IAB Tech Lab Finalises Data Deletion Request Framework to Streamline Digital Ad Supply Chain Privacy Compliance
Global digital advertising technical standards-setting body IAB Tech Lab has released the final Data Deletion Request Framework (DDRF). The conclusion of two extensive public comment periods marked a significant step forward in addressing consumer data privacy concerns within the digital advertising supply chain.
The Indian government is progressing rapidly toward enacting the Digital Personal Data Protection Act (DPDPA), which aims to establish a robust framework for digital privacy. This Act will necessitate brands and ad agencies to update privacy policies, set up consent mechanisms, and comply with rules on data portability and erasure.
The new Act will require clear consent mechanisms to ensure users understand and agree to how their data is processed. Brands must upgrade their systems for data portability, allowing users to transfer their data between providers effortlessly. Additionally, specific procedures for obtaining consent from parents or guardians for minors and individuals with disabilities will need to be implemented.
Brands and advertising agencies are tasked with enabling users to request data deletion and providing data protection notices in all 22 languages listed in the Eighth Schedule of the Constitution, necessitating significant technical and interface updates. Compliance will incur additional costs, including investments in new technology and personnel.
Jared Moscow, director of product privacy and addressability at IAB Tech Lab, highlighted that the industry has struggled with the need for a standardised solution to manage data deletion requests. The DDRF addresses this challenge directly, offering clear guidance and strategic insights into effectively handling these requests. It provides industry players with the technical tools necessary for efficiently managing data deletion requests.
The DDRF establishes a standardised mechanism for transmitting data deletion request signals throughout the digital advertising ecosystem. It ensures requester authenticity, confirms receipt, and employs cryptographic signatures for authentication. This interoperable framework supports compliance with existing privacy legislation and lays the groundwork for future privacy initiatives within the adtech ecosystem.
The DDRF builds upon IAB Tech Lab’s portfolio of privacy compliance initiatives, which include the Global Privacy Platform, the Accountability Platform, and the Privacy Taxonomy project. Together, these form a foundational framework for streamlining privacy regulatory compliance and advancing responsible data-handling practices in digital advertising.
Several organisations, including Google, Roku, Ketch, Sourcepoint, Dstillery, Raptive, Mediavine, and Index Exchange, played a role in shaping the framework. Jonathan Joseph, head of solutions at privacy compliance provider Ketch, mentioned that the DDRF would bring much-needed efficiency to the ecosystem, automating previously manual processes. John Rosendahl, director of product management at Mediavine, added that DDRF solves critical challenges publishers face in transmitting data deletion requests, reducing technical complexities, and providing the necessary tools to remain compliant.
