningful guardrails concerning the use of data. IAB will provide the legal agreement to companies across the advertising landscape later this quarter.

“The IAB CCPA Compliance Framework is designed to help publishers protect consumers’ privacy, while fueling the free internet,” said Michael Hahn, Senior Vice President and General Counsel, IAB and IAB Tech Lab, who led the IAB Privacy and Compliance Unit working groups that designed the framework. “Hundreds of thousands of companies support their businesses with advertising on the internet, because it enables them to effectively reach new and existing customers at scale. Publishers bear the brunt of responsibility for compliance because of their direct relationship with consumers.”

“IAB has been a strong advocate for increasing consumer trust and transparency, and this framework is another example of that commitment,” said Dave Grimaldi, Executive Vice President, Public Policy, IAB. “What IAB is creating will help companies, both large and small, comply with the CCPA legislation in a manner that allows them to continue to innovate and offer the products and services that consumers love.”

“CCPA will become a reality in the new year and this framework will deliver a real solution for the industry and for consumers,” said Dennis Buchheim, Executive Vice President and General Manager, IAB Tech Lab, which has been designing the technical specifications for implementing the framework in companies’ operations. “Tech Lab is at the center of developing standards and technologies that improve the digital marketing supply chain and promote the responsible use of data. The partnership with IAB on the CCPA solution has been similar to our work with IAB Europe and respective member companies on the Transparency and Consent Framework for GDPR, and we’re committed to evolving privacy solutions in the U.S. and globally.”

This framework provides an initial solution for publishers and other parties to comply with CCPA in a timely manner, given the January 1st deadline. CCPA regulations are still being finalized by the California Attorney General. As rules evolve, IAB and IAB Tech Lab will work with stakeholders across the industry to adjust the framework and continue to iterate the approach as needed to meet any revised requirements, ensuring that there are comprehensive solutions for CCPA and other forthcoming privacy laws. Once the final version 1.0 of the IAB CCPA Compliance Framework for Publishers and Technology Companies is released, the trade groups will provide educational support to encourage rapid marketplace adoption.

IAB and the IAB Tech Lab have been developing industry standards and best practices since the organizations’ founding in 1996. Among the industry standards now embedded in the operations of the open internet ecosystem are the VAST standards for digital video advertising distribution, the ads.txt standard helping internet publishers and advertisers identify and eliminate fraudulent inventory, the IAB Europe GDPR Transparency and Consent Framework, the OpenRTB protocols for managing programmatic advertising transactions, and more solutions to enable brand safety, consumer privacy, and transparency.

To review the proposed framework and provide feedback, please go to iab.com/CCPA. The final framework will be released next month to prepare the ecosystem before CCPA goes into effect.

About IAB
The Interactive Advertising Bureau (IAB) empowers the media and marketing industries to thrive in the digital economy. Its membership is comprised of more than 650 leading media companies, brands, and the technology firms responsible for selling, delivering, and optimizing digital ad marketing campaigns. The trade group fields critical research on interactive advertising, while also educating brands, agencies, and the wider business community on the importance of digital marketing. In affiliation with the IAB Tech Lab, IAB develops technical standards and solutions. IAB is committed to professional development and elevating the knowledge, skills, expertise, and diversity of the workforce across the industry. Through the work of its public policy office in Washington, D.C., the trade association advocates for its members and promotes the value of the interactive advertising industry to legislators and policymakers. Founded in 1996, IAB is headquartered in New York City.

About IAB Technology Laboratory
Established in 2014, the IAB Technology Laboratory (Tech Lab) is a non-profit consortium that engages a member community globally to develop foundational technology and standards that enable growth and trust in the digital media ecosystem. Comprised of digital publishers, ad technology firms, agencies, marketers, and other member companies, IAB Tech Lab focuses on solutions for brand safety and ad fraud; identity, data, and consumer privacy; ad experiences and measurement; and programmatic effectiveness. Its work includes the OpenRTB real-time bidding protocol, ads.txt anti-fraud specification, Open Measurement SDK for viewability and verification, VAST video specification, and DigiTrust identity service. Board members/companies are listed at https://iabtechlab.com/about-the-iab-tech-lab/tech-lab-leadership/. For more information, please visit https://iabtechlab.com.

IAB & IAB Tech Lab Media Contact
Laura Goldberg
347.683.1859
laura.goldberg@iab.com

The post IAB & IAB Tech Lab Release CCPA Compliance Framework for Public Comment appeared first on IAB.

Register here to view the webinar

IAB CCPA hub

The post Get Ready for Data Privacy Regulation: The Impact on Direct-to-Consumer Brands appeared first on IAB.

BRUSSELS, BELGIUM & NEW YORK, NY (May 2, 2018) —On the heels of releasing the final technical specifications for the Transparency and Consent Framework last week to address user choice and other aspects of compliance with the notice, transparency, and choice requirements set forth in the GDPR (European General Data Protection Regulation), IAB Tech Lab and IAB Europe are introducing an additional supporting tech spec—pubvendors.json (a publisher’s list of vendors)—and the much awaited mobile in-app support for the Framework is also being released for public comment. Both tech specs build upon initial adoption of the Framework, with over 120 vendors registered on the Global Vendor List.

The pubvendors.json tech spec is intended to:

• Provide a standard for publishers to publicly declare the vendors that they work with, and their respective data rights/configuration
• Allow vendors to verify publishers’ GDPR settings and verify/audit Consent Management Provider (CMP) consent strings
• Establish a standard way for publishers to white-list vendors
• Enable publishers to limit purposes and features (consistent with the Framework) on a per-vendor basis

Mobile in-app enables app developers to access and honor the Framework’s consent and legitimate interest mechanisms as a supporting standard to assist with GDPR compliance. CMP API endpoints and app developer local storage are specified, which enables the mechanism of collecting and propagating consent, so third-party vendors can operate in respect of users’ and publishers’ choices. App developers continue to have flexibility in defining user experience for exposing purposes and controls, as per the Framework.

“The feedback from publishers since we launched the public consultation on the first version of the specs for the Transparency and Consent Framework included a couple of strong messages,” noted Townsend Feehan, CEO, IAB Europe.  “First, publishers wanted even more control with respect to data processing purposes, notably to be able to authorise different partners to leverage different purposes.  Second, they wanted more control over which legal bases their partners could adduce.  The pubvendors.json solution is a rapid response to accommodate these requirements.”

“These additional tech specs are a direct reflection of our commitment to the flexibility and adaptability of the Transparency and Consent Framework, to ensure that it meets the needs of publishers and other parties in the supply chain,” said Dennis Buchheim, Senior Vice President and General Manager, IAB Tech Lab. “The continued dominance of apps in mobile environments made supporting tech specs on that front particularly vital, and we’re pleased that our working group moved quickly to close that gap.”

After public comment concludes on June 1, 2018, IAB Tech Lab and IAB Europe participants will evaluate and incorporate feedback received and release a final version of each of these specifications. Companies with urgent transparency goals are invited to adopt the pubvendors.json technology as a beta implementation, even before the specifications are finalized.

To review the proposed pubvendors.json technology specification and the mobile in-app specification, please visit http://www.iabtechlab.com/gdpr. Technical feedback can be sent to transparencyframework@iabtechlab.com and general feedback can be sent to feedback@advertisingconsent.eu.

About IAB Technology Laboratory
The IAB Technology Laboratory (“Tech Lab”) is a non-profit research and development consortium that produces and provides standards, software, and services to drive growth of an effective and sustainable global digital media ecosystem. Comprised of digital publishers and ad technology firms, as well as marketers, agencies, and other companies with interests in the interactive marketing arena, IAB Tech Lab aims to enable brand and media growth via a transparent, safe, effective supply chain, simpler and more consistent measurement, and better advertising experiences for consumers, with a focus on mobile and “TV”/digital video channel enablement. The IAB Tech Lab portfolio includes the DigiTrust real-time standardized identity service designed to improve the digital experience for consumers, publishers, advertisers, and third-party platforms. Board members include AppNexus, ExtremeReach, Google, GroupM, Hearst Digital Media, Integral Ad Science, Index Exchange, LinkedIn, MediaMath, Microsoft, Oracle’s Moat, Pandora, PubMatic, Quantcast, Telaria, The Trade Desk, and Yahoo! Japan. Established in 2014, the IAB Tech Lab is headquartered in New York City with an office in San Francisco and representation in Seattle and London.

About IAB Europe
IAB Europe is the leading European-level industry association for the digital advertising ecosystem. Its mission is to promote the development of this innovative sector and ensure its sustainability by shaping the regulatory environment, demonstrating the value digital advertising brings to Europe’s economy, to consumers and to the market, and developing and facilitating the uptake of harmonised business practices that take account of changing user expectations and enable digital brand advertising to scale in Europe.

IAB Media Contact
Laura Goldberg
347.683.1859
laura.goldberg@iab.com

IAB Europe Media Contact
Matthias Matthiesen
+32.4.96709294
matthiesen@iabeurope.eu

The post IAB Tech Lab & IAB Europe Release Pubvendors.json and Mobile App Specifications to Support Transparency & Consent Framework appeared first on IAB.