4 ms·

> Even if Google doesn't pay you for your data, you still have the right (as a resident of California) to prevent Google from selling on your data directly, or

by d1zzy 7y ago

> Even if Google doesn't pay you for your data, you still have the right (as a resident of California) to prevent Google from selling on your data directly, or in using your data as part of a sale (e.g. targeted advertising). Except the definition you quoted doesn't say anything about "using" the information to provide a product (ie targeted advertising), it only talks about actually transferring that information to "another business or third party for monetary or other valuable consideration". So if the information doesn't leave Google's servers then it seems like it doesn't apply to Google.

geocar 7y ago
It does leave Google's servers in several ways. 1. The ad tag Google delivers to publishers captures personal data like IP addresses and cookies, non-personal but potentially privacy-leaking data such as the URL the user is visiting, and somewhere in-between marketing segments that the user may belong to, and delivers that information (usually in JSON) to hundreds or even thousands of different advertisers using a protocol called OpenRTB. 2. The ad tag being served can also include an impression tracker. This is usually a pixel (literally an <img tag!) that refers to the advertisers' server where they record counts, sometimes media spend, and because it's a third-party server, that advertiser will receive (automatically) the IP addresses and cookies, the URL the user is visiting, and so on. 3. One of Google's products includes custom segments which contain IP addresses and cookies for one or more ad exchange. This is actually delivered in a flat file to buyers, and while Google themselves do not offer this service publicly (so conceivably the contracts could be updated to be CCPA-compliant), other exchanges that are like Google in other ways certainly do not. It is entirely possible your point is accurate for someone who doesn't provide ad exchange services or impression trackers or custom segments (such as Facebook), but it is also likely that some party selling a product that is derived from the use of this data will be considered in-scope. I would steer clear of companies that favor an alternate interpretation until the Attorney General has had a say.

by d1zzy 7y ago

geocar 7y ago

It does leave Google's servers in several ways. 1. The ad tag Google delivers to publishers captures personal data like IP addresses and cookies, non-personal but potentially privacy-leaking data such as the URL the user is visiting, and somewhere in-between marketing segments that the user may belong to, and delivers that information (usually in JSON) to hundreds or even thousands of different advertisers using a protocol called OpenRTB. 2. The ad tag being served can also include an impression tracker. This is usually a pixel (literally an <img tag!) that refers to the advertisers' server where they record counts, sometimes media spend, and because it's a third-party server, that advertiser will receive (automatically) the IP addresses and cookies, the URL the user is visiting, and so on. 3. One of Google's products includes custom segments which contain IP addresses and cookies for one or more ad exchange. This is actually delivered in a flat file to buyers, and while Google themselves do not offer this service publicly (so conceivably the contracts could be updated to be CCPA-compliant), other exchanges that are like Google in other ways certainly do not. It is entirely possible your point is accurate for someone who doesn't provide ad exchange services or impression trackers or custom segments (such as Facebook), but it is also likely that some party selling a product that is derived from the use of this data will be considered in-scope. I would steer clear of companies that favor an alternate interpretation until the Attorney General has had a say.