Amagi is committed to safeguarding the privacy of personal information and complying with applicable data protection laws and regulations.
Several newer state laws such at the California Consumer Protection Act of 2018 (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”), as well as state privacy laws such as the Virginia Consumer Data Protection Act (the “VCDPA”), the Colorado Privacy Act (the “CPA”), the Connecticut Data Protection Act (the “CTDPA”) and the Utah Consumer Privacy Act (the “UCPA”) (collectively, “State Privacy Laws”), give consumers new privacy rights and impose obligations on businesses that collect, use, store or retain a consumer's personal information. Your company has been identified as a customer of Amagi’s ad monetization services and to the extent your company provides or makes available personal information of consumers to Amagi in connection with such business relationship, your company and Amagi are each required to comply with all State Privacy Laws applicable to such activities.
In particular, certain State Privacy Laws require contractual language to be put in place between entities who provide or receive personal information from one another, and further determine that certain advertising activities deem the recipient of the personal information to be a “third party” vis-à-vis the party providing such information. While Amagi has in the past considered itself a “service provider” under the CCPA and a “processor” under other US state privacy laws, it must now adjust its status to that of a “third party” under CCPA/CPRA and a “controller” under other State Privacy Laws. Such adjustment is being made for the following reasons:
- Although Amagi does not “sell” data within the traditional sense of the word, the passing of data by (i) a publisher to Amagi, and (ii) by Amagi to advertising inventory buying partners, could each be deemed a “sale” and/or a “share” under CCPA/CPRA, and a “sale” under other State Privacy Laws, because:
- Partners who purchase advertising inventory from Amagi (“Buyers”) may engage in certain ad-targeting activities in their use of the personal information they receive (i.e., cross-context behavioral advertising/targeted advertising, which constitutes a “share” of personal information under CCPA/CPRA).
- Buyers pay for advertising inventory after they win an auction for, or otherwise purchase, such inventory, and such payment may fulfil the “monetary or other valuable consideration” element contemplated by State Privacy Laws in order for a “sale” to take place.
The continued characterization of Amagi as a “service provider” or “processor” would thus conflict with Amagi’s role under evolving State Privacy Laws; therefore, Amagi must be classified as a “third party” and a “controller” for ad monetization services.
Additionally, as related to your company’s provision of data to Amagi that falls within the definition of “personal data” under the European General Data Protection Regulation (“GDPR”), and based on the adoption by the UK of the 2021 EU model clauses (“New SCC”) and release of the 2022 UK International Data Transfer Addendum regarding the transfer of EU/EEA personal data outside the EU/EEA (following the Schrems II decision by the Court of Justice of the European Union) (the “IDTA”), Amagi is reaching out to its customers and suppliers to ensure that any relevant cross-border data transfers are compliant with such rulings and guidance. European data protection law requires that all contracts using older 2010 SCCs must be updated to use the New SCCs, and that the IDTA also be used for transfers of personal data out of the UK to third countries. Additionally, Amagi has clarified its status as that of a “controller” for ad monetization purposes under European data protection laws in order to more accurately reflect its role in the ecosystem and to maintain consistency with its adjusted position under State Privacy Laws.
Accordingly, we have updated our Data Processing Addendum (“DPA”) to incorporate the new requirements under State Privacy Laws and European data protection laws. In order for Amagi to continue to provide ad monetization services to your company, we require that you please review and execute the updated DPA by no later than May 31, 2024. In order to ensure our mutual compliance with Data Protection Laws, if we have not received a response from you on or before May 31, 2024 we will deem your silence as your acceptance of the terms of the updated DPA.
If you have any questions at all, please feel free to reach out to legalrequests@amagi.com. We thank you for your continued partnership.