The CCPA enforcement date of July 1 has recently passed, but there are still areas of the regulation that businesses need clarity on. One particular need for clarity surrounds data-sharing relationships, such as those that exist between advertisers and Facebook. Facebook has recently announced the launch of a Limited Data Use (LDU) feature to help businesses work towards their CCPA compliance goals.
The LDU feature will allow businesses to exercise more control over how their data is used in Facebook’s systems. This new feature will most significantly affect Facebook ad buyers and marketing performance.
Between July 1 and July 31, the LDU is automatically enabled on all Facebook business accounts. From July 31 onwards businesses will be required to update their pixel to include an LDU parameter.
In short, the LDU feature works by automatically detecting if a user is a California resident and then limiting the way that their user data can be stored and processed.
CCPA background
The LDU is designed to help business with CCPA compliance, so below is a brief overview of the relevant CCPA requirements:
- Information being collected must be transparent about what data they collect, the purpose for it, and any third parties it may be shared with
- A business must delete the data if it’s requested by the user
- Consumers can opt-out of their data being sold through a “Do Not Sell” button or link on a website
Businesses that target residents of California must comply with the CCPA. So, if your business markets to California residents on Facebook you must ensure compliance or your business may face liability and potential penalties.
Facebook’s LDU as part of your CCPA compliance
By using Facebook LDU, advertisers are able to specify which data should be subject to the protections of the CCPA. See the specific ways that user data will be limited under Facebook’s list of state-specific terms here.
Detecting if a user resides in California is done through a modification to the Facebook PageView pixel. Within the Facebook pixel, ‘dataProcessingOptions’ must be included. The string will allow an advertiser to control whether they are identifying California residents or if Facebook should handle the auto-identification.
The most notable consequence here is that the LDU may well have a significant impact on overall performance targeting for California residents. Facebook notes that “When Limited Data Use is enabled, businesses may notice an impact on campaign performance and effectiveness, and retargeting and measurement capabilities will be limited.”
What should be done before July 31?
The responsibility for assessing processes and taking decisive action still sits with businesses. There are two ways of approaching Facebook’s new LDU feature:
Approach 1: Implement a consent management platform that gives users a clear choice to opt-out of tracking. This would mean that the LDU would only need to be enabled for users who opted out, which would stop the Facebook pixel from firing. By taking this approach a business can still use behavior-based and re-targeted ads if California users do not opt-out.
Approach 2: Do not offer an explicit opt-out and enable the LDU to limit the data of all identified California residents. This approach has the downside that all California residents will be excluded from re-marketing, meaning that marketing performance will likely take a significant hit.
The important thing here is timing, whichever route your business takes, the LDU update on your Facebook pixel must be actioned before August 1.
For more information on how OneTrust can help, request a demo today.
