The Digital Advertising Alliance has published guidance on the use of a tool for opt out requests under CCPA under its (voluntary) self-regulatory principles.
Takeaways:
- Both the entity that owns and operates the digital property and collects Personal Information directly from a consumer (publisher) and a third party that indirectly collects Personal Information through the publisher’s digital property (third party) are required to honor California “Do Not Sell” requests.
Third Parties:
- When a consumer exercises their California “Do Not Sell” rights through the CCPA Opt-Out Tool, third parties may use and transfer such Personal Information only for certain operations and system management purposes.
Publishers:
- Must display a California “Do Not Sell My Personal Information” link leading to a notice that describes the third party collection of personal information and links to the DAA CCPA Opt-out Tool.
- Must place a flag that can be read by third parties indicating the link(s) have been placed; and
- If a publisher collects Personal Information and transfers it to a third party, it must provide a “Do Not Sell” choice. and inform parties with whom is shared information in the past 90 days of such consumer choice.