Throughout this Webcast, they will discuss:
– Privacy Sandbox Fit Gap Analysis study results
– Areas where adjustments and improvements may be needed
– To what extent Privacy Sandbox prioritizes user privacy

Don’t miss this full-on virtual chat from ExchangeWire in association with IAB Tech Lab, keeping you up-to-date in these unprecedented times.

Agenda:
15 minute presentation by Shailley Singh, IAB Tech Lab
30 minute panel discussion

The post Navigating the Divide: Privacy Sandbox Fit-Gap Analysis and Industry Solutions appeared first on IAB.

With more than a dozen privacy laws in effect or coming into effect, each of which provides for an opt-out of “sales” and targeted advertising, digital advertising is increasingly becoming a regulated industry. This change in the law must be met with a change in business practices, including how we conduct diligence around privacy in digital ad transactions.

Liability is shifting

One of the fundamental changes in state privacy laws is the inclusion of accountability. There are new requirements around what partners can and cannot do with the personal information you provide them. Indeed, you must take “reasonable and appropriate steps” to make sure that your partner uses that personal information consistent with the law — for example, by including mandatory audit provisions in your contracts.

Perhaps the most significant change is the California Privacy Protection Agency’s (CPPA) regulation stating that whether you conduct diligence of your partners with whom you disclose personal information is a material factor in determining whether you will be liable for their wrongdoing.  In other words, due diligence and third-party risk management should now be integral aspects of your data privacy program.

Enforcement is getting tougher — and digital advertising will face new scrutiny

Not only is liability shifting, but enforcement is too. Upon the effective dates of the dozen-plus privacy laws, each vests enforcement in its attorney general’s office. In California, both the Attorney General’s Office and the CPPA each have enforcement powers.

Those enforcers have shown a clear intent to protect consumers under their privacy laws.  On January 26, the California Attorney General’s announced a sweep of streaming services under the CCPA.  The Connecticut Attorney General’s Office announced its enforcement priorities for the digital advertising industry at the IAB State Privacy Law Summit on November 15, including setting bright lines on the right to opt-out of the disclosure of personal information to vendors for measurement and frequency capping (where those vendors do not serve as your processors), as well as parameters on the categorizing information as deidentified.

Colorado’s Attorney General Phil Weiser has said “Enforcement of the Colorado Privacy Act is a critical tool to protect consumers’ data and privacy (…) If we become aware of organizations that are flouting the law or refusing to comply with it, we are prepared to act.”

Finally, the CPPA has a fully staffed enforcement division to investigate possible violations, and it’s hard to imagine digital advertising won’t be one of its key focus areas. Importantly, you can expect announced or unannounced audits to commence soon, particularly: for companies who’ve had any history of non-compliance with any privacy law; where there are potential violations of the law; or where the subject’s “collection or processing of personal information presents significant risk to consumer privacy or security”.  And there is no longer a mandatory 30-day “cure period” — no guaranteed second chances — under the CCPA.

Companies should not underprice state privacy risk because doing so could become a big — and very costly — mistake.

Industry diligence must improve

Historically, privacy diligence has relied on two things. First, you obtained a representation and warranty in the contract that the business partner would comply with applicable law and then indemnity if it failed to do so.  Second, you typically sent out a generic questionnaire.

This approach will no longer do.

For a fully digital industry, diligence is woefully analog and outdated. It’s underfunded, understaffed, and in an underdeveloped state. Companies send out and receive dozens of questionnaires monthly in connection with transactions and partnerships. These often ask the same questions in multiple different ways, which makes responding to them a rote exercise of managing answers in spreadsheets and cutting and pasting. Worse, these questionnaires are often generic and out of date, and the majority fail to address the actual uses of personal information contemplated by the business arrangement and the entirety of each state law. Sometimes, the surveys come back incomplete — if they come back at all.

The industry must solve for privacy diligence, and it can’t do so by doubling down on its current approach. Rather, what’s needed are standards around privacy diligence that can achieve effectiveness and efficiency so that all industry participants are speaking the same language. We need standardized privacy diligence questions that address both the letter of the law and the specific data flows and business use cases for every vendor and sub-vendor. We also need a more effective and efficient means of managing the diligence process.

It’s a digital problem that demands a digital solution.

Introducing the IAB Diligence Platform

To proactively meet the needs of regulators, the IAB convened a Privacy Implementation and Accountability Taskforce (PIAT), composed of publishers, advertisers, agencies and ad tech companies.  The group highlighted the need for an effective and efficient solution: the IAB Diligence Platform.

The Platform provides a privacy diligence solution that is purpose-built for the digital advertising industry. This solution will combine new industry vertical business questions with US state law assessments in one collaborative platform to make the diligence workflow effective and efficient for both sides of the partnership.

Leading industry privacy lawyers and law firms are collaborating in the PIAT initiative to draft the right business and privacy questions of each digital advertising use case and vendor type. We know that the right questions that a publisher should ask an SSP aren’t the right questions for an advertiser or its agency to ask a DSP.  These questions will be complemented by questions specifically tailored to assess compliance with each state privacy law.

The IAB Diligence Platform will be built on the SafeGuard Privacy Platform, which features robust state law assessments and a vendor compliance hub.  Users will be able to complete the diligence questionnaire once and share it with the partners on the platform as they engage in digital ad transactions.  By moving the industry towards use of the Platform, there will be a strong network effect to drive efficiency and improve deal speed.  In fact, IAB members that are already on the SafeGuard Privacy platform are seeing 80%+ efficiency gains by managing multiple laws concurrently and automating vendor compliance. They have a single source of truth for members to handle their diligence efficiently, and they’re saving dozens of FTE hours a month.

The solution provides:

• Standardized privacy questions that will be leveraged by the industry.
• Ability to fill out assessments and questionnaires once and easily share with partners many times.
• Ability to update compliance as new laws come online or existing laws and regulations evolve.

It’s better for vendors. Automated sharing means significant time and labor savings for vendors — they answer the right set of questions once and share everywhere. Deals close faster when there are no overlapping, inappropriate, out of date, and repetitive questions to wrestle with.

It’s better for accountability. It’s auditable, fully accountable, and provides a clear record of compliance: companies that are audited can show the actions they’ve taken to ensure that control and privacy of company data was assured. The combination of SafeGuard Privacy assessments and IAB PIAT (Privacy Implementation & Accountability Task Force) questionnaires delivers what the heightened regulatory landscape calls for.

Of inertia, lack of budgets, and finger-pointing

The first challenge is for the industry to overcome inertia. We must recognize that we are now becoming a regulated industry, and expect that regulators will do their job diligently. What worked in the past will not work in the future.

Despite this, few budgets have a line item for a diligence platform. This must change.

Company leaders must not allow this to devolve into finger-pointing about which budget this should come from — especially since nobody’s going to point at their own budget first.

This needs to be a priority driven by top management, with real effort to find the resources and get a real solution in place. The good news is, the cost is lower than it might appear — and certainly lower than the financial and reputational cost of an enforcement action arising from your partner failing to properly process personal information you provided to it.

Additionally, the costs of the industry’s current approach are high, but largely hidden. Every hour that employees spend sending out questionnaires, working with vendors to fill in the inevitable gaps, and chasing down vendors who are too overwhelmed to reply has a hard-dollar cost. This is to say nothing of the opportunity cost of executives stepping in to push through contracts that have been held up in the process.

What to do now

We encourage everyone to understand the new legal landscape, and prepare for smarter diligence. If you’re not already a member of IAB PIAT (Privacy Implementation & Accountability Task Force), you can email michael.hahn@iab.com. You can also contact SafeGuard Privacy here to see a demo of the IAB Diligence Platform.

The new regulations are real, and we expect them to be enforced. The most important thing to do is to start today to prepare for new state privacy law diligence requirements.

The post Working Harder Won’t Solve Privacy Diligence. It’s Time to Work Smarter. appeared first on IAB.

The post The Accountability Platform Explained appeared first on IAB.

This event provides a unique opportunity to dive deep into the technologies and solutions being developed for addressability, privacy and data security. Attendees will gain valuable insights into the practical application, benefits, and limitations of privacy enhancing technologies. Additionally, discussions will cover how to use Tech Lab’s compliance and audit frameworks to comply with government regulations, plus so much more. Join us to stay ahead of the curve in understanding and adapting to the dynamic changes hitting the ad tech ecosystem.

This event series is in-person only.

We are currently accepting speaker and sponsor applications for this event, if you’d like to be involved, please reach out to: techlab@iabtechlab.com

*Agenda times are not final and subject to change.

Agenda

• As The Cookie Crumbles
• Privacy on the Horizon: Insights into Regulation and Enforcement
• The Power of Erasure: Handling Data Deletion Requests in Ad Tech
• Accountability Platform
• The Power of a Privacy Taxonomy
• Privacy Sandbox on Android (SDK Runtime)
• Privacy Sandbox – Protected Audience Auction Dynamics
• Addressability Stack in the New World
• Implementing the Global Privacy Platform: Practical Guidelines
• Privacy Sandbox Gap Analysis
• Identity Solution Interoperability for Effective Audience Management
• Privacy & Ad Fraud – Trust tokens/Privacy Pass Capabilities and Limitations
• ID Less Solutions Guidance
• Using Data Clean Rooms for Measurement

The post IAB Tech Lab, Privacy & Addressability, “As The Cookie Crumbles” appeared first on IAB.

The post 01/10 OpenRTB 2.x 2023 Release Review Webinar appeared first on IAB.

The post IAB Tech Lab Brand & Agency Event, “Ad Tech Foundations And Critical Standards For Buyers” appeared first on IAB.

Consumers and legislators have made two things abundantly clear.

First, getting privacy right is a fundamental obligation of all companies participating in the digital advertising industry.

And second, progress cannot wait.

The time to set down the standards and best practices for privacy implementation and accountability is now, but it’s easier said than done.

Implementation issues abound, both for consumer-facing and business-facing obligations.

Everyone agrees that consumers should be informed about how their data is used for advertising and how to make choices about those uses in a way that minimizes friction. But there’s no consensus about how to do it well. The result? The consumer’s privacy experience is fragmented with too many different approaches, leading to consumer confusion and frustration with ad-supported media.

As another example, businesses seeking to responsibly process consumer data and honor consumer privacy rights must conduct data discovery within their organizations. However, the many different data mapping tools available in the market today are not one size fits all and often do not neatly account for the kinds of data processed for digital advertising. The digital advertising industry would benefit from greater consensus about what level of automated and non-automated data discovery should be performed across multiple structured and complex unstructured data containers.

At the same time, the digital advertising industry faces a critical accountability inflection point. Too often, our industry has relied solely on contract language, whether representation and warranties or indemnification provisions, to manage partner behavior. But new state privacy laws require more forceful action. For example, these new laws create accountability requirements between businesses and their service providers, and the CCPA now imposes material legal risk on a company for the wrongdoing of its partners (regardless of whether those partners are service providers) unless the company conducts sufficient due diligence.

To address these challenges and continue raising the bar for privacy, ​​PIAT will bring together leading privacy technology vendors, media companies, advertisers, and the supporting ad tech ecosystem to create the shared understanding, best practices, and standards the industry needs to move forward. However, we cannot move forward on everything at once. We need to set priorities.

Putting accountability first

A survey of PIAT working group participants provided clear direction that the creation of standards around accountability needs to be our first priority.

Every new privacy law in the US includes language about accountability, and regulators have been very clear that they expect real action. All parties subject to the state-level privacy laws must be able to demonstrate their privacy compliance to enforcers and to each other. That means every service provider or processor must make a contractual commitment to demonstrate its privacy compliance to the business or controller. There are rules for subcontractors and third parties, too, including due diligence of third parties when there is a “sale” of personal information for cross-context behavioral advertising.

Our first effort will be The Diligence Project. Today, vendor due diligence is most often done by way of lengthy questionnaires that are not tailored to digital advertising data flows and that take a disproportionately large amount of time and effort to complete — all while providing only questionable value or insight into relevant privacy practices. Clearly, we must move beyond such basic efforts.

The Diligence Project will seek to define a set of standards or best practices around what steps publishers and advertisers can reasonably undertake today, based on a review of all the currently available technologies, to ensure that their partners are acting in compliance with state privacy laws and contractual obligations. We’ll examine all of the accountability and diligence requirements that apply and provide a roadmap about how they can be implemented in the digital advertising industry using privacy technology tools that are available today.

We’ll also begin our Privacy Taxonomy Project. Underlying this project is a necessity to move from first generation to second generation technology in vetting partner privacy compliance.  Marketing, media and other consumer-facing organizations must have a more refined tool set than exists today to demonstrate to regulators that their service providers are complying with the limitations imposed under state privacy laws; vendors are complying with “do not sell” requests; and vendors are meeting the contracting and subcontracting requirements that relate to “sales” under CCPA.

But the next generation of privacy tools can’t solve these problems if industry participants lack a shared language to define them.

The industry needs a common data taxonomy for publishers and advertisers to be able to organize their data and communicate with partners around its use limitations, as well as receive data validating its use.

For example, today every SSP (supply side platform) works with multiple demand side platforms (DSPs). But since everyone’s data is organized differently, to make real accountability work you’d need a mapping table for each and every vendor and then another for their client specific customizations. Hence the need for the Privacy Taxonomy Project. We first need common language around how we organize personal information before we can push the privacy vendor marketplace to build a new suite of tools that will need to be interoperable across the industry.

Bringing legal, product and technology together is critical to success.

The privacy challenges facing the digital advertising industry require collaboration between legal and technology stakeholders. The IAB Legal Affairs Council has deep experience with state level legal compliance — in particular, through its Multi-State Privacy Agreement. The IAB Tech Lab has deep experience setting technical standards that undergird the industry, including with respect to privacy. By working together across functions, we’re confident we can turn privacy challenges into privacy solutions.

Moving forward together

Getting accountability right is a fundamental part of our compliance obligations and foundational to maintaining trust with consumers. We’re committed to getting this right.

But we won’t stop there. Over time, working together, we’ll solve the thorniest privacy challenges that are embedded in industry technology, including driving consensus on privacy implementation, improving guidance or best practices involved in data discovery and mapping, developing a low-friction user interface, and more.

We’re committed to getting this right and started now.

So far, our joint effort comprises more than 100 people from across the entire digital ecosystem. We’d like to see even more people participate from legal, product, and engineering. If you’re interested in shaping the future, we hope you’ll read more and join us by sending an email to techlab@iabtechlab.com.

The post Why the IAB Tech Lab and IAB Legal Affairs Council Are Coming Together for the Privacy Implementation & Accountability Task Force (PIAT) appeared first on IAB.

The post IAB Tech Lab: Compliance Automation (Free Member Webinar) appeared first on IAB.

The digital advertising landscape is undergoing a fast evolution with deprecation of traditional identifiers, privacy regulations enforcement, need for privacy enhancing technologies (PETs) and fast emerging growth of new advertising channels like CTV and Retail Media Ad Networks.

Join us for an afternoon of in depth exploration and discussion of what these changes mean for advertising operations. In this workshop style discussion, ad ops experts from both sell side and buy side will outline the challenges and debate solutions and alternatives for success in ad operations. Some of the topics, we plan to investigate at this event are:

• Retail Media Networks activation and reporting
• Post Cookie Campaign trafficking management
• Managing CTV campaigns for privacy, viewability and IVT
• Privacy regulations compliance management

The focus will be on how Ad Ops can proactively plan for and lead the industry evolution.

The post IAB Tech Lab: Adops? How To Thrive In A Changing Digital Advertising Landscape (Free Member Meeting) appeared first on IAB.

We’ll cover releases across all of our strategic pillars including privacy, addressability & privacy enhancing technologies, advanced tv and supply chain foundations.

This event will take place at the IAB Tech Lab office in New York City. Virtual option is available.

The post IAB Tech Lab Council Meeting (Free Member Meeting) appeared first on IAB.