Ad industry asks for more time to ramp-up after CCPA’s final rules

The California Consumer Privacy Act (CCPA) went into effect on New Year’s Day, but there was a major catch. The law’s final rules have not yet been released by the state’s Attorney General (AG).

While enforcement is scheduled to begin six months after the final rules are released, enforcement will begin no later than July 1 in any case. Since July 1 is five months from now, there obviously is no way the final rules could be released at this point and still allow six months before enforcement begins.

Given this situation, five major advertising trade groups – the Association of National Advertisers (ANA), the American Association of Advertising Agencies (4A’s), the Interactive Advertising Bureau (IAB), the Network Advertising Initiative (NAI) and the American Advertising Federation (AAF) — have sent a joint letter to AG Xavier Becerra, asking that his office “delay the enforcement of the CCPA until at least six months from the date of finalization of the rules implementing the law.”

‘Sufficient time period’ to implement CCPA

The six months would begin after the final rules have been issued, have received a final round of comments from the field, and have been approved by the administering agency, California’s Office of Administrative Law.

This full six months would give businesses “a sufficient time period to implement the new regulations before being subject to enforcement,” the letter said. The letter points out that draft regulations were not formally released until October 11 of last year, followed by a period of comments from the field.

ANA Group EVP for Government Relations Dan Jaffe told ClickZ that the five organizations have not yet received a response from the AG’s office, which was quoted recently in the Los Angeles Times saying it would not respond to such letters or requests.

First draft on October 11

He said draft regulations were not formally released until October 11 of last year, followed by four days of hearings, with last comments due by last December 6. He added that his organization, among others, sent a “very detailed” letter of requested clarifications and suggestions.

The law as written is “extraordinarily complex with many ambiguities and inconsistent provisions,” Jaffe said, and it “needs a lot of work” to make it clear to businesses. For instance, he said, all loyalty programs for California residents appear to be in “serious jeopardy” under the current draft rules.

Jaffe noted that, without the final rules, the law is “a target that is not only moving, but not fully visible.” At this point, he said, “a lot of businesses have to guess what the law means.”

The European Union’s more stringent General Data Protection Regulation (GDPR) also had many murky areas when enforcement began May 25, 2018, plus each EU nation has a separate body to interpret the law.

How CCPA differs from GDPR?

But the difference between that and CCPA, Jaffe said, is that GDPR regulators “provided substantial guidance with meetings and publications,” after the final rules went into effect.

By contrast, he said, he’s attended meetings where “very senior [privacy law] lawyers are disagreeing” about key parts of the CCPA draft rules.

Unless the AG’s office responds, Jaffe said there isn’t much more the five organizations can do until July 1, and that the real solution to the California dilemma and the spate of emerging and sometimes conflicting state privacy laws is a federal privacy law that replaces them.

The ANA is offering some materials on its website that it says provides “best effort” guidance on the probable meaning of the draft rules.

Another signatory to the letter — the Interactive Advertising Bureau — has similarly offered some guidance based on initial readings with its CCPA Framework.