IAB Releases Amended Limited Service Provider Agreement for CCPA Compliance

All LSPA Signatories: Please Update Your Registration Information by May 7

As part of your California Consumer Privacy Act (CCPA) compliance process, your company may have signed the IAB Privacy, LLC’s Limited Service Provider Agreement (LSPA). After just over a year in-market, the IAB Legal Affairs Council reviewed applicable regulations and market practice and issued updates to the LSPA. Those updates are outlined in detail below, notably the notice obligations of publishers and the definition of “re-sale”. Additionally, current signatories will need to provide new information as part of their registration, which will be accomplished through a new registration management process for signatories, hosted in the IAB Tech Lab Tools Portal (https://tools.iabtechlab.com/lspa). LSPA signatories have until May 7 to update their registrations before the list and new registration details are made public to the industry. So, we encourage you to review your company’s registration information as soon as possible. The First Amended Limited Service Provider Agreement (the “First Amended LSPA”), which is part of the IAB CCPA Compliance Framework for Publishers & Technology Companies, will become effective on May 7, 2021. The First Amended LSPA will be accompanied by changes to the LSPA registration process and the Tech Lab’s specification for the U.S. Privacy String. Each are discussed in more detail below.

Revisions to the LSPA

• Definition of “Re-Sale”: Section 1.23 defines “Re-Sale” (or “Re-Sell”) as a Sale by a Downstream Participant after a Sale to such Downstream Participant by the Publisher Digital Property (emphasis added).
• Amended Notice Obligations: Section 3.3(b) amends the Publisher’s notice obligations when a Consumer clicks on the Link, most notably as follows:
  • Requiring a disclosure that Downstream Participants may Re-Sell the Consumer’s Personal Information that was Sold to them by the Publisher
  • Requiring a disclosure that the Consumer has the right to Opt Out of the Re-Sale of the Consumer’s Personal Information by a Downstream Participant by clicking on the link to the Signatory Identification List and then Opting Out on the Downstream Participant’s digital property. The Publisher must make the link to the Signatory Identification List available to the Consumer as part of this disclosure.
    • This addition is intended to facilitate the provision of “explicit notice” under the CCPA on behalf of Downstream Participants.
    • The 90-day look-back period was included in the California Attorney General’s Original Proposed Regulations but never adopted in the Final Text of Regulations.
    • For Non-Opt Out Transactions where the LSPA Transaction Signal is set to “Yes,” a Downstream Participant may Re-Sell Personal Information only if the Downstream Participant also provides a “Do Not Sell My Personal Information” link in accordance with the CCPA.

    LSPA Registration

    IAB Privacy, LLC is providing a new streamlined interface for registration and management of Signatories to the First Amended LSPA at https://tools.iabtechlab.com/lspa. For new registrations, users can create a tools portal account and click on the LSPA tile to complete the registration information and sign the First Amended LSPA.

    For current Signatories, your LSPA data has been migrated to a tools portal account under the email address with which you previously registered to receive Signatory Identification List notifications. You should have received an email from [email protected] welcoming you to the Tools Portal and a second email asking you to verify your email address to complete the account creation. Please contact [email protected] if you have not received or cannot find these email notifications.

    Once you’ve logged into the Tech Lab Tools Portal you will be able to review and manage your registration. Per the updates to the First Amended LSPA, Signatories will need to provide a link to the Opt Out notice on their registered digital properties to support the amended notice obligations above.

    Current Signatories should update their registration as soon as possible, but no later than May 7, 2021.

    When the First Amended Agreement becomes effective on May 7, 2021, the Signatory Identification List will be made publicly available via a downloadable file or API. The list will automatically update as Signatories are added or removed. As such, the IAB Privacy, LLC will no longer email copies of the Signatory Identification List. Signatories will be able to use the API for automatic updates, or they can login to the Tools Portal to download regular updates in excel or json formats.

    Updates to the U.S. Privacy String

    Versions 1-1.1 of the USPrivacy String required Publishers to send a Yes/No Signal indicating whether the Publisher had provided explicit notice required by Cal. Civ. Code § 1798.115(d) and the opportunity for a Consumer to Opt-Out of the Sale of Personal Information.

    Version 1.2 of the USPrivacy String has been updated so that the Yes/No Signal for CCPA notice will, instead, indicate whether a Publisher has provided notice pursuant to § 1798.100(b), along with providing the opportunity for a Consumer to Opt-Out of the Sale of their Personal Information. This straight-forward change is consistent with the revised Section 3.3(b) of the First Amended LSPA described above.