CPRA also adds new requirements for data minimization, places limits on data retention, calls for annual audits and risk assessments for “high-risk processing” and expands the “do not sell” remit within CCPA to “do not sell or share” – which has a direct impact on ad tech companies.
“Between CPRA, the efforts that have been made by major browsers and the recent iOS14 privacy updates to do away with third-party cookies, the ad tech industry will need to evolve,” said Heather Federman, VP of privacy and policy at privacy tech company BigID. “Otherwise, their business models are at risk of becoming obsolete.”
