Staying CCPA Compliant with Facebook's Limited Data Use

Facebook has recently released a feature called Limited Data Use (LDU) to give business more control over how their data is used and to better support efforts to meet compliance with CCPA.

The LDU feature will allow businesses to exercise more control over how their data is used in Facebook’s systems. This new feature will most significantly affect Facebook ad buyers and marketing performance. 

Between July 1 and July 31, 2020, the LDU will be automatically enabled on all Facebook business accounts. From July 31,2020 onward, businesses will be required to update their pixel to include an LDU parameter. 

In short, the LDU feature works by automatically detecting if a user is in California and then limiting the way that their user data can be stored and processed.

CCPA Background

The LDU is designed to help business with CCPA compliance, so below is a brief overview of the relevant CCPA requirements:

  1. Businesses must be transparent about what data they collect, the purpose for it, and any third parties it may be shared with.

  2. A business must delete the data if requested by the user.

  3. Consumers can opt out of their data being sold through a “Do Not Sell” button or link on a website.

Businesses that target residents of California must comply with the CCPA. So, if your business markets to California residents on Facebook you must ensure compliance, or your business may face liability and potential penalties.

To Implement Facebook LDU

Data Processing Fields

Field
Description
Data Processing Optionstype: array

Processing options you would like to enable for a specific event. Current accepted value is LDU for Limited Data Use.

The name of this field can be presented differently, depending on the API and implementation you are using. For example, this is dataProcessingOptions for a Pixel JavaScript call, but data_processing_options for a Server-Side API call. Please see the example calls below.

An empty array can be sent to explicitly specify that this event shouldn't be processed with the Limited Data Use restrictions.

Data Processing Options Countrytype: integer

Optional for most APIs.

A country that you want to associate to this data processing option. Current accepted values are 1, for the United States of America, or 0, to request that we geolocate that event.

Notes:

This field is required for Offline Conversions during the Transition Period stated above or if you send LDU under data_processing_options.

This field is required for Server-Side API if you do not provide an IP address during the Transition Period stated above or if you send LDU under data_processing_options.

Data Processing Options Statetype: integer

Optional for most APIs.

A state that you want to associate to this data processing option. Current accepted values are 1000, for California, or 0, to request that we geolocate that event.

Notes:

If you set a country, you must also set a state. Otherwise, we apply our geolocation logic to the entire event.

This field is required for Offline Conversions during the Transition Period stated above, if you send LDU under data_processing_options.

Note that geolocation is currently unavailable for this API.

This field is required for Server-Side API during the Transition Period stated above, if you send LDU under data_processing_options and do not provide an IP address.

Browser Pixel

Update pixel initialization code to specify the dataProcessingOptions method before you call fbq('init').

To explicitly not enable LDU mode, use:

CODE 
fbq('dataProcessingOptions', []); fbq('init', '{pixel_id}'); fbq('track', 'PageView');

If you want use Facebook to geolocate, you will add the following to your Facebook Pixel deployment:

CODE 
fbq('dataProcessingOptions', ['LDU'], 0, 0);
Note:

We recommend using this approach.

To enable LDU and specify user geography:

CODE 
fbq('dataProcessingOptions', ['LDU'], 1, 1000);

Image Tag

Add the following to the Pixel image tag:

dpo: data processing options

dpoco: data processing options country

dpost: data processing options state

See the above table for data processing definitions.

To explicitly not enable LDU mode, pass an empty value for the 'dpo' parameter:

JSON 
<img src="https://www.facebook.com/tr?id={pixel_id}&ev=Purchase&dpo=" />

To enable LDU with Facebook geolocation:

JSON 
<img src="https://www.facebook.com/tr?id={pixel_id}&ev=Purchase&dpo=LDU&dpoco=0&dpost=0" />
Note:

We recommend using this approach.

To only enable LDU for users who have made a request to ‘Opt-out of the Sale of Personal Information’, use the OneTrust CMP in coordination with the snippet below.

<script type="text/javascript"> // Create a global variable and set the string ‘LDU’. This means the default is to have the FB pixel initiated with the limited data processing on, knowing this will only affect Californians var pixelLDU = 'LDU'; function OptanonWrapper() { // Updates the global variable based on whether or not the cookie category Id active // Note: replace ',C0004,' with whichever category you wish to match to enabling/disabling FB LDU mode if (OptanonActiveGroups.indexOf(',C0004,') == -1) { console.log('Limited Data Processing'); } else { console.log('No Limits'); pixelLDU = ''; } } </script> <!-- OneTrust Cookies Consent Notice end --> <!-- Facebook Pixel Code --> <script> … // Initiates the FB pixel to do the geolocation lookup itself and only enable LDU if the consumer has opted out of the sale of personal data fbq('dataProcessingOptions', [pixelLDU], 0, 0); fbq('init', {pixel_Id}); fbq('track', 'PageView'); </script> … <!-- End Facebook Pixel Code -->

To enable LDU and specify user geography:

JSON 
<img src="https://www.facebook.com/tr?id={pixel_id}&ev=Purchase&dpo=LDU&dpoco=1&dpost=1000" />