“For purposes of this title, a business does not sell personal information when: (A) A consumer uses or directs the business to intentionally disclose personal information or uses the business to intentionally interact with a third party, provided the third party does not also sell the personal information, unless that disclosure would be consistent with the provisions of this title. An intentional interaction occurs when the consumer intends to interact with the third party, via one or more deliberate interactions. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumer’s intent to interact with a third party.” Cal. Civ. Code 1798.140(t)(2).
When the user clicks on the advertiser’s ad, the user is using the publisher partner to intentionally interact with the advertiser (on whose behalf Pepperjam collects the data). Pepperjam’s agreements with advertisers prohibit them from handling the data (or any other aspect of the service) in a manner inconsistent with, or in violation of, any laws, including the CCPA.
In more detail, here is the user’s journey:
Step one: User sees the ad
A user sees an ad from a participating Pepperjam advertiser on a participating publisher partner’s website. Pepperjam doesn’t personalize or behaviorally target that ad. Pepperjam does not read or write any cookies, and does not track the user, at this stage of the process, even if the user hovers over, mutes, pauses, or closes the ad.
Step two: The click and momentary visit to interstitial page
If — and only if — the user clicks on the ad, Pepperjam will begin to track the user. After the click, the user is momentarily taken to an interstitial page hosted by Pepperjam on behalf of the advertiser. During that transition process, Pepperjam logs the following on behalf of the advertiser:
On the interstitial page, Pepperjam also checks to see if the browser contains a Pepperjam cookie that Pepperjam previously set for that advertiser. If not, Pepperjam writes a cookie to the user’s browser that contains the following data point:
As described in the executive summary above, this data collection is not a “sale” by the publisher partner because it happens through the user’s intentional interaction with the advertiser on whose behalf Pepperjam hosts the interstitial page and collects the data.
The interstitial page then redirects the browser to the advertiser’s landing page (and Pepperjam logs the specific landing page to which the browser is routed).
Step three: Arrival on the advertiser’s landing page
The user arrives at the advertiser’s site, which contains integrations with Pepperjam. Pepperjam logs the following information:
Step four: Purchase
When the user makes a purchase attributed to the ad, the advertiser sends Pepperjam a record of what was purchased, the prices of each item, the total price, and an indication of whether the user was a new or returning purchaser. Pepperjam never receives identifying information such as names, contact information, shipping information, payment card numbers, or usernames.
Step five: Payment and accounting
On behalf of the advertiser, Pepperjam provides the publisher partner with the agreed commission for the purchase, along with supporting information for auditing and accounting (the transaction information described above and, if applicable, the SID).
Additional CCPA Points:
Publisher partners and advertisers should not send “do-not-sell” requests to Pepperjam. Because we don’t sell personal information, there is nothing for us to do with these requests.
Publisher partners also should not send us other CCPA requests, such as requests for a copy or deletion of personal information. When publisher partners receive such requests from their users, those requests should apply only to personal information held by or on behalf of the publisher partner. Pepperjam does not hold any personal information on behalf of publisher partners. Neither do advertisers. Pepperjam is a “service provider” to the advertiser, not to the publisher partner.
Advertisers that require assistance with CCPA requests can contact Pepperjam at firstname.lastname@example.org.
Individuals who wish to make CCPA requests with respect to the data that Pepperjam holds on behalf of an advertiser should contact the advertiser.