On January 1, 2020, the California Consumer Privacy Act of 2018 (CCPA) has entered into effect.
At Fyber, we invest great effort to ensure that our products and services comply with legislative and regulatory requirements and were an early adopter of CCPA. For that purpose, we have created this CCPA resource page to provide you with information about Fyber’s compliance efforts with the CCPA. Our resource page includes terms defined by the CCPA which we have capitalized throughout this page so you can easily identify them.
PUBLISHERS
If you are connected to a Fyber service as a publisher, we have executed with you a commercial agreement and a data protection addendum that describe the service that Fyber provides you and instruct Fyber to process personal data, on your behalf, as part of Fyber’s provision of the service to you. For the purposes of the CCPA, the data that Fyber Collects on behalf of its publishers may include Personal Information. In this context, you are a Business and Fyber is your Service Provider.
Your sharing of Personal Information related to your Consumers with Fyber, and Fyber’s Collection of Personal Information related to your Consumers, are done strictly and as necessary to facilitate Fyber’s provision of the service to you.
In consideration for providing the service to you, Fyber pays you a share of the revenue collected by Fyber from relevant demand partners (advertisers, DSPs, ad networks, etc.) for the purchased advertisement space inventory on your mobile application pursuant to the terms of your agreement with Fyber. Fyber does not receive from you and you do not pay Fyber any monetary or other valuable consideration for making Personal Information available to Fyber.
FYBER FACILITATES IT’S PUBLISHERS COMPLIANCE WITH THE CCPA:
Fyber’s SDKs allow publishers to technically ‘announce’ when a user has opted out of the sale of personal information.
Fyber further supports the IAB’s CCPA Compliance Framework, accordingly, Fyber enables the ‘US Privacy String’ as defined by the IAB for the entire ad tech industry. This allows publishers to instruct Fyber which users chose to be opted out of the sales of personal information.
If you wish to provide your Consumers with a “Do not sell my personal information” option on your application or website Homepage, then following your notification to us, Fyber will cease Collecting, using and sharing, on your behalf, Personal Information related to the opted-out Consumers, except for permissible uses under the CCPA. It is your sole responsibility and liability, as a Business, to decide if the opt-out option is required, pursuant to the CCPA and to instruct Fyber accordingly. Fyber will pass the out-out signal or the ‘US Privacy String’, as applicable, to its demand partners and expect them to respect users’ choice and not use the personal information for ad targeting purposes, in compliance with CCPA.
Fyber requires its publishers to agree to Fyber’s CCPA Addendum for Publishers.
PUBLISHER’S FAQs:
Can Fyber identify if the user is a California resident?
No. It is the publisher’s obligation under the CCPA to verify that the user is a California resident. Fyber does not have the data or the ability to determine the residency status of the publisher’s users.
What happens if the user’s preferences changes?
Fyber will be able to ingest updated US Privacy String or opt-out signal from the publisher and pass the new values to our demand partners. In short, publishers are responsible for updating such string/signal to indicate the change in the user’s opt-out status, Fyber’s role would be to pass the signal or string onward to its demand partners.
Does Fyber plan on signing the IAB’s Limited Service Provider Agreement (“LSPA”)?
The LSPA is a legal agreement that includes obligations taken by publishers and by downstream participants in a programmatic auction (except for the publisher). Under the LSPA, downstream participants act as a Service Provider under the CCPA whenever a California user opts-out from a “Sale” of his/her Personal Information. As Fyber acts as a Service Provider at all times (even when the user has not opted-out) Fyber does not need to sign the LSPA but has no objection to do so.
Does Fyber support the IAB’s CCPA Compliance Framework?
Yes, Fyber supports the IAB’s CCPA Compliance Framework and has been implementing the IAB Tech Lab CCPA technical specification for OpenRTB. The IAB’s CCPA specifications require that Fyber gives all publishers the ability to communicate to Fyber when a California resident has opted-out of Personal Information processing for ad targeting purposes. Publishers will be given the opportunity to pass Fyber a signal containing information about your user’s opt-out choice, via a simple string – the U.S Privacy String. Fyber will pass the U.S Privacy String to its RTB demand partners.
What does Fyber do when a user has opted-out of a Sale?
Whether the transfer of personal information for ad targeting purposes constitute a sale of personal information under the CCPA is not for Fyber to decide. This is a decision that publishers should make. Fyber is operationally ready to pass the US Privacy string to demand partners so that demand partners know that they may not use the personal information for ad targeting purposes. Fyber anticipates that demand partners will only provide contextual ads in this case or decide not to buy the specific ad impression. Fyber and Demand partners may still use the personal information of an opted-out user for fraud prevention and detection and operational purposes such as capping and measurements.
DEMAND PARTNERS
Services: Fyber Marketplace; Fyber FairBid Mediation; Programmatic Mediation:
As a Fyber demand partner, you have executed with us a commercial agreement and a privacy and information security addendum or a data processing addendum that describe Fyber’s service. The agreement and addendum also set the terms for your use of Personal Information related to users that Fyber makes available to you, so that you could purchase ad inventory on Fyber publishers’ mobile applications and serve targeted or contextual advertisements to them.
Under the General Data Protection Regulation (GDPR), Fyber is a data processor on behalf of its publishers.
FYBER’S PROCESSOR POSITION DOES NOT LIMIT YOU from processing such personal data based on your independent lawful ground of processing such data as an independent data controller. In a similar manner, under the CCPA, Fyber, as a Service Provider of its publishers, makes Personal Information available to you via the Fyber service, so that you could purchase the advertisement space inventory on Fyber’s publishers’ mobile application and serve targeted advertisements. According to your commercial agreement with Fyber, you pay Fyber the purchase price of such advertisement space inventory, advertisement impression or a fee for using such service, to facilitate the serving of your ads on the publishers’ advertisement space inventory.
You do not pay Fyber or provide Fyber with any other valuable consideration for the making of Personal Information available by Fyber to you, to support Fyber’s position as the publisher’s Service Provider.
Under the CCPA Addendum, you are requested to make sure that you use the Personal Information that Fyber transfers to you, strictly as necessary to facilitate Fyber’s function as a Service Provider on behalf of Fyber’s publishers-customers. Fyber’s agreement with you, including the CCPA Addendum, does not limit you from using Personal Information related to your own Consumers, as a Business or a Third Party, subject to the provisions of the CCPA.
Services: Fyber Offer Wall Edge or Fyber Direct Sales Service
When using the Fyber Offer Wall Edge or the Fyber Direct Sales Service, you may make Personal Information of your Consumers available to Fyber. Fyber needs your Consumers’ Personal Information to prepare and send you the action-based invoices, to follow your instructions not to send ads to specific Consumers’ devices, to send you fraud related reports and for Fyber’s Operational Purposes associated with the service. In this context, you are a Business and Fyber is your Service Provider.
Your sharing with Fyber of Personal Information related to your Consumers and Fyber’s Collection of Personal Information related to your Consumers, are done strictly and as necessary to facilitate Fyber’s provision of the service to you.
You pay Fyber fees in consideration for using the Fyber Offer Wall service for user acquisition by the delivery of your offers/advertisements, in accordance with the business model and terms of your agreement with Fyber. Fyber does not pay you and you do not receive from Fyber any monetary or other valuable consideration for transmitting Personal Information related to your Consumers to Fyber.
If you wish to provide your Consumers with a “Do not sell my personal information” option on your application or website’s Homepage, then following your notification, Fyber will cease Collecting and using on your behalf Personal Information related to the opted-out Consumers, except for permissible uses under the CCPA. It is your sole responsibility and liability, as a Business, to decide if the opt-out option is required, pursuant to the CCPA and to instruct Fyber accordingly. Fyber requires its demand partners as applicable to agree to Fyber’s CCPA Addendum for Demand Partners.
CONSUMER RIGHTS
Fyber will follow your instructions to delete Personal Information, according to the deletion details that you transfer to us together with the deletion request (e.g. a specific Ad ID), following a Verifiable Consumer Request, unless Fyber concludes that it is necessary for Fyber to maintain such Personal Information for one or more permitted purposes under the CCPA (for example, to detect fraudulent or illegal activity or to prosecute those responsible for these activities).
As a Business, it is your responsibility to send us Verifiable Consumer Requests only and it is your discretion whether to accept or deny any deletion request, based on the provisions of the CCPA.
What should you do if you receive a deletion request?
There are some cases where the user may request to exercise his/her rights under CCPA and have, for example, his/her Personal Information deleted. However, as a Service Provider under the CCPA, Fyber will ask the user to send such request directly to the applicable Business. If you, as a Business, receive such request, you may forward it to us and we will delete the relevant Personal Information as instructed by you. Please send your Consumers requests to: [email protected].
DEMAND PARTNER’S FAQS
How does Fyber facilitate its demand partner’s compliance with the CCPA?
Fyber supports the Digital Advertising Alliance (DAA) green AdChoice icon mechanisms that allow Consumers to opt out of the sale of their Personal Information as required by the CCPA. If you wish to include the green AdChoice icon on your advertisement/offer, please email your Fyber account manager.
What is Fyber doing on the demand side to support the IAB’s CCPA framework?
When Fyber receives a US Privacy String from a publisher, we will pass it to our demand partners on the bid request through a custom extension or through a url parameter (non-RTB), as applicable.
CCPA-Adapted Privacy Policy
Fyber introduced an update to its privacy policy to support the applicable disclosure requirements under the CCPA. The updated policy is available at https://www.fyber.com/privacy-policy/