Interest Based Advertising Under New Privacy Regimes: California, Colorado, and Virginia

Many companies in the United States conduct interest-based advertising, which may meet the definitions of targeted advertising or consumer profiling (as provided below)- those that do face a decision this year as to whether they want to continue to engage in such activities (in which case they need to do several things to comply with state privacy laws), or to change how they do business. A brief discussion of various state privacy regimes associated with targeting advertising follows:

 

 

California Privacy Rights Act (“CPRA”) is the successor to the California Consumer Privacy Act (“CCPA”) and takes effect January 1, 2023 with a lookback period going back to 2022 meaning businesses must track their collection, use, and disclosure of personal information up to 12 months before the law’s 2023 effective date. CPRA expands the scope of CCPA by adding limitations to the "sharing" of personal information in addition to the "selling" of personal information. 

 

Under CPRA, “Sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged. 

 

CPRA defines “cross-context behavioral advertising” as the “targeting of advertising to a consumer based on the consumer’s personal information obtained from the consumer’s activity across businesses, distinctly-branded websites, applications, or services, other than the business, distinctly-branded website, application, or service with which the consumer intentionally interacts.”

 

If a business sells or shares personal information or collects or uses sensitive personal information, CPRA requires a separate link to the “Do Not Sell or Share My Personal Information” internet web page and a separate link to the “Limit the Use of My Sensitive Personal Information” internet web page, if applicable, or a single link to both choices, or a statement that the business responds to and abides by opt-out preference signals sent by a platform, technology, or mechanism.

 

 

The Colorado Privacy Act (“CPA”) takes effect July 2023.

 

Under VCDPA, If a controller sells personal data or processes it for targeted advertising or consumer profiling, it must provide consumers with the right to opt-out. 

 

Targeted advertising does not include (1) ads in response to consumer’s request for info or feedback, (2) ads based on activities on the controller's affiliated websites; (3) ads based on the context of a consumer's search query or visit to a website or app; and (4) the processing of personal data solely for measuring or reporting ad performance, frequency, or reach. 

 

Profiling means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

 

 

The Virginia Consumer Data Protection Act (“VCDPA”) takes effect January 1, 2023.

 

Under VCDPA, If a controller sells personal data or processes it for targeted advertising or consumer profiling, it must provide consumers with the right to opt-out. 

 

Targeted advertising does not include (1) ads in response to consumer’s request for info or feedback, (2) ads based on activities on the controller's affiliated websites; (3) ads based on the context of a consumer's search query or visit to a website or app; and (4) the processing of personal data solely for measuring or reporting ad performance, frequency, or reach. 

 

Profiling means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.