Publishers, ad tech firms scramble to comply with GDPR
On April 25 — a month before GDPR takes effect — the Interactive Advertising Bureau Europe and IAB Tech Lab officially released a framework for publishers to ask if it is OK for the publisher and their ad tech vendors to collect and use people’s data. The framework is meant to maintain the status quo of targeted online advertising while abiding GDPR’s transparency rules and preparing for ePrivacy’s consent decree.
But publishers balked at the initial framework, saying it wasn’t transparent enough about how vendors would use the data. Quantcast, along with some publishers in the GDPR Implementation Working Group had “major concerns because they understand that they are liable for everything and wanted to make sure that we were closing loopholes,” said Somer Simpson, product lead at ad-measurement firm Quantcast and a member of the working group.
So a week after releasing the official framework, IAB Europe and IAB Tech Lab released an update that clarified what vendors would do with publishers’ audience data and gave publishers more control over which vendors could access that data.
The updated framework forces vendors to disclose to publishers and, by extension, to publishers’ audiences if they’ll use the data collected from someone visiting a publisher’s site to target them with ads on other sites or apps, or to personalize the content they’re shown on those other sites or apps. Specifically, vendors have to list that use as one of five so-called “purposes” — up from the original four purposes — they can cite when asking for a publisher’s audience data.
“This is mainly driven by requests from publishers because a few of them felt like the original four purposes were bundling too much, which is kind of an anti-GDPR approach,” said Simpson.
Issues remain with IAB Europe’s framework. Most glaringly, the official version of the updated framework won’t be released until after GDPR takes effect. The framework is designed to evolve as the regulation itself evolves in Europe and beyond, said Alice Lincoln, vp of data policy and governance at MediaMath and chair of IAB Europe’s Working Group on Consent. She said more updates will occur to the framework after the May 25 deadline to give publishers additional control.
But it’s unclear how much control publishers would actually get. Publishers can stipulate which vendors are allowed to use their data and condition that access based on what vendors say they plan to do with the data, but it’s more of a request than a requirement or, as Simpson put it, “a strongly worded suggestion.” The framework operates under an honor code, in the same way that Do Not Track (R.I.P.) did. “This requires every vendor to be able to understand and honor the signal, but a publisher can’t actually stop that,” said Simpson.
The flimsy control is made more problematic to publishers by the fact that vendors can claim to be able to use people’s data without consent by asserting they have a “legitimate interest” to do so. But no one knows if the legitimate-interest loophole covers any advertising-related usage of people’s data.
“There’s conflicting legal advice on legitimate interest and whether it applies to advertising at all,” said John Potter, chief technology officer of Purch and member of IAB Tech Lab’s GDPR Technical Working Group.
Regulators have largely left legitimate interest as an open question, and to the extent they have answered it, those answers can vary by regulator. “Different countries within the EU have different definitions for legitimate interest. So not only is it a subjective interpretative piece of legislation, but that subjectivity is slightly more extreme by market,” said Andrew Casale, CEO of Index Exchange.
Despite the lack of certainty, as of press time, 52 of the 99 vendors participating in IAB Europe’s framework claim legitimate interest for at least one of the ways they plan to use people’s data, according to a Digiday analysis. And 21 of the vendors claim legitimate interest for using the data to target ads and personalize content when someone uses a site or app other than the one the person had given consent to collect and use their data.
“Me deciding whether another company has a legitimate interest, it doesn’t really work that way,” Lincoln said. “I can have my own opinion about it, and based on that, recommend whether we work with a company or not. But to determine to whether they quote-unquote really have it, it’s not that black and white.”
Despite the uncertainty involved in complying with GDPR by the deadline, the largest leap of faith by many publishers and ad tech vendors may be the idea that the deadline is not a hard one.
“From a pure regulation standpoint, there is no requirement to be fully ready on the 25th of May,” said Romain Job, chief product officer at ad tech firm Smart. “Regulators have been saying in different occasions that they will allow some time for companies to comply with the GDPR. What they want to see is that everyone has some initiative going in the right direction.”
Download Digiday’s complete guide to GDPR.
Pinterest testing new co-sold, revenue-share ad model for publishers with Tastemade
Currently in an experimental phase, Tastemade is the first publisher to sign on and the brand that is funding this ad experiment is corn chip snack Fritos.
As publishers clean up automated supply chains, education-title Chegg cut ad resellers and saw no negative impact on revenue
"We were told as publishers that resellers were so important, but no [publisher] has communicated to me they removed resellers and lost X% lift."
Member ExclusiveThe Facebook ad boycott could help publishers swing the pendulum back to context
Publishers have a golden opportunity to shift thinking around the role context, broadly defined, should play in advertising.
SponsoredFour ways to adapt to the changing publisher ecosystem in 2020
By Neal Sinno, general manager Americas at GeoEdge For marketers, 2020 started out with so much promise — but this changed rapidly as the industry faced a global epidemic head-on. Not only did our own daily routines come to a screeching halt, for many of us our professional lives did as well. Almost as quickly […]
Patagonia: Boycotting Facebook ads will lead to an ‘even more thoughtful approach’ to its ad buying
Patagonia has pulled all paid ads from Facebook and Instagram until at least the end of July. The boycott will extend if the advertiser has seen three specific changes to how the social network handles hate speech.
How Substack has spawned a new class of newsletter entrepreneurs
As the media ecosystem contracts amid coronavirus, Substack has been thrust into an uncomfortable role — that of a savior.