Today in Digital Marketing - 188: SPECIAL: How the CCPA Affects Your Brand

Episode Date: July 7, 2020

A special edition today: Everything you need to know about the California Consumer Privacy Act. Simon Poulton (@SPoulton) from WPromote joins Tod for an in-depth discussion about this legislation and how it affects your brand. Today in Digital Marketing is produced by engageQ.com. Can we help you with YOUR brand’s digital marketing and social media? Email [e-mail] or visit engageQ.com/contact Help Spread the Word! • Rate/Review Us: ratethispodcast.com/today • Click bit.ly/tweet-tidm to preview a tweet you can publish Advertising: Reach 1,000 Digital Marketers Learn more at todayindigital.com/ads TOD’S SOCIAL MEDIA: • Tod’s web site: TodMaffin.com • Tod’s agency: engageQ.com • LinkedIn: linkedin.com/in/todmaffin • Twitter: twitter.com/todmaffin • Instagram: instagram.com/todmaffin • Facebook: facebook.com/tmaffin • TikTok: tiktok.com/@todmaffin • Twitch: twitch.tv/todmaffin • Xbox Gamertag: Radio#9573 --- Send in a voice message: https://anchor.fm/todayindigital/messageOur Sponsors:* Check out Kinsta: https://kinsta.comPrivacy & Opt-Out: https://redcircle.com/privacy

It's been called everything from a blip on digital marketers' radars to an apocalypse bigger than the loss of third-party cookies. The truth is, of course, somewhere in between, and we are taking a deep dive into the California Consumer Privacy Act today, Tuesday, July 7th. It's Today in Digital Marketing. I'm Todd Maffin. You don't need to be in California to be affected by the CCPA. If you do any marketing to people who live in California,

then your brand is affected by this legislation. And just days ago, the litigation window opened, meaning if you're not in compliance, your company could be sued. It's a big deal, and that is why I'm devoting today's entire episode to it. And to help me unpack it is Simon Poulton. He's vice president at digital agency W Promote. And Simon, I guess, I mean, I guess we need to start at the basics. What is the CCPA? The CCPA legislation in general is the California Consumer Privacy Act. So we've known about this for quite some time. Many platforms

have taken action. Essentially, what it provides is consumers the ability to opt out of tracking. So I think that's the big difference there between this and GDPR. GDPR is obviously an opt-in tracking, which no one's doing, and this is an opt-out of tracking. And this has apparently been around since January. Why are we hearing that July 1st and August 1st are really important days tied to some sort of horrible legal deadline? Yeah, yeah. So we have known about it for quite some time. And like I just mentioned, other platforms have taken action. So I think Google even was taking action back in October. But right now we're actually approaching the Sorry, we've just passed the litigation deadline. So that was July 1st. That's when companies can actually start entering into litigation around any kind of CCPA violation

that they see. So what Facebook's ultimately done is they've taken a pretty heavy-handed approach here to say, we're going to make everyone compliant on July 1st. And they basically rolled it out on the same day. The reason why August 1st is such an important date is because Facebook has this window from July 1st to August 1st, where they are automatically enforcing limited data use for all accounts. That means if you're marketing to anyone in the state of California, then limited data use is being applied.

You have to actively take a step to opt out of that to retain your standard tracking. But if you don't do that by August 1st, Facebook will do it for you. So basically, this is a big risk shift that goes from Facebook to brands and to advertisers to make sure that they do take action by August 1st. What is the litigation danger there? Is it that the state of California will sue companies that are not in compliance? Yeah, essentially, there are a number of ways that you can be in violation. But essentially, it is the state of California taking this. There can be individuals that are taking it to certain companies. Honestly, there's a lot that is unknown here.

I think we're actually getting a front row seat right now to what does CCPA enforcement and litigation look like? Who can sue who? And honestly, it'll be very interesting. I think there's a lot of legal scholars out there who have a lot of very differing opinions on this. And certainly, those are the folks that I'm following very closely on Twitter to get a pulse on what they're thinking. And to be clear, this doesn't affect companies that are only in California. That's not the way the legislation is. It's for companies that are doing any marketing to California residents.

Is that right? That is correct. And California resident is such an interesting term as well. One of the examples I like to think about is, well, at least before COVID, I was traveling to New York pretty frequently. What if I go to New York and I go to a website and then I come back here to California where I live?

That is a very strange scenario. That's a scenario where at one point in time, I'm in a non-compliant area. And then the next day, I'm in a compliant area. So what Facebook is actually able to do is they have two ways that you can detect the user's location. One is allowing Facebook to automatically detect it. And that is done by Facebook having a lot of data on individuals. They know where you reside. They know where you reside, they know where you work. That's how they're determining residency. But you can actually

override that. So brands can go in and state, well, the user's address on their profile states they live in New York. So we're going to treat them as a New York resident, not a California resident. So certainly it's a bit dicey for these individuals that spend a lot of time out of state, a lot of time in state, or even anyone who's coming to California for, say, a one-month holiday. Are you a resident? Maybe, possibly not, though. So I think it's more out of an abundance of caution that they're looking to have this as broad as possible, at least with their initial rollout. So Facebook is applying from July 1st until August 1st, even though the litigation deadline could be possible as of July 1st. But they're in this

window where they've essentially turned off all major reporting. So you can't really get any data on California. So if you're doing like a state by state breakdown in your Facebook ad manager, a lot of those metrics are just missing. So what do you have to do if you are a brand and you market to California people and you want to get those metrics back? Well, yeah. So I would just clarify on one point there that the way that it is being looked at currently is through the lens of remarketing lists are certainly impacted. Any kind of feedback loop is impacted. We do still see some data coming through for the state of California.

So this is based purely on, predominantly on prospecting, any kind of lookalike audiences that are being created. Those are still functional from everything that we can see. It really comes back to the feedback loop. So there are a lot of,

there's both a lot of data that's missing and there's also a lot of performance challenges associated with this. When we think about return on ad spend, a lot of that often, when you look at these holistic numbers, is heavily driven by remarketing the second, the third touch points. The first touch point, very seldom is that really powerful. We're seeing a 10 row ads on a first touchpoint for the prospecting campaign. That just doesn't really happen. So that's why we are seeing such a tank in the metrics that are being reported here. So what brands can do, and what I actively advise right now is, I'm not a lawyer. And I know this is something we'll always make note of, but I'm not a lawyer. So definitely consult with your specific legal team about what qualifications you need to meet

for compliance. And from there, start thinking about what qualifications you need to meet for compliance. And from there, start thinking about, have you met these requirements? So one of the big ones is, again, the ability for a user to opt out of tracking. There are a lot of platforms that do this. OneTrust, CookieBop, there's a few others. Ensuring that you have one of those on your website, that's really important. If a user can actively take that step on site, then they can block cookies. That means they can block the Facebook pixel. That's really quite key. If they want to go back immediately to the previous data processing rules,

they actually can do this, but they need to ensure that they are compliant. So when Facebook says, hey, on August 1st, we're releasing this, they're basically giving us that one-month window to sort this out. But if your company says, well, yeah, we've already got it sorted out. We have a way that people can opt out of tracking very easily on site. This is all very straightforward. We believe that we can return to standard data processing for the majority of users. And I think that this kind of goes back to the thing I was saying in the beginning. The idea here is that CCPA is an opt-out-based law, right? This is GDPR being the opt-in.

We should have the ability to maintain at least probably 90% of these audiences. When we talk about opt-out rates, they're usually quite low. When you talk opt-in rates, maybe 1% to 2% of people opt-in. So it's a very different scenario there. Although I have to imagine that over the horizon,

and we know that this is probably coming on the ballot this year in November, we will be seeing an even more restrictive version of CCPA coming through, which I think is, well, it's going to be a very interesting little tidal wave I think we have in both an election year as well as a year when a lot more people go to the polls and they will be voting on a lot of these things tied to privacy. You mentioned the steps that you can take, a brand manager can take on their website, similar to kind of the GDPR cookie browser

that we've sort of all become used to now. I had also read those somewhere, and this was Facebook messaging it, saying something to the effect of, you can also change the code of the Facebook pixel and become compliant. What's that about? There's one parameter that you can include,

which is the data processing options parameter. And you can just go to the Facebook developer documentation site and you'll find this. Essentially, what that enables you to do is to define if you'd like to enable LDU, to enable limited data use. If so, then you use two digits. One of

those digits will define the user geography and then the country. The second will define the user state. so in that scenario when we when we have uh one comma one thousand it would be somebody in california uh of course so if you prefer for facebook to uh detect somebody for you uh then you can actively take that step and just say okay facebook you you determine who this is and if it is then we'll cut them out the, though, is that applying that on a page view pixel means that every single person that comes to the website is now impacted. So you need to have a strategy here that accounts for

the bulk of users have not opted out, but some users will. So if a user opts out, you need to ensure that you can track it just for them. You can make sure that you include that just for them. But anyone else, I would actively advise to not include it. Obviously, speak with your legal counsel, but I would advise to not have it at a page view level, or you'll just persistently lose all this data. And we are hearing early anecdotal reports of a number of advertisers seeing just really poor results coming out of California. And we usually think 4th of July weekend, that's going to be a big weekend for sales usually.

And it certainly still was. It's just how much data are we getting back? How much intelligence are we getting here? That is, I think, what's really key to this is just making sure that you aren't taking too much of a heavy-handed approach, kind of like Facebook did when they rolled it out. But making sure you know what is your point of compliance. So like I was saying, that really comes back to this idea of if a user opts out, then this slightly different page of pixel should fire and at that point in time, that will persist. I do think one of the challenges here though,

and it's this weird cross-section of privacy. There's the privacy technology and there's privacy legislation. When we think about things like ITP, for example, that creates a few roadblocks here. So if I opt out of tracking right now, but then I maybe come back a week from now after my cookie is gone, can you still tell that it's me? Can you still persist that identity to the point where I've opted out? It's a very strange scenario to be in because I really need as much information as possible on you to know that you don't want to be tracked. So it sort of is a self-fulfilling prophecy of,

if you want to opt out and you want to be very private, I need all of your information in order to do that. Very similar to what we saw with GDPR. Simon, is this the end of digital marketers being able to reach people in California? Is this the apocalypse? I don't think it's the apocalypse. I think that what we typically see is a back and forth.

Certainly, we're seeing a larger swing towards privacy. But I think a lot of this still needs to be determined, how brands are going to look at future compliance. There's a lot of thought around the saying, hey, login states, getting users emails, persisting identity in that way. There's a lot of value in going down that path. What I think is actually more detrimental is at a much broader level. And that's what we're seeing from Apple with IDFA restrictions. It's what we're seeing with ITP, ETP, what we're seeing with cookie changes. So I don't think it'll be just California. But certainly, I think the tid of the tidal wave that we see building is very real and is going to spread out. There'll be ways that we react, but I certainly don't think we'll

see the sort of the golden days of Facebook returns that we once did. You live in California. As of July the 1st, Facebook pushed us all into this data use just to kind of get us ready. So that impacted the news feed, I would presume. Have you personally, as a California resident, since this happened on July 1st, have you noticed a difference in your news feed from Facebook? Partially, but what I will also say is that given the nature of my job, I'm constantly testing different kinds of pixels, constantly testing different kinds of pixels, constantly testing different kinds of websites. So my feed is a little bit of a mess anyway. I'll have 100 purchase events

firing me for one website and they'll think, he's the best customer of all time. So it's a little bit complicated for me. Certainly though, my wife, I'm going to be studying very closely the ads that she's receiving and really just getting a hold on what does remarketing look like and actively trying that out. I think that's a really important thing that we in California should be trying is how persistent is this? You can go into your Facebook privacy settings and better understand where the data is coming from and have a core understanding of, okay, this is a website pixel because some brands may have already overridden that protection. So that's where it's going to be a bit of a mixed bag of results.

Some brands are going to immediately just swing back and go, nope, we think we're compliant. Let's turn it off. And that might be a very smart statement to be in. But other brands, and I'd say the brands with more complex challenges, they're going to take longer to get there. So when we think about complexity here, it's not just the pixel. It's server-to-server tracking.

It's the way that we handle custom audience uploads into the platform. Facebook's now saying you need to add three additional columns to a custom audience upload to determine if somebody should be included within a limited data use pool. So I say for the average advertiser, this is very confusing. And for the average Californian, they're going to start seeing some strange things in their feed for sure. And this is just one state. So like if Georgia decides to do this or the Canadian province of Quebec, which has always had kind of its own set of rules for everything anyway, do we have to do this all over again for every damn state and province and region and municipality that decides to put in legislation like this? You know, I would love to say that we wouldn't have to,

but of course we will, right? Like I think that there needs to be some kind of uniform approach, ideally in the United States at a federal level, where they don't just let every single state go rogue. I think the burden of compliance when you've got 50 different state regulations is gonna be too much for brands.

And even if they have the best intentions of compliance, you just can't keep up with that. And I think honestly, there needs to be too much for brands. And even if they have the best intentions of compliance, you just can't keep up with that. And I think, honestly, there needs to be consistency around how this works. And I do hope that when California makes this move, that the country follows somewhat of its lead. We have actually seen a few other states pop up with their own privacy regulations

and around the do not track me, do not sell my data. I think Utah has one now. Certainly, Massachusetts is working on one. It's likely that we'll see a little bit more proliferation of this before we see any consolidation. But I'm hopeful that before we go too far down that path, that we will see some degree of at least federal consolidation of these types of practices. So just to recap, and please check me to make sure that I have this accurate as kind of the closing wrap up here. So this law is in effect right now. It only applies to you if you are marketing to California residents.

It's not based on whether your brand or business is in California. You can avoid all this by simply not marketing to California residents if you want. Or you can apply this limited data use that Facebook has politely turned on during this month for us, but warning at the end of this month, they're turning that off. So you better have your legal ducks in a row. Did I get all that right? Yeah, absolutely. I think right now is the time to have that conversation with your team internally, with your legal team, and just make sure you are very clear on are we compliant or are we not?

Once August 1st hits, there's no going back. And we need to ensure that we're compliant if we're going to continue advertising to folks in California. Simon, tell me about WPromote, your agency. Yeah, absolutely. So WPromote, we're actually headquartered here in Los Angeles, California. We've got a number of offices across the country. We are a performance marketing agency. We actually took the top spot in the recent Forrester performance marketing wave, which we were very pleased to see and we're very excited to have happened to us. So we work across a wide variety of disciplines, paid search, programmatic, paid social, email.

And then the team that I lead is called Digital Intelligence, all about the wide world of analytics and ultimately trying to squeeze a little bit more juice out of that intelligence layman. And if someone wanted to reach you to find out a bit more about WPromote or maybe have some questions for you, how can they connect with you? Sure, absolutely. Well, I'm on Twitter, so you can connect with me at spoulton, S-P-O-U-L-T-O-N. Or if you're interested in WPromote in general, you can just go to wromote.com. Simon, thank you so much for your time. This has been invaluable. Of course, Todd. Appreciate you having me on the show.

I hope that deep dive look at the CCPA was helpful. We're back to the regular podcast tomorrow. Our theme music is by Mark Blevis, ad sales by Podcorn. I'm Todd Maffin from EngageQ Digital. Talk to you tomorrow.