Ad tech vendors offer customers rosy pictures of GDPR compliance
Any ad tech vendor clinging to the notion that legitimate interest alone will render them compliant for the General Data Protection Regulation may need to think of a plan B — and fast.
Less than four months remain until GDPR enforcement, yet confusion remains about compliance and how the regulation will be enforced, at least in some quarters.
It appears that location-based ad tech vendors are among those in the worst pickle, with many claiming loudly that their businesses comply with the GDPR under its “legitimate interest” clause, according to sources. In doing so, they hope to skirt some of the more arduous hurdles around obtaining consumer consent for data use. While some businesses will be able to claim a legitimate interest in using people’s data without having to seek explicit permission, no ad tech vendor that relies on bid-stream data to create segments and audiences can use the legitimate-interest loophole.
But that is indeed what many are doing, according to sources. The lack of detail on how the GDPR will be enforced has lulled some into a false sense of security, which could backfire on them later.
“If a [location] ad tech vendor tells you they can use legitimate interest and they can’t explain why, they’re morons and don’t understand at all what GDPR means,” said one ad tech executive, who spoke on condition of anonymity. Most location vendors that rely on bid-stream data are claiming legitimate interest, with nearly none of them having grounds for doing so, the executive added.
Some agency groups have sent out RFPs for location data, and responses from location vendors have not impressed them regarding plans for making their businesses compliant with the law, according to sources. “They’re [agencies] getting high-level claims of legitimate interest but no real meat on the bones,” said the same executive. “It will likely result in agencies culling [location] vendors.”
Some third-party vendors have appeased agencies, saying they are reducing their dependence on bid-stream data. Regardless, agencies aren’t satisfied. “The feedback you get with [independent] tech providers is way too high-level,” said a senior media agency executive, who preferred to stay anonymous. “They say they’re 100 percent compliant or that they have these ‘high-level’ principles, but they don’t really answer my questions around what levers they have in place to act on the right to be forgotten, for example, or to send me all the ways they process data.”
If the vendors are important partners to this agency group, then they’ll undergo data protection impact assessments to assess whether they’re compliant, according to the same agency executive. “If they’re not important partners, we will drop them.”
To some extent, it’s understandable that some vendors are latching on to legitimate interest as a get-out-of-jail-free card: Details on how the GDPR will be enforced remain broad, leaving companies searching for loopholes. “Companies risk being wiped out partially, if not entirely, and many are fighting tooth and nail, climbing mirrors to avoid the collapse of their commercial relationships, buying time and getting some oxygen while waiting to see what will happen,” said a media executive, who spoke on condition of anonymity.
But the core rules seemingly ignored by vendors assuming they are safe under legitimate interest are clear: A business must balance its interests against an individual’s when determining if it has a legitimate interest in using the individual’s data. Data processing must be necessary, and if other methods of achieving the same result are feasible, then legitimate interest won’t apply.
“Legitimate interest can’t protect people,” said Amir Malik, digital marketing lead at Accenture. “The permission procedure is to remove all ambiguity, and legitimate interest is rigidly defined, so can’t be used as a hack. Consent is ultimately required.”
In short, attempting to hide behind legitimate interest won’t work in the long run. Instead, vendors should be proactive in finding ways to use the GDPR as an opportunity to clean up their processes. “Rather than try to slip through the net of GDPR, the ad tech sector should rather reinvent itself, focusing its energy in developing new solutions that fulfill the need for more genuine, earned and not forced engagement with audiences, serving publishers’ and advertisers’ legitimate interest and not their own,” said Alessandro De Zanche, independent consultant and former News UK executive.
‘We see a world where publisher data replaces third-party data’: News U.K. puts its data at the nucleus of post-cookie push for media budgets
News U.K. has overhauled the way it collects, sorts and monetizes its audience data across all its titles via first-party data platform Nucleus.
Here’s why the loss of the third-party cookie is heading toward a collapse in the middle
In the absence of third-party cookies, marketers will need to work more closely with trusted publishers to reach their audiences. Who will lose out? It is posed for a collapse in the middle.
Member ExclusiveMedia Briefing: What to expect from the Digiday Publishing Summit
This week's Media Briefing previews the upcoming Digiday Publishing Summit, which kicks off on Sept. 27 and will feature speakers from media companies including The Washington Post, BDG, Group Nine Media and Essence.
SponsoredHow retailers can be ready for holiday shoppers this year
Suchi Sastri, managing director and partner, Boston Consulting Group As the holiday season approaches and the pandemic continues to evolve, retailers want to know what to expect. Will e-commerce continue to grow at the rate it did last year? How big of a role will in-store shopping play in holiday shopping? While it’s still early, […]
How the pandemic has been a real a buzz kill for office happy hour bonding, culture
As COVID-19 crawls on, more companies are rethinking the wisdom of mixing booze and the stresses of the workplace.
‘Football has lost its soul’: How Copa90 is repositioning itself around the creator economy
Copa90’s overseers believe there’s another shift happening in tandem with the corporatization of the sport that has the potential to be just as transformative