ADventures in Law

Home | ADventures in Law

core/image

As we head into 2023, advertisers, publishers, ad tech companies and others involved in the digital advertising ecosystem are facing significant challenges when it comes to data. It can be overwhelming: five new U.S. state data privacy laws to contend with; a continued regulatory focus in Europe, including a new suite of proposed legislation relating to the digital data ecosystem; and the deprecation of third-party cookies. Facing so many challenges, everyone is looking for solutions to help them continue to engage with consumers in a compliant way. One potential solution you’ve likely heard about – and will continue to hear about in the coming year – is a data clean room.

core/paragraph

As with much of the terminology used in this space, the definition of “clean room” may depend on whom you ask. But in general, clean rooms are solutions that allow advertisers to target, measure and analyze advertising campaigns in a privacy-compliant way and without the use of third-party cookies ... or at least that is the goal. The actual implementation can vary. Many clean rooms involve the advertiser and publisher uploading data into a platform where that data can then be matched and operated on. But data points that tie back to specific users are not allowed to leave the environment; data only leaves in an aggregated and anonymized form, stripped of any user-level personal information. The benefit of these solutions is that they allow parties to control what data comes in, how the data is joined with other data, the kinds of analytics that can be performed, and what data, if any, leaves the environment. The solutions also normally provide features to ensure that the data is transferred and stored securely.

<strong>Clean Rooms and Privacy Compliance</strong>

So are these solutions really the answer to all our privacy compliance concerns? Is this the silver bullet we’ve all been waiting for? The answer is yes ... and no ... as well as maybe, partially and it depends. Rather than viewing clean rooms as the silver-bullet solution to privacy compliance, we see them as another tool to help you achieve your marketing goals in a compliant way. One of the main benefits of using a clean room is the structure and framework it provides – access to and use of data are clear, there are built-in restrictions and data governance mechanisms, and it allows you to gather insights and make other use of data through an intermediary, so you can limit the universe of data you receive. Additionally, any data that leaves the room is generally aggregated and anonymized in a way that takes the data outside the scope of the definition of “personal information” under many U.S. state data privacy laws. All those things can make the privacy compliance analysis significantly easier and potentially reduce your compliance burden. But it doesn’t mean you can forgo the analysis.

There are no provisions in the privacy laws that provide a blanket safe harbor to those who use a clean room. The same laws and regulations apply. And clean rooms do involve the use and processing of personal data – e.g., as an advertiser, you may be uploading your first-party data (including customer personal data) into the clean room. Therefore, in considering use of a clean room, you should be conducting the same analysis and asking the same questions you would ask if you weren’t using a clean room, such as: What kind of data is it? How is it being used? What are the data flows? From there you can determine which laws and regulations apply as well as which compliance obligations are triggered – including any specific notice obligations, consent/opt-out rights and requirements for managing access requests. As you run the analysis, you may find that using a clean room will enable you to decrease your compliance burden significantly – but that will depend on the features of the particular clean room and how you are using it. The important thing is, you still need to run the analysis.&nbsp;

So, is a data clean room the one-stop, silver-bullet answer to all of your 2023 privacy woes? Probably not. Is it an effective tool you can use to help achieve your marketing goals while easing the privacy compliance burden? Definitely yes. But as with other technology solutions in this space, you should view the clean room as a tool to help you achieve compliance and not as an excuse to forgo the analysis.

Is a Data Clean Room the Answer to Your Privacy Woes?