CCPA Impact on Google, Microsoft, and Facebook Ads

It’s been a year since the California Consumer Protection Act (CCPA) went into effect, so it’s a good time to revisit what that means for paid search marketers on Google, Microsoft, and Facebook.

What Is CCPA? 

CCPA is an act that grants the following rights to consumers in California:

• The right to know what information a company collects about them, and how it’s used and shared;
• The right to delete personal information about themselves;
• The right to opt-out of the sale of their personal information;
• The right to non-discrimination for exercising their CCPA rights. This means that a company can’t refuse to sell someone their products or charge them a different price because a consumer wants to see, delete, or opt-out of the sale of their information.

Many companies that aren’t located in California might assume that CCPA doesn’t apply to them but it could. CCPA applies to any for-profit business that does business in California and meets any of the following criteria:

1. Has an annual gross revenue of more than $25 million;
2. Buys, receives, or sells the personal information of 50,000 or more California residents, households, or devices; or
3. Gets 50% or more of their annual revenue from selling California residents’ personal information.

Items number one and three are pretty straightforward; it’s number two that applies to more companies than you might think. And the word “receives” is problematic. According to this criterion, if you have a company that sells to consumers in California and you have any or all of the following accounts: Google Analytics, Google Ads, Microsoft Advertising, or Facebook Advertising you may very well have a company to which CCPA applies.

Again, it’s that word “receives” that can cause a hidden problem.

What is personal information, according to the CCPA? 

“Personal information is information that identifies, relates to, or could reasonably be linked with you or your household. For example, it could include your name, social security number, email address, records of products purchased, internet browsing history, geolocation data, fingerprints, and inferences from other personal information that could create a profile about your preferences and characteristics.”

I bolded a few of these items that you might not think about. For example, if you use Google Analytics and your site receives enough site traffic, you may very well qualify as receiving enough personal information that CCPA applies to your business. 

So, if a site that uses Google Analytics had 750,000 new California users in 2020, but doesn’t earn $25 million in revenue, does CCPA apply to them? That’s a question for a privacy attorney. And that’s the critical part: neither this article nor any other article online can clearly explain whether or not CCPA applies to a certain business. It’s essential to consult a privacy attorney for your specific business. 

CCPA Applies to You, Now What?

If your privacy attorney confirmed that CCPA applies to your business, how does that affect your paid search advertising?

Google Ads has come up with an option to opt-out of collecting data from California consumers for Remarketing purposes. Customer Match — as well as Store Sales (direct upload) — already operate using restricted data processing to comply with CCPA. But you need to enable restricted data processing for the Remarketing pixel manually in the admin. 

To enable restricted data processing for Remarketing, follow these steps:

1. Navigate to Shared Library > Audience Manager. 
2. Select Audience Sources in the left-hand navigation, click the three dots on the Google Ads tag widget, and choose Edit Source. 
3. Check Exclude California Users from remarketing lists under the Restricted data processing section, as shown below, and click Save and continue.

Note that your code will not change with this setting change, so select however you installed the code previously and hit continue.

Alternatively, you can update the global site tag with the parameter ‘restricted_data_processing.’ 

Microsoft Advertising

When I reached out to our Microsoft team to see if the same option applied to the Universal Event Tracking tag, I received the following reply: 

“Microsoft is leveraging its extensive expertise in protecting data, championing privacy, and complying with complex regulations. We believe that the California Consumer Privacy Act (CCPA), as well as other applicable state, federal, and international data privacy protection laws are an important step forward for clarifying and enabling individual privacy rights. Microsoft is committed to CCPA compliance across our business, including Bing Ads, when the law takes effect on January 1, 2020. Microsoft will honor CCPA rights through the standard controls and processes applicable to Microsoft Advertising, including honoring the privacy settings chosen by users through Microsoft’s privacy dashboard.  For general information about Microsoft’s privacy practices, please see our Privacy Statement. User controls for personal data collected, processed, and retained by Microsoft are available on our privacy dashboard. We offer our own Privacy Dashboard and we honor the opt-out choices offered by the Network Advertising Initiative (NAI).”

In combing through their FAQs, I found no option to exclude California users from Microsoft’s data collection.

Facebook Advertising

When CCPA first came about, Facebook implemented a transition period where they automatically limited how they use data about people in California. Today, however, you must ensure you are using the Limited Data Use flag as described in the developer documentation. Implementing this flag will tell Facebook who has opted out so that data use can be limited.

Google Analytics

What if you use Google Analytics audience lists shared to Google Ads? You can opt-out of data collection for specific geolocations, including U.S. states. To exclude California, follow these steps:

1. Navigate to Admin, and then click Tracking Info > Data Collection under the Property column.

2. Under Advanced Settings to Allow for Ad Personalization, click the Gear next to the option “Ads personalization is allowed,” as shown below.

3. Then select California, or any other states or countries you want to exclude, as shown below.

Again, I can’t stress enough that it is murky as to which businesses CCPA applies to. It is vital to consult an attorney who understands CCPA to see if it applies to your business.

If you work with an agency to manage your digital advertising accounts, make sure to let them know if CCPA applies to you so that they can help you opt-out of collecting the data. But only you and your attorney can determine if that’s a step that you need to take.