The five stages of CIPA

1. Oh, no, lawyers! We better put a cookie banner on the site!

This is an understandable reaction because it’s based on what a lot of companies already did for GDPR in the EU. This is only the first stage, though, partly because CCPA+CIPA is fundamentally different legally from ePrivacy+GDPR, but mostly because there’s no California equivalent to Ireland’s Data Protection Commission—which is supposed to be in charge of applying EU privacy law to the Big Tech companies that run their EU operations in Ireland, but doesn’t really do much.

In Europe, Big Tech and their enablers can get away with breaking the law because the fix is in. California, not so much. On privacy, we have three enforcers, not one: the Attorney General, CalPrivacy (our dedicated privacy agency), and attorneys in private practice performing public service. And unlike the way things work in Europe—where a Big-Tech-friendly Irish bureaucrat can block privacy cases or at least delay them for years—none of the California three can block the other two.

2. Oops, better actually hook up the cookie banner so it does something.

You might be surprised how many sites have a really nice “consent” UX but then the third-party tracking runs whether or not the user clicks it.

Or maybe you wouldn’t be surprised, because so much stuff seems broken now. Development teams are understaffed, in the weeds, and trying to vibe-code their way out of it.

What I think may be going on is that sites are doing both cookie banners and services that block AI crawling. And when you run an end-to-end test to make sure that no trackers are loading without consent, the test script is being detected as a bot, so it’s getting the HTTP response that bots get, not the regular page with tracking scripts that users do.

Anyway the next step is to wait for consent to turn the tracking on, and make sure it works.

Basically set one first-party cookie to indicate cross-context tracking mode, and only do the tracking if the user has already opted in.

This is a little tricky because cross-context tracking mode is not just a front-end ticket. It also needs to cover stuff like Custom Audiences and Conversions APIs—which means that you need to check whether cross-context tracking is in effect when a user submits a form, and have a cross-context tracking flag in the CRM so you know not to use that record for server-to-server tracking.

Technically, if you want to get into the legal weeds, the CCPA “opt out of sale or sharing” is different from the CIPA “did not consent to wiretapping.” So, technically, a company that really wanted to over-invest in privacy lawyers could track CIPA “consent to wiretapping” and CCPA “opt out of sale or sharing” separately, and support 2² code paths.

But that’s way too much nerd stuff, and way too confusing. The user research supports more lumping and less splitting: just keep track of cross-context tracking on or off.

If someone declines CIPA consent, assume that’s also the equivalent of a CCPA “do not sell”. And if someone opts out under CCPA, assume they’re also declining consent under CIPA. That’s not just simpler to test and harder to break, it’s also less likely to result in getting dinged for deceptive UX/Dark Patterns. (Yes, adding functionality to try to lower CIPA risk could be adding CCPA risk. The safer approach is to give site visitors the benefit of the doubt and turn off CIPA “wiretapping” for everyone who is entitled to have CCPA “sale” turned off, and the other way around.)

3. Hey, wait a minute, this is California, we have Global Privacy Control

Since Global Privacy Control (GPC) is required anyway, and it’s safer legally and QA-wise to maintain two codepaths, not four, then check GPC up front and give those users the opted out and CIPA safe version of the site.

Coincidence: I am sitting in a cafe right now and it looks like they did this, and did it right. I got on the WiFi captive portal, which was set up pretty slick, integrated with the company main site. A little message about GPC popped up at the bottom of the page, and I checked browser dev tools and things look squeaky-clean as far as both CIPA and CCPA go. (TODO: test this with some other configurations and/or fresh installs. I don’t want to make the claim that someone is already at stage three until I make sure it works. If I can confirm the GPC/CIPA setup is right I’ll link to what they’re using.)

3, continued. What about the customers who actually want cross-context personalized ads?

Right now, people who really want ads that are individually personalized don’t have a lot of great options.

Sitting back, leaving GPC off, and consenting to CIPA wiretapping is a choice that allows the conventional Google and Meta tracking, so is just going to result in more scams, price discrimination, and other forms of adversarial personalization. And those pro-personalization users are still stuck doing CIPA consent manually.

The conventional adtech/martech business gives those pro-personalizaion users a terrible experience. And after all that, if they’re on Apple Safari, some of the personalization they want is going to break anyway because of Blocking Identity Resolution Infrastructure.

There is one option for personalization under user control that does give those personalization-seeking people what they want: Rewarded Interest. A future CIPA-aware Rewarded Interest version could solve CIPA consent—not exactly what the company does for users in the EU, but close enough that CIPA support could be integrated with the Rewarded Interest onboarding process in a pretty slick and legally safe way. Pro-personalization users could install Rewarded Interest once instead of navigating CIPA consent on every site that asks for it.

4. Are we measuring the wrong people?

Here’s the tricky part. The paradox is that

The most engaged, most valuable customers are often the same people who’ve taken the most deliberate steps to make themselves less measurable by conventional ad tech, which means that if you’re an advertiser that is optimizing purely for trackability, you may be underweighting your best customers.

There is already a Measurement Gap between “upper funnel” and “lower funnel” advertising, and the risk of over-emphasizing the most trackable customers just adds to that. Rick Bruner of Central Control suggests more, and more statistically valid, experiments: The Benchmark Advertising Still Needs. It is possible to do “transparent, unbiased, and replicable techniques for measuring incremental advertising impact with experimental design” (see Geo RCT Guide) but valid measurements can’t depend on taking Big Tech’s word for everything.

5. Time to stop selling out customers to Big Tech

The terms on which Big Tech interacts with other companies keep getting more and more one-sided—and rigged against both the users and the legit advertisers. They’re at third stage enshittification for anyone following along at homw

As Big Tech’s villainy level increases, can any “consent” dialog both explain it well enough that people could give informed consent to it, and also not scare them off? The fraction of users who will willingly give Meta and Google the data needed to more effectively scam them is…probably not super high.

Meta just changed their business terms of service so that any business with an account must allow Meta scraping of their web site. Media attorney Matt Topic told Nieman Journalism Lab, This is a remarkable provision to bury in [the] terms of service, given that this would give Meta access to material that would likely cost many millions of dollars in a licensing market. (More on this problem: Legal experts warn Meta’s new terms still grant broad scraping permissions, despite language changes)

And “AI” harm isn’t just about copying sites. Meta’s main use of “AI” is to automatically match ads with people likely to click, which often means matching scammers to victims. Meta earns 10% of revenue from scams directly, but the real impact is higher, because scammers act as shill bidders in Meta’s internal ad auction—driving up ad rates for the legitimate advertisers too.

Google’s system is also increasingly scam-friendly, as the company has adopted more and more one-sided terms over the years. The Google Ads Trademark Policy means that Google no longer enforces trademarks in ads, unless specifically reported. The catch is that Google’s ad system is designed to target the ads to people likely to click, which means it “learns” to hide them from the real trademark holder.

The result is that Google has become a delivery service for malware. The FBI recommends, Use an ad blocking extension when performing internet searches.

Both companies have chosen to take a stand that’s explicitly hostile to legitimate advertisers on their platforms, and enable user harms at a scale that would have been unimaginable in other advertising media. It’s not about “business vs. consumers.” Legitimate businesses and their customers are on the same side.

If we survive these times and their history is written, one of the hardest parts to explain will be Big Tech, and how such transparently criminal organizations grew to such great power and influence.

A future stage 6: We should improve society somewhat.

Getting an individual advertiser out of Big Tech’s racket is a positive move. But to be fair, we’re still going to need to do something about these companies in general.

A conventional FTC breakup is too slow and uncertain. AT&T re-combined, and Microsoft and Google dodged theirs.

Maybe the answer is per-state surveillance licenses. Or maybe (Internet optimism alert) more CIPA cases will do it.

More: CCPA and CIPA on the same site

Bonus links

The Supreme Court Is Leaning Toward a Digital Privacy Victory by Matt Ford. The Supreme Court appeared likely to side with a customer who invoked a semi-obscure federal law to sue Paramount for sharing his personal information with Facebook, during oral arguments on Wednesday, though multiple justices signaled that they might constrain such lawsuits in future cases.

Meta may use sweeping new commercial TOS to avoid millions in AI licensing fees - Ars Technica by Ashley Belanger. (More coverage of the Meta scraping contract. Meta announced the update in a blog, where the company claimed it was simply streamlining its commercial terms.)

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab News coverage: Targeted ads delivered 0-click exploits to install mercenary malware by Dan Goodin. Among the major vendors that listed Discover-Tech as a certified or verified vendor were Google and the advertising industry association IAB Europe. The Israeli firm also used European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union. Discover-Tech has served ads through major networks such as Google, Yandex, and Beeswax. (More: Hey, look over there! Security risk!)

Accenture Tells Employees They Can Now Spend Only $29 on Claude Per Month by Joseph Cox. (Solution: use the $29 to prompt the LLM to go find someone else’s API key that got copied to the wrong place and use that, then be shocked to discover when it “goes rogue.”)

Canada could save millions by developing its own operating system instead of relying on Microsoft Windows by Joshua M. Pearce. The U.S. later passed the Clarifying Lawful Overseas Use of Data Act, which permits American authorities to compel U.S.-based providers like Microsoft, Google, AWS, Amazon and Meta to disclose data within their control, even when it’s stored abroad. This means that even storing data with American companies in Canada does not place it beyond the reach of the U.S. government.