Making sense of the large number of rapidly evolving privacy regulations can be a bit daunting. For marketers who just want to do right by customers, reach the audiences that matter, and stay on the right side of the regulatory fence this can be quite overwhelming. While timelines are rapidly shifting, there are a few major privacy-related tools and timings that global marketers need to be aware of over the next six months.  

To hear the latest on these topics and how Adform is supporting our clients, make sure to keep an eye our LinkedIn page. There, we share thought leadership as well as panel and webinar participation from experts like our VP of Legal and Privacy Compliance, Elena Turtureanu and are actively working to help demystify this complex landscape. 

In this post we’ve compiled what we see as key upcoming regulatory considerations. We hope this helps you better grasp how these might impact you, and when and where to engage with your own legal team so that you can ask the right questions, prepare well in advance, and anticipate what your privacy requirements will be in the future. 

The GPP was introduced by IAB Tech Lab in 2022. The vision is to create a top-level tool that will streamline transmitting privacy, consent and consumer choice signals from websites and applications to vendors.

Imagine you’re a global publisher or advertiser with inventory and campaigns running in all 50 US states and Europe. In its simplest form, the GPP would register and incorporate privacy and consent signals from both the MSPA in the US and Canada and TCF in Europe, serving as a global privacy tool to manage different consent signals from multiple jurisdictions. More information here.

What we're doing: Adform is working to support the GPP signal.

The US currently has several individual state privacy laws which are coming into effect; California (CPRA), Colorado (CoPA), Connecticut (CDPA), Utah (UCPA), Virginia (VCDPA). While these are all similar, they differ in a range of small ways. From California to Puerto Rico the potential complexity of US state and territory laws poses a daunting challenge.  

These challenges include new consumer rights to opt out of “sales,” “sharing,” and the processing of personal data for “targeted advertising”. This also includes the need to signal that information to the vendors, and requirements to have contracts in place governing essentially all transfers of personal information. In addition, there are limitations on how service providers can use information on behalf of businesses, explicit consent for processing sensitive data (health-related, religion, political views etc.), and concepts of joint controllership introduced among publishers, advertisers, and their digital advertising vendors. 

IAB, the industry trade body, has succeeded in working with industry experts, including representatives from Adform, to build the MSPA or Multi-State Privacy Agreement. The goal with this sophisticated agreement is to create a tool that scales effectively while recording and registering consent signals and aligning those to each state’s individual restrictions. 

The vision is that these signals can then further be fed into the GPP, alongside signals from outside the US for an effective and efficient global consent platform and process. 

What we're doing: Adform is a signatory of the MSPA. 

The Network Advertising Initiative (NAI) is a leading self-regulatory association in the US comprised exclusively of third-party digital advertising companies. In addition to a wide range of existing resources, the NAI is working on a State Law Processing Addendum that is narrower in scope and functionality than the MSPA but provides an excellent complimentary solution. Read more about it here. 

The NAI template is an easy to read and adopt set of data processing templates for use by publishers, advertisers, and vendors alike. Its goal is to cover the requirements of current US privacy laws while meeting the needs of the ad tech ecosystem and digital advertising.  

What we're doing: Adform has adopted the NAI template and incorporated a customized version into our data processing framework for the US market.

The IAB Transparency & Consent Framework (TCF) is a framework that helps websites, advertisers, and adtech partners obtain, record, and update consumer consent for web pages. The latest version of the TCF (version 2.2) will go into effect later this year. This version brings a wide range of additional improvements, refinements and technical additions which further align it with requests from key regulatory bodies in Europe.  TCF 2.2 was initially slated to go live on September 30th, but has now been pushed to November 20th to provide more time for users to implement the new version. 

What we're doing: Adform is a long-standing TCF vendor and will support TCF v2.2 when the latest update goes live.

The EU’s Digital Services Act is a far-reaching series of changes. The DSA includes a wide range of regulatory requirements. Among those are increased requirements for transparency, which has privacy considerations. As many of the sites most directly impacted by the DSA are large walled gardens that also feature user generated content, and/or have both publisher and adtech properties the DSA applies to them to a wider extent. However, some aspects of the DSA are more broadly applicable across adtech. These include a Ban on targeted ads to minors, ban on targeted ads focused on special/sensitive categories of personal data, and content moderation around illegal content and dark patterns.  For the ad tech ecosystem, platforms must disclose and provide more transparency for each ad that is shown about the following:  

• why the user is seeing the ad  
• who paid for the ad 
• how and where a user can exercise choices  

What we're doing: Adform is engaged as part of the IAB and EDAA working groups which are crafting industry standards and best practice approaches.

Despite certain risks and controversy, organizations may continue to engage in data transfers while prevailing on one of 2 transfers mechanisms: 

• SCCs plus data transfer impact assessments
• The current EU-US data transfer scheme, which is outlined in added depth here.

What we're doing: Adform relies on SCCs as transfer mechanisms and has conducted transfer impact risk assessments. We also can store and process European data in Europe. 

The US and Europe are far from the only countries actively implementing new privacy and consent regulations. Regulation like Japan’s APPI highlight that advertisers should engage with their local legal and trade bodies for the latest insights and in-depth analysis on which of these laws are likely to impact their technology choices and advertising strategies moving forward.