IAB privacy choices (National)

IAB privacy choices are categorized as either opt in or opt out and are presented to the end-user so that they can make a decision upon prior to the processing of that data. In this article, we will review the different privacy choices that you can configure for a U.S. Multi-State Privacy (National) vendor list:

• Opt in choice
• Opt out choice

To start, navigate to a U.S. Multi-State Privacy (National) vendor list and select the Privacy Choices Selection tab.

When you select an IAB privacy choice on the Privacy Choices Selection page, you are indicating that the required notice for that data processing activity will be given to all users. As such, we will update the fields related to that category in the gppString to indicate notice has been given.

Opt in choice

Opt in choices are choices presented to the end-user which the end-user has to consent to/opt into prior to the data processing taking place.

Select the Opt In Choice tab from the Privacy Choice Selection section.

If your organization processes any of the following relevant categories pertaining to sensitive data, select the checkbox to the left of Processing of Sensitive Personal Information and select all that apply from Opt In to process the consumer's sensitive data consisting of.

• Personal Data Revealing Religious or Philosophical Beliefs
• Personal Data Revealing Racial or Ethnic Origin
• Personal Data Concerning a Consumer's Health (including a Mental or Physical Health Condition or Diagnosis; Medical History; or Medical Treatment or Diagnosis by a Health Care Professional.)
• Personal Data Revealing Sex Life or Sexual Orientation
• Personal Data Revealing Citizenship or Immigration Status
• Genetic Data for the Purpose of Uniquely Identifying an Individual/Natural Person
• Biometric Data for the Purpose of Uniquely Identifying an Individual/Natural Person
• Precise Geolocation Data
• Consumer's Social Security, Driver's License, State Identification Card, or Passport Number
• Consumer's Account Log-In, Financial Account, Debit Card, or Credit Card Number in Combination with Any Required Security or Access Code, Password, or Credentials Allowing Access to an Account
• Contents of a Consumer's Mail, Email, and Text Messages unless you are the Intended Recipient of the Communication
• Union Membership

Each selected category of sensitive data that is processed by your organization will be collated into a bulleted list in your message and the end-user can either opt into all the categories or none. 

Once configured, the applicable section for the MSPS (either the national section or state-specific section) will set the values for SensitiveDataLimitUseNotice and SensitiveDataProcessingOptOutNotice fields to 1 (i.e. true). Additionally, the categories of sensitive data in the SensitiveDataProcessing array will be set in accordance with the end-user's opt-in choice.

{
...
  "SensitiveDataLimitUseNotice": 1,
  "SensitiveDataProcessing": [
    1,
    1,
    1,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "SensitiveDataProcessingOptOutNotice": 1,
...
}    

Opt out choice

Opt out choices are choices presented to the end-user which the end-user can opt out of prior to the data processing taking place.

Select the Opt Out Choice tab from the Privacy Choice Selection section.

The two choices that end-users can opt out of are:

• Sharing of Personal Information/Targeted Advertising
• Sale of Personal Information

Your organization can select each choice individually if you only do one of the choices or want each option listed separately in your message. Optionally, if your organization engages in both choices, you can choose to list both choices as a single opt-out statement in your message.

Your decision to list each opt out choice individually or combined will be surfaced in your message.

Based on the opt out choices your select, the applicable section for the MSPS (either the national section or state-specific section) will set the values as such:

• Sharing of Personal Information/Targeted Advertising
  • SharingNotice set to 1 (i.e. true)
  • SharingOptOutNotice set to 1 (i.e. true)
  • TargetedAdvertisingOptOutNotice set to 1 (i.e. true)
  • SharingOptOut set based on end-user's choice
  • TargetedAdvertisingOptOut set based on end-user's choice
• Sale of Personal Information
  • SaleOptOutNotice set to 1 (i.e. true)
  • SaleOptOut set based on end-user's choice

//Example of Sale or Share of Personal Information/Targeted Advertising
{
...
  "SaleOptOut": 1,
  "SaleOptOutNotice": 1,
  "SharingNotice": 1,
  "SharingOptOut": 1,
  "SharingOptOutNotice": 1,
  "TargetedAdvertisingOptOut": 1,
  "TargetedAdvertisingOptOutNotice": 1,
...
}