On September 17, 2019, numerous stakeholders in the digital advertising industry, including publishers, advertisers/brands, AdTech companies, and law firms (including numerous representatives from BakerHostetler) convened at the Interactive Advertising Bureau’s (IAB) headquarters in New York for a preview of its CCPA Industry Compliance Framework.

Throughout the course of 2019, IAB has solicited input from a broad swath of digital advertising industry stakeholders to develop the industry’s approach to addressing consumer Do Not Sell requests arising out of the multiparty, downstream sharing of consumer behavioral data to effectuate interest-based advertising. IAB’s efforts began by addressing what level of industry cooperation is required in ad buying transactions to cause compliance with the CCPA, and developing policy parameters around a technical solution to pass “signals” relating to the sale of personal information (or restrictions thereof).

The downstream sharing of this behavioral data involved in digital advertising is implicated by Section 1798.115(d) of the CCPA, which requires that a third party cannot onward sell (i.e., sell data that has been sold to it) unless the consumer has received explicit notice and is provided the opportunity to opt-out pursuant to Section 1798.120. In short, the IAB framework addresses the fact that various participants in the interest-based advertising ecosystem must onward sell personal information, but do not have the ability to obtain the explicit notice required by .115(b), which is only afforded to website and mobile application publishers (a website operator with advertising on its site or app).