Cross-context behavioral advertising (CCBA) emerged in the early 2000s as data collection and tracking technologies like cookies evolved. Since then, CCBA has continued to grow, fueled by the rise of big data and multi-device ecosystems.<\/p>\n\n\n\n
This type of digital advertising has revolutionized marketing by enabling businesses to target users that are already interested in products like theirs. However, it has also become a point of contention in the data privacy space. <\/p>\n\n\n\n
Today, concerns about how personal information is used to enable cross-context behavioral advertising has sparked stricter regulation of this practice. Businesses need to be cautious and pay attention to meet \u2014 and maintain compliance with \u2014 these regulatory requirements. <\/p>\n\n\n\n
This article explores what cross-context behavioral advertising is, what privacy laws like the CPRA and GDPR say about it, and what you can do to ensure your operations are compliant. <\/p>\n\n\n\n
Think about the last time that you visited a news website. You likely saw a range of advertisements that weren\u2019t necessarily related to the information featured on the page you landed on. For example, you may have spotted a promotional video for athletic gear embedded into a finance article regarding interest rate predictions.<\/p>\n\n\n\n
This is a prime example of cross-context behavioural advertising. It\u2019s a sophisticated digital marketing technique that uses data from a website visitor\u2019s activity across multiple platforms to deliver tailored ads.<\/p>\n\n\n\n
According to the California Privacy Rights Act (CPRA)<\/a>, cross-context behavioral advertising refers to when a website shares a consumer\u2019s information with other, unrelated websites, apps, or services with the aim of delivering targeted ads to that individual. <\/p>\n\n\n\n CPRA SEC. 14. Section 1798.140 (k)<\/a> defines cross-context behavioral advertising as:<\/p>\n\n\n\n \u201cthe targeting of advertising to a consumer based on the consumer\u2019s personal information obtained from the consumer\u2019s activity across businesses, distinctly\u2010branded websites, applications, or services, other than the business, distinctly\u2010branded website, application, or service with which the consumer intentionally interacts.\u201d<\/em><\/p>\n\n\n\n In other words, cross-context behavioral advertising happens when data is:<\/p>\n\n\n\n Generally, businesses use digital advertising platforms like Google and Meta to push ads to their targets. These platforms aggregate user data, and businesses are able to retarget key customers based on their activity across the internet.<\/p>\n\n\n\n Highly targeted ads are the hallmark of online behavioral advertising. To achieve this, marketers gather information about a user based on their browsing habits. The two most common methods for doing so are by using website cookies and tracking pixels. <\/p>\n\n\n\n Once marketers have this data on hand, they aggregate it to group users, draw certain inferences about them, and deliver ads that they believe a user in a certain segment is most likely to interact with. <\/p>\n\n\n\n Browsing history is a good indicator of ongoing interests, hobbies, or product preferences, while search queries might show immediate needs or intentions. So, if you often watch yoga videos on YouTube, you may see ads for yoga mats on other websites. Alternatively, a recent Amazon search for office chairs could result in ads for ergonomic furniture on unrelated sites.<\/p>\n\n\n\n Contextual advertising, on the other hand, doesn\u2019t rely on tracking user behavior. Instead, it delivers ads relevant to the content of the web page a user is currently viewing. For instance, someone reading a recipe blog might see ads for kitchen appliances or grocery delivery services. <\/p>\n\n\n\n Behavioral advertising tracks personal information, therefore raising concerns related to data processing and sharing. Contextual advertising uses immediate, page-level relevance. This avoids the complexities of cross-context tracking and minimizes privacy risks.<\/p>\n\n\n\n Data privacy concerns target the core of behavioral advertising. Advertisers, publishers, and advertising network providers like Google and Meta exchange personal information about data subjects \u2014 ranging from location data to purchase histories \u2014 to segment users and deliver targeted ads.<\/p>\n\n\n\n Under previous data privacy regulations, there was at times debate about whether the concepts of \u201csale\u201d and \u201csharing\u201d could be used interchangeably. Some players in the marketing industry attempted to use this lack of clarity to sidestep compliance. <\/p>\n\n\n\n For example, some businesses argued that they weren\u2019t \u201cselling\u201d personal data, since no money actually changed hands. Instead, they were just \u201csharing\u201d that data in exchange for targeted ad placements or insights.<\/p>\n\n\n\n To prevent this and similar ambiguous actions, California lawmakers provided a comprehensive definition of what constitutes \u201csharing\u201d in terms of personal data when updating and expanding the earlier CCPA. CPRA SEC. 14. Section 1798.140 (ah)(1)<\/a> states that:<\/p>\n\n\n\n \u201cShare,\u201d \u201cshared,\u201d or \u201csharing\u201d means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer\u2019s personal information by the business to a third party for cross\u2010context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross\u2010context behavioral advertising for the benefit of a business in which no money is exchanged.\u201d<\/em><\/p>\n\n\n\n Put simply, the CPRA considers any transfer of personal information to third parties for the purpose of cross-context behavioral advertising as sharing. This comprehensive definition aims to hold businesses accountable for how they handle consumers\u2019 sensitive information.<\/p>\n\n\n\n Another important factor to keep in mind here is automated decision-making. Businesses using AI systems or algorithms in cross-context behavioral advertising must also disclose how these systems process and share personal data and enable opt-out. <\/p>\n\n\n\n The CPRA establishes several obligations for businesses engaged in cross-context behavioral advertising to promote consumer privacy and transparency. <\/p>\n\n\n\n First, businesses that are involved in data sharing must have a prominent \u201cDo Not Sell Or Share My Personal Information<\/a>\u201d link on their websites. This enables consumers to easily opt out of having their personal data shared with third parties for advertising purposes. <\/p>\n\n\n\n When a user triggers the \u201cDo Not Sell or Share\u201d mechanism, businesses must promptly honor this privacy opt-out signal. This also applies to consent preference signals sent by Global Privacy Control (GPC)<\/a> tools, which enable users to automatically communicate their preferences across multiple sites.<\/p>\n\n\n\n In addition to placing obligations on businesses, the CPRA also establishes requirements for service providers, contractors, and third parties. Service providers and contractors must agree to binding terms that limit their use of shared data to authorized purposes. Third parties must adhere to strict privacy rules and provide clear disclosures about their data practices.<\/p>\n\n\n Get a clear set of steps to comply with the data privacy law and avoid fines.\u00a0\u00a0<\/p>\n <\/div>\n <\/div>\n \n
Behavioral advertising vs. contextual advertising<\/h3>\n\n\n\n
Cross-context behavioral advertising and the CPRA\u00a0<\/h2>\n\n\n\n
CPRA requirements regarding cross-context behavioral advertising<\/h3>\n\n\n\n