CCPA Compliance: Facebook Announces Limited Data Use Features

The California Consumer Privacy Act (CCPA) went into effect on January 1, 2020, and is now being enforced starting on July 1, meaning your business can officially get fined for non-compliance. Some businesses are still puzzled about CCPA’s requirements for handling and sharing personal data, and Facebook just threw a wrench in the confusion.

Facebook has just announced its new feature called Limited Data Use (LDU) which gives businesses more control over how their data is used in our systems and provide more support for CCPA compliance. From July 1 through July 31, the new feature is enabled for all Facebook business accounts, limiting the way user data can be stored and processed for users Facebook identifies as residents of the state of California.

The feature automatically detects if a user resides in California, and applies limited data use rules. Once July 31 hits, Facebook will require businesses to update their pixel to include an LDU parameter.

Overview of CCPA

Before diving into the LDU, let’s review what CCPA is and who it impacts:

The California Consumer Privacy Act is intended to strengthen privacy rights and consumer protection for residents of California. If a business that collects the personal data of individuals meets one or more of the following conditions, they must adhere to the CCPA: 

• Earns $25 million or more in revenue annually. 
• Processes data of 50K or more consumers, households, or devices. 
• Derives at least 50 percent of its annual revenue from selling personal information.

Some of the main requirements are the following:

• Information being collected must be transparent about what data they collect, the purpose for it, and any third parties it may be shared with
• A business must delete the data if it’s requested by the user
• Consumers can opt out of their data being sold through a “Do Not Sell” button on link on a website

Facebook’s LDU Feature

Facebook LDU enables advertisers to specify which data should be subject to CCPA data management. The company has outlined the specific ways user data will be limited in its list of state-specific terms.

To identify California residents, you must modify the existing Facebook PageView pixel to include a string within the Facebook pixel for ‘dataProcessingOptions’. The string will allow for an advertiser to control if it is identifying a user in California or prefer for Facebook to handle the auto-identification.

The downside of the new feature is the potential to impact marketing performance and revenue due to the limitation of retargeting ads to California users. Since the feature is already automatically enabled now through July 31, be conscious that this could be the reason for a drop in your performance.

Next Steps

You and your business must take responsibility to assess take action on Facebook. There are two primary options to choose from:

Option A: Leverage CookiePro to create a cookie banner that provides users the choice to opt-out of tracking. With a cookie compliance tool such as CookiePro, you’re able to enable LDU for the users who opt out, which will also disable the Facebook pixel from firing. This will likely allow you to deliver ads based on behavior and retarget ads as usual if California users decide not to opt out.

Option B: If the user has been identified as a California resident, enable the Facebook LDU string on all instances of the PageView tag firing. However, going this route makes could put you at risk of excluding California residents as a whole from remarketing campaigns.

Whichever option makes more sense for your business, be sure you update your Facebook pixel accordingly to protect your advertising spend and from getting fined.

Get started with a free website scan today!