CCPA, Data Governance, and How Privacy Measures Will Affect Digital Marketing

For many across the world, Netflix’s new documentary “The Social Dilemma” was as informative as it was terrifying. For those who haven’t seen it, the film details the way social media platforms are designed to keep us engaged and (at times) invade our privacy. Through conversations with friends and family members who watched the show, a lot of claims made in this movie seemed to sound the alarm for them about the dangers of the pervasive nature of data mining and manipulative technology.

The way mobile and web-based applications collect and use data has been a burgeoning topic for many years, and recent documentaries and news stories (including recent press related to TikTok) have only exacerbated the need for more clarity. As a digital marketing agency, both our clients and ourselves benefit from being able to use platforms like Facebook, Google, and more to target and convert “users” into customers. However, we also are big proponents of the ethical use of data, and part of collecting data ethically is helping individuals understand what is being collected. The purpose of this article is to increase your knowledge, while also making some predictions on how digital marketing (as a whole) may change due to new standards of data governance.

As you scroll through this site right now, some of your behavior is being monitored. We can tell what pages you visit, and retarget you with more content on social media or search engines. A pop-up may also appear on the page after a couple of minutes asking you to sign up for our newsletter so we can reach you with future messages. Digital marketing practices are sprinkled in everywhere, but as the call for additional online security measures gains momentum, it will pose challenges to marketers and businesses alike. How will things change, and what happens if they don’t? Keep reading to learn more.

What are the GDPR and CCPA?

If you live in the digital marketing space, you’re accustomed to many acronyms. Two of the most common ones these days are GDPR and CCPA.  The GDPR is short for “General Data Protection Regulation” and is Europe’s new data privacy and security law that was put into effect in mid-2018. The act includes hundreds of pages’ worth of new requirements for businesses in the EU and for organizations outside of the EU that offer goods or services to those in it. This law essentially sets guidelines for the collection and processing of personal information, and heavily penalizes those who do not abide by it. 

The GDPR being passed by the European Union really set the stage for what will continue to be increased regulations across the world with data collection and privacy. In fact, it heavily influenced the decision by California-based lawmakers to pass the CCPA (or “California Consumer Privacy Act”) which took effect in January 2020. The CCPA applies to individuals in California, and allows them the following rights:

• A right to know what personal data is collected, used, shared, or sold by businesses.
• A right to delete personal data.
• A right to prohibit the sale of personal data (children under the age of 16 must give explicit consent to have their data eligible for sale, and a parent or guardian must give explicit consent for a child under the age of 13).
• A guarantee that consumers who exercise their rights under the CCPA will not be penalized with higher prices or lower levels of service than those who do not.

The CCPA applies to any businesses that either: (a) gross annual revenues of $25 million or more, (b) purchase, receive, or sell personal data from 50,000 or more individuals, households, or devices, or (c) have sales of personal data represent at least 50% of their annual revenue. If one of these does apply to your business, you’ll be asked to notify consumers in advance of their personal data being collected, make it easy for consumers to exercise their right to avoid data collection, maintain data inventories, and more.

These sets of laws have forced data companies (and those collecting data of any sort) to be more mindful of how their data is being used, and more transparent with all of their visitors. All across the nation, other states and lawmakers are considering similar acts as the CCPA (and GDPR, for that matter) in order to instill greater trust and privacy for their constituents. Washington, Nebraska, Virginia, Florida, and New York have all discussed similar bills, and it’s only a matter of time before additional states join the discussion. If you’re a company that’s benefitting from the collection of data, it may be time to think about getting “ahead of the game” with your privacy measures to ensure transparency and establish trust with your visitors.

What Data Can Google and Facebook Currently Access?

The threat of someone having your data is way more debilitating when you’re unaware of what is actually being collected. That’s why I think it’s important to have a clear cut understanding of what a platform can learn about you and what an advertiser can use to target you. For most advertisers, ourselves included, the top spots to target prospective customers are Google and Facebook. So, what is it that each of these advertising platforms knows about an individual?

Google

It’s important to first note that Google knows exponentially less about you if you never create a Google account, and it knows nothing about you if you’re doing all of your searching on an incognito window. For many of us, however, there is some important information that’s being stored which you should be aware of. In fact, if you wish to find out the full list of what Google knows about you, you can feel free to go here. But for most, here are the highlights:

• Age
• Gender
• Location Information
• Search Activity
• YouTube and Gmail Activity
• Voice Data (on Google devices)

Google is adamant about not selling your personal information (see their safety page) which should provide some reassurance. They also are adamant about not selling your personal information that identifies you to their advertisers (name or email). However, the data that is collected on you and your internet activity does provide for Google AdWords and Google Shopping campaigns to work effectively, as advertisers are able to identify and serve ads to people who fit a certain demographic or other criteria. It’s important to have an understanding of what is being collected and how it’s being used for your own comfort.

Facebook

Being the social media platform that you post photo albums on, acknowledge friendships with, and use to sign up for many third-party apps (Candy Crush, anyone?), it’s no secret that Facebook has a lot of data about you. While a fair amount of their data collection is used to enhance your experience on their platform (for example, re-sharing the memory of you in the Bahamas 3 years ago), it also uses some of the data to improve their ad platform and help businesses reach you with messaging about their products or services. Some of that data includes:

• Education
• Employment
• Household
• Financial/Income Demographics
• Language
• Lifestyle
• Interests (based off Pages you like)
• Behaviors
• Email Addresses, Name, or Address (to match your account to lists)
• Other Data

Facebook, like Google, has become increasingly transparent about what’s being collected and how it’s being used. The problem is: a lot of people either don’t care to know or don’t care to look. We’d encourage you to check out Facebook’s Full Data Use Policy to have a complete understanding of what’s being collected, or to reach out to our team if you have any other questions or concerns.

How Digital Marketers Use Your Data

Sometimes, Facebook and Google’s collection of your data is intended for the purpose of streamlining your internet activity. By remembering websites you’ve visited before, videos you’ve watched before, and locations you frequent on your map, predictive algorithms can feed you the content and locations you desire with greater ease. On Facebook and Instagram, you’re delivered content from people you engage with the most on the top of your timeline, and you’re given birthday reminders to help your memory. There are numerous subtle ways that technology serves to make our lives easier, and that shouldn’t get lost.

However, data is also collected with the intention of making digital advertising more effective, and making these platforms more lucrative for their owners. With that, I think it’s important to discuss how digital marketers can use your data so that you have more awareness of how the world of online advertising works.

Google

On Google AdWords, there are a few demographic areas that advertisers are able to target: 

• gender
• age
• parental status (on display/video campaigns)
• household income (in some countries, including the U.S.)

Most companies have conducted enough marketing research to know who their ideal client is, and through Google Ads they’re able to find people that match those descriptions based on Google Account data that is captured. When keywords are searched on Google, ads are only served to individuals that fit within the identified target audience. Ultimately, this helps preserve marketing spend for consumers with the highest buying potential.

Data related to your internet behavior (website visits, products you search for, videos you watch, etc.) can also be used to put you into a custom targeted audience by advertisers. Through audience targeting options such as “in-market” and “similar audiences,” your internet browsing activity becomes very crucial to advertisers and allows them to reach you (and attempt to sell to you) with greater ease.

A final way that data is used in advertising efforts on Google is through remarketing campaigns. Companies can install a piece of Google remarketing code onto their websites in order to start tracking web visitors, and then can serve them display ads on a number of Google partner sites and display locations at a later date. You can also get really granular with this, and serve individuals specific product ads based on product pages they’ve visited. 

Facebook

On Facebook, advertisers are able to target even more demographic attributes. Facebook advertisers can target users based on: location, demographics, interests, behavior, and connections. In order to reach you on Facebook, advertisers are using data related to:

• city you live in
• age
• gender
• education
• job title
• interests and hobbies
• consumer behavior
• pages you like
• events you attend. 

As Facebook use continues to grow (over 2.6 billion monthly active users), advertisers have flocked to this channel as a great way to reach potential audiences for a relatively low cost. Facebook, like Google, also allows for remarketing opportunities when businesses have installed “Facebook Pixel” (tracking code) on their site. If you go and check out a pair of shoes on a website that has tracking code installed, you may later be served an ad for the exact same pair of shoes when scrolling through Facebook.

Though scrutinized by many for the data that they collect, it’s important to note that Facebook does not sell your data to others. What it does, instead, is help advertisers access you more easily through the data that has been collected (by showing up on your news feeds). If you have any concern about what’s being collected, you can go into your “Settings” on Facebook and download a copy of your Facebook data.

Expected Privacy Measures Moving Forward

At this very moment, the topic of data governance and responsible use of data is being discussed everywhere from conference rooms in Silicon Valley, to congressional meetings in Washington, D.C. In a world that is so connected to social media, and one where privacy feels to be increasingly obsolete, As the topic of data governance and ethical use of data continues to grow, we can expect privacy measures to be heightened moving forward. 

More States Adopting Laws Like CCPA

The GDPR laid the foundation, The CCPA made things more real, and soon, we can likely expect more (and potentially, all) states in the U.S. to create more stringent laws related to data collection that mirror the CCPA. It’s even possible that we’ll see more federal regulations emerge related to data collection and privacy. Regardless, more transparency will be required in data collection, including the addition of a lot more messages like these in the footers of websites we visit:

Creation of More Roles Related to Data Collection:

For companies of all sizes, the creation of positions such as “Data Protection Officer” will likely emerge. These positions will help mitigate the risk that brands face with new laws that are being created, and also will help provide more security and comfort for consumers. For larger organizations with greater access to data, it’s likely that full committees or departments will need to be created to be tasked with this.

Consumers Will Be Choosier With Their Business

Surveys suggest that more than 80% of consumers are concerned about how companies are using their personal information. These individuals are going to be more likely to do business with organizations that are committed to taking data privacy measures seriously, and the way businesses respond to concerns related to the collection of data will prove pivotal.

Digital Marketers Will Need to Adapt

With the call for less data to be collected, or more opportunity for data to be deleted or removed by consumers, under laws like the CCPA – it may impact digital advertising in some capacity. As a result, us digital marketers will need to adapt and find new ways to reach our target audiences. So much is yet to be seen, and technology is evolving every day, but it will be an important area for us to continually monitor.

Ultimately, the move for increased data protection and cyber security is a very positive one for all of us. Though data collection can be used to enhance your experience online, if it falls into the wrong hands or is used unethically, it can have dire consequences. If you’re concerned about the information that is being collected, consider taking a couple of the following steps:

• Review what Google knows about you
• Review what Facebook knows about you
• Do your searching and online engaging on incognito browsers
• If you see ads that you don’t wish to, let Facebook know
• Increase your knowledge and awareness (reading this may just be step 1!)

For digital advertisers, we love knowing that we can reach a potential customer with an ad that’s served to them on Google or Facebook. However, we also want to make sure that there’s an understanding by the masses as to what data is being collected and how (or rather, why) you are being served a specific ad. Hopefully this article helped highlight that, but if you’d like to talk more about our digital advertising practices, please feel free to contact us.