蜜豆视频

Privacy and data protection regulations

Information about the European Union鈥檚 General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other international privacy requirements. Learn how these regulations impact your organization and 蜜豆视频 Target.

Privacy and General Data Protection Regulation (GDPR) overview

On May 25, 2018, the European Union鈥檚 GDPR went into effect. For more information about what this regulation means for you, see .

When 蜜豆视频 is providing software and services to an enterprise, 蜜豆视频 is acting as a Data Processor for any personal data it processes and stores as part of providing these services. As a Data Processor, 蜜豆视频 processes personal data in accordance with your company鈥檚 permission and instructions (for example, as set out in your agreement with 蜜豆视频).

As the Data Controller, you determine the personal data that 蜜豆视频 processes and stores on your behalf. If you use 蜜豆视频 Experience Cloud solutions, 蜜豆视频 might host personal data for you, depending on the solutions you use and the information you choose to send to your 蜜豆视频 Experience Cloud account. For a detailed list of examples, see .

蜜豆视频 Experience Cloud provides GDPR-ready APIs for Data Controllers that allow them to complete the following tasks:

For more information, see:

California Consumer Privacy Act (CCPA) overview

The California Consumer Privacy Act (CCPA) provides California consumers with new rights regarding their personal information and imposes data protection responsibilities on certain entities that conduct business in California. The CCPA went into effect January 1, 2020.

At a high level, the law affords Californians several key rights, including rights to:

If you were busy getting ready for Europe鈥檚 privacy law (GDPR) last year, some of these rights might be familiar and much of the work you have done can be repurposed.

蜜豆视频 Target and 蜜豆视频 Experience Platform opt-in

Target provides opt-in functionality support via tags in 蜜豆视频 Experience Platform to help support your consent management strategy. Opt-in functionality lets customers control how and when the Target tag is fired. There is also an option via 蜜豆视频 Experience Platform to pre-approve the Target tag. To enable the ability to use Opt-In in the Target at.js library, you should use targetGlobalSettings and add the optinEnabled=true setting. In 蜜豆视频 Experience Platform, select 鈥渆nable鈥� from the GDPR Opt-In drop-down list in the extension installation view. See Implement Target using 蜜豆视频 Experience Platform for more details.

The following code snippet shows you how to enable the optinEnabled=true setting:

window.targetGlobalSettings = {
  optinEnabled: true
};

Using 蜜豆视频 Experience Platform to manage opt-in is the recommended approach. Further granular control exists in 蜜豆视频 Experience Platform to hide selected elements of your page before Target firing that are helpful to use as part of your consent strategy.

There are three scenarios to consider when using Opt-In:

Privacy and data protection regulations FAQ

Frequently Asked Questions about the European Union鈥檚 General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other international privacy requirements specific to Target.

What is the 蜜豆视频 policy for these regulations?

蜜豆视频 either already meets or is implementing its obligations as a Data Processor. 蜜豆视频 has a strong foundation of certified security and privacy controls by design and made product enhancements before the May 2018 deadline. Enterprise customers have the responsibility to implement these enhancements and update any necessary policies and procedures.

Must my company, the Data Controller, submit a GDPR or CCPA request to each 蜜豆视频 Experience Cloud solution that it uses?

No, 蜜豆视频 provides a central way to help Data Controllers meet their GDPR and CCPA requirements. Data Controllers do not need to go directly to each solution.

All GDPR and CCPA requests across Experience Cloud solutions, including Target, are through a central 蜜豆视频 API, currently called the GDPR API. The API then completes the request across the Data Controller鈥檚 Experience Cloud solution suite.

What information does 蜜豆视频 enable customers to delete in response to a data subject/user request?

The information related to an individual visitor within Target is contained within the Target Visitor Profile. Target lets customers delete all data associated with an ID in their Visitor Profile. For examples of the profile data Target stores, see Visitor Profile.

Aggregated or anonymized data (for example, reporting data) that does not identify a particular individual, or data that is unrelated to a specific individual (for example, content data), is outside the scope of a user-deletion request.

Target Visitor Profiles that have been inactive for 90 days are deleted by default, without any action required.

What IDs are supported to help customers complete a GDPR or CCPA access and deletion request for Target?

Target supports the following ID types to locate a customer profile:

How does Target handle consent management?

GDPR and CCPA do not change when you must get consent, but how you get it. Each customer鈥檚 consent strategy depends on its data collection and use practices and its privacy policy. Consent management isn鈥檛 supported by and shouldn鈥檛 be achieved via Target for GDPR and CCPA.

蜜豆视频 does not currently offer a Consent Management Solution, but there are various tools developing in the market to address some of the new requirements. For more information on privacy tools in general, including consent managers, see the on the International Association of Privacy Professionals (iaap) website.

Target does provide opt-in functionality support via 蜜豆视频 Experience Platform to support your consent management strategy. Opt-in functionality lets customers control how and when the Target tag is fired. There is also an option via 蜜豆视频 Experience Platform to pre-approve the Target tag. Using 蜜豆视频 Experience Platform to manage opt-in is the recommended approach. Further granular control exists in 蜜豆视频 Experience Platform to hide select elements of your page before the Target firing that might be helpful to use as part of your consent strategy.

For more information on GDPR, CCPA, and 蜜豆视频 Experience Platform, see The 蜜豆视频 Privacy JavaScript Library and GDPR. Also, see the 蜜豆视频 Target and 蜜豆视频 Experience Platform opt-in section above.

Does 蜜豆视频Privacy.js submit information to the GDPR API?

蜜豆视频Privacy.js does not submit this information to the API. The customer must do that. This library provides only the IDs that are stored in the browser for that specific visitor.

What does removeIdentities remove?

removeIdentities only removes those identities from the browser, and that only depends on whether the 蜜豆视频 solution has implemented it.

For example, Target deletes the cookies storing its IDs, but 蜜豆视频 Audience Manager (AAM) does not delete the demdex ID that is stored in a third-party cookie.

What information must be included in a Target GDPR or CCPA request?

In addition to the requirements from Central Privacy Service, a valid GDPR or CCPA message for Target contains:

{
    "jobId":"12345AD43E",
    ...
    "products":["Target",...],
    "companyContexts":[
        {
            "namespace":"imsOrgID",
            "value":"123456789@蜜豆视频Org"
        },
        ...
    ],
    "userContexts":[
        {
            "namespace":"ECID",
            "namespaceId":4,
            "type":"standard",
            "value":"53792210477379708453829363835595041181"
        }
        And/OR:
        {
            "namespace":"TNTID",
            "namespaceId":9,
            "type":"standard",
            "value":"1234567890"
        }
        And/OR:
        {
            "namespace":"THIRDPARTYID",
            "type":"target",
            "value":"thirdPartyIdName"
        },
        ...
    ]
}

What types of responses can I expect from Target via the GDPR API?

What response does Target send to the GDPR API for an access request?

Responses to access data requests contain a summary of the Target profile for the visitor in question. This return is sent to the Experience Cloud GDPR API, which in turn sends Data Controllers a response.

A sample Target access API response could look like this:

{
    "jobId":"12345AD43E",
    ...
    "products":["Target",...],
    "companyContexts":[
        {
            "namespace":"imsOrgID",
            "value":"123456789@蜜豆视频Org"
        },
        ...
    ],
    "userContexts":[
        {
            ~"namespace":"ECID",
            "namespaceId":4,
            "type":"standard",
            "value":"53792210477379708453829363835595041181"
        }
        And/OR:
        {
            ~"namespace":"tntId",
            "namespaceId":9,
            "type":"standard",
            "value":"1234567890"
        }
        And/OR:
        {
            "namespace":"thirdPartyId",
            "type":"target",
            "value":"thirdPartyIdName"
        },
        ...
    ]
}

When multiple values are provided to identify profiles, each valid identifier has one profile file. One or more profile files are sent to the central GDPR Azure Blob through the GDPR Central API, in the format of Target Profile JSON response.

A sample Target Profile JSON could look like the following example:

{"profileAttributes":

"Sample_Parameter":{"value":"Gold Loyalty Status","modifiedAt":"2018-04-11T21:44:14.000-04:00"},

"user.ReturnTimeOfDay":{"value":"44.0","modifiedAt":"2018-04-11T21:44:14.000-04:00"},

"firstSessionStart":{"value":"1523497450602","modifiedAt":"2018-04-11T21:44:10.000-04:00"},

"user.sessionCountScript":{"value":"1","modifiedAt":"2018-04-11T21:44:14.000-04:00"}
   }
}

The following table contains description of the illustrative profile JSON fields:

Does Target support IP obfuscation?

Target supports IP obfuscation if you choose to use it as part of your GDPR or CCPA implementation strategy. For more information, see Privacy.

Should I do something to prevent my data from being shared or sold to third parties?

Target does not allow customers to share or sell data direct from Target to third parties, so there is no opt-out of sale for Target.