CCPA Notice

Executive Summary:

• In CCPA terms, Pepperjam is a “service provider” to our client, the advertiser. We are contractually bound to use, disclose and retain any personal information we collect only on behalf of the advertiser for whom we collect it. That advertiser owns the data.
•  
• Pepperjam tracks the user only if and when the user clicks on the advertiser’s ad on the publisher partner’s site. This tracking is not a “sale” of personal information under the CCPA because it qualifies for the first exception in the CCPA’s definition of that term:

“For purposes of this title, a business does not sell personal information when: (A) A consumer uses or directs the business to intentionally disclose personal information or uses the business to intentionally interact with a third party, provided the third party does not also sell the personal information, unless that disclosure would be consistent with the provisions of this title. An intentional interaction occurs when the consumer intends to interact with the third party, via one or more deliberate interactions. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumer’s intent to interact with a third party.” Cal. Civ. Code 1798.140(t)(2).

When the user clicks on the advertiser’s ad, the user is using the publisher partner to intentionally interact with the advertiser (on whose behalf Pepperjam collects the data). Pepperjam’s agreements with advertisers prohibit them from handling the data (or any other aspect of the service) in a manner inconsistent with, or in violation of, any laws, including the CCPA.

• Pepperjam’s sole service is (i) allowing participating publisher partners to display ad creative from participating advertisers, and (ii) facilitating the advertiser’s payment to the correct publisher partner if a user clicks on the ad and then makes a purchase (consistent with payment eligibility rules).
•  

The Process:

In more detail, here is the user’s journey:

Step one: User sees the ad

A user sees an ad from a participating Pepperjam advertiser on a participating publisher partner’s website.  Pepperjam doesn’t personalize or behaviorally target that ad. Pepperjam does not read or write any cookies, and does not track the user, at this stage of the process, even if the user hovers over, mutes, pauses, or closes the ad.

Step two: The click and momentary visit to interstitial page

If — and only if — the user clicks on the ad, Pepperjam will begin to track the user. After the click, the user is momentarily taken to an interstitial page hosted by Pepperjam on behalf of the advertiser. During that transition process, Pepperjam logs the following on behalf of the advertiser:

• Click Date – Date/time that the click occurred (used for accounting)
• Referrer URL - The URL of the publisher partner page that contained the ad (used for accounting)
• User Agent - User agent description of customer’s device/application (used for device level reporting and commissioning capabilities)
• IP address - IP address of the user (used for fraud detection and prevention)
• SID - String used for tracking/attribution of the potential purchase driven from that ad.

On the interstitial page, Pepperjam also checks to see if the browser contains a Pepperjam cookie that Pepperjam previously set for that advertiser. If not, Pepperjam writes a cookie to the user’s browser that contains the following data point:

• Consumer ID – Randomly assigned ID of the user that Pepperjam uses for that advertiser to tie that advertiser’s clickstreams together for transactions.

As described in the executive summary above, this data collection is not a “sale” by the publisher partner because it happens through the user’s intentional interaction with the advertiser on whose behalf Pepperjam hosts the interstitial page and collects the data.

The interstitial page then redirects the browser to the advertiser’s landing page (and Pepperjam logs the specific landing page to which the browser is routed).

Step three: Arrival on the advertiser’s landing page

The user arrives at the advertiser’s site, which contains integrations with Pepperjam. Pepperjam logs the following information:

• Click ID - Unique ID assigned by Pepperjam to each click record generated from an ad.
•  

Step four: Purchase

When the user makes a purchase attributed to the ad, the advertiser sends Pepperjam a record of what was purchased, the prices of each item, the total price, and an indication of whether the user was a new or returning purchaser. Pepperjam never receives identifying information such as names, contact information, shipping information, payment card numbers, or usernames.

Step five: Payment and accounting

On behalf of the advertiser, Pepperjam provides the publisher partner with the agreed commission for the purchase, along with supporting information for auditing and accounting (the transaction information described above and, if applicable, the SID). 

Additional CCPA Points:

Publisher partners and advertisers should not send “do-not-sell” requests to Pepperjam. Because we don’t sell personal information, there is nothing for us to do with these requests.

Publisher partners also should not send us other CCPA requests, such as requests for a copy or deletion of personal information. When publisher partners receive such requests from their users, those requests should apply only to personal information held by or on behalf of the publisher partner. Pepperjam does not hold any personal information on behalf of publisher partners. Neither do advertisers. Pepperjam is a “service provider” to the advertiser, not to the publisher partner. 

Advertisers that require assistance with CCPA requests can contact Pepperjam at privacy@pepperjam.com. 

Individuals who wish to make CCPA requests with respect to the data that Pepperjam holds on behalf of an advertiser should contact the advertiser.