Lucid Privacy Survey Finds That The Majority Of AdTech Businesses Plan To Honor Opt-Out Preference Signals Globally

Following the recent passage of new privacy laws in California, Colorado and Connecticut that will require businesses to honor ‘Do Not Sell or Share’ of targeted advertising opt-out requests via “opt-out preference signals’ or (‘signals’) (aka; ‘global privacy controls’ or ‘GPC’),”  there has been some uncertainty on h0w these opt-out mechanisms will be implemented by the AdTech and digital media industries.

The California Attorney General’s recent settlement with Sephora for not implementing the ‘GPC’ added urgency to the matter, without addressing the outstanding policy questions.

The upcoming California Privacy Rights Act (CPRA) goes into force from January 2023, and codifies the requirement for businesses that ‘sell or share’ personal information to honor opt-out preference signals,  However, the CPRA also authorizes the California Privacy Protection Agency (CPPA) to “Issue regulations to define the requirements and technical specifications for an opt-out preference signal sent by a platform, technology, or mechanism, to indicate a consumer’s intent to opt out of the sale or sharing of the consumer’s personal information and to limit the use or disclosure of the consumer’s sensitive personal information”.

A recent Lucid Privacy survey of AdTech vendors and digital publishers gives a gauge how the industry is reacting to current uncertainty.

In spite of some likely legal and industry hurdles still to be overcome, it seems that businesses are leaning into regulations, making fundamental and wide reaching changes to honor signals before the regulations are mandated.

Despite the fact that the necessity of Opt-Out Preference Signals is focused on three specific States’ legislation, the majority of businesses aim to implement controls and recognize all global signals, rather than geo-restrict to the states requiring and enforcing action.  

In addition, businesses intend to move quickly before any enforcement becomes widespread.

• 33% of the respondents currently honor browser based preference signals in some way. Another 20% might follow suit before the end of the year, but are currently waiting to see which way the market ‘herd’ moves.
• Unsurprisingly, over 80% of businesses are likely to implement signal recognition by July 2023, when CPRA enforcement is slated to begin.
• In determining the type of solution, around 50% of businesses plan to use a third party intermediary, such as a consent management platform, whilst about 40% will be implementing their own recognition technology.
• About 40% of businesses plan to treat the opt-out signal as persistent, 27% are considering session based opt-out and 13% are ‘other’ potential (TBD) solutions.

Conclusion

If we are to defer to the wisdom of the surveyed crowd, it would seem that businesses should be ready to receive Opt-Out Preference Signals across all browsers, and have automated mechanisms to comply with such signals before the July 2023 deadline.