1

What does CCPA require for proof of consent to display advertising in mobile applications (vs a web site), especially for apps that do not create a user profile? Hypothetically, would it be sufficient to retain copies of versioned source code that indicates a user must actively give consent for any advertising to be displayed?

I have reviewed the following, but it is a couple of years old and only addresses GDPR: User consent required under GDPR

Improve this question
4
  • Are you asking about display ads or collect info? you can display ads, ccpa doesn't need your consent
    – kirill_igum
    Commented Jan 12, 2021 at 12:18
  • @kirill_igum, kinda both. Google Admob offers either targeted/relevant or non-targeted/non-relevant ads. Google automatically collects user information, such as browsing topics and user demographic bands, for the targeted/relevant ads. But even for the non-targeted ads, it stores a cookie on the device. The hypothetical question is what proof of consent does CCPA require for either type of ad to be displayed, especially if the app doesn't collect a user profile (name, email, etc)?
    – Ahnold
    Commented Jan 12, 2021 at 13:37
  • cookies are still personal information. also IP addresses. also any information that can lead to deidentification.
    – kirill_igum
    Commented Jan 13, 2021 at 10:42
  • 'what proof of consent" is to big of a question for a comment. it depends on the current set up by google.
    – kirill_igum
    Commented Jan 13, 2021 at 10:59

1 Answer 1

Reset to default
2

here is what the law says about the mobile apps alternative to homepage

1798.140.p

(p) “Homepage” means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the application’s platform page or download page, a link within the application, such as from the application configuration, “About,” “Information,’’ or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.

so one option is to display it somewhere on the way to download the application. my guess it would be in the app store and another option is around the link to your app in the app store.

Improve this answer
6
  • Does CCPA require that a user be provided the ability to withdraw permission at a later date? If so, would an app need to record that request from the user?
    – Ahnold
    Commented Jan 11, 2021 at 23:47
  • @Ahnold yes ` (a) A consumer shall have the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. This right may be referred to as the right to opt-out. `
    – kirill_igum
    Commented Jan 12, 2021 at 12:15
  • Thanks! If the only options are to use a free app with advertising or purchase an ad-free version of it, would CCPA hypothetically require any documentation of user consent beyond a notice prior to download of the free app and source code that shows the app shuts down (i.e. no further user info is shared, no further cookies placed on device) if user opts-out of advertising?
    – Ahnold
    Commented Jan 12, 2021 at 14:02
  • depends on your infrastructure and what meta data you record. If you have a website or an app, you'll still receive network requests, which most likely have IP. therefore you would be receiving pi. the only way i can think of completely avoiding it is to get anonymous requests (TOR for example) and also at randomized times given your app has a lot of visitors to hide the visit times in noise; maybe even more engineering for anonymization.
    – kirill_igum
    Commented Jan 13, 2021 at 11:13
  • Thanks for your time and responses. For an app that doesn't use a backend server (all app generated info is stored on the device), how to record user consent and/or opt-out requests? Google records the user responses, but doesn't make those records available to app developers in case of a dispute (their records are only for internal Google use). Does CCPA indirectly require app developers maintain a backend server when they otherwise wouldn't need one?
    – Ahnold
    Commented Jan 13, 2021 at 23:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .