‘The Google Data Protection Regulation’: GDPR is strafing ad sellers

The vagueness of GDPR has led to wildly different compliance interpretations from businesses. Google has taken a strict consent-based approach to avoid the risk of hefty penalties. Days before the law’s arrival on May 25, Google warned ad tech vendors that rely on demand from Google’s DoubleClick Bid Manager to expect some short-term disruption to European campaigns until Google has integrated fully with the Interactive Advertising Bureau Europe’s GDPR framework — to which Google only publicly confirmed its commitment in the week of the law’s enforcement.

However, media buyers were also informed on the eve of May 25 not to buy via DBM on third-party exchanges, as Google could not verify they are compliant. The consequence was that just hours after the law’s enforcement, numerous independent ad exchanges and other vendors watched their ad demand volumes drop between 20 and 40 percent. But with agencies free to still buy demand on Google’s marketplace, demand on AdX spiked. The fact that Google’s compliance strategy has ended up hurting its competitors and redirecting higher demand back to its own marketplace, where it can guarantee it has user consent, has unsettled publishers and ad tech vendors.

“Everyone is watching the dramatic shift in demand from Google,” said a publishing executive at a national publisher. “The concern we all [publishers] call out is Google’s dominance, which is driving distortion of the market, while they’re lining their own pockets. If you believe the privacy cases that have been launched at Facebook and Google, then they’re not pursuing a path to compliance in all areas, but they are insisting with publishers that they are compliant — that undermines that argument.”

“We have suddenly become even more dependent on Google, while other exchanges are hurting,” said the same exec. “It’s the concern of the last two years playing out. We always said, ‘What happens if Google is the only demand source in the market?'”

An ad tech vendor owner, who has seen a collapse in spend on its platform since May 25, said: “GDPR has, as predicted, become an acronym for Google Data Protection Regulation, such is the level of self-claimed ownership the tech company has over the industry’s ability to respond. We and numerous other smaller tech suppliers are seeing our revenues significantly affected by Google’s last-minute decision to join in. It’s exhausting.”

Google has tried to quash any suspicions in the market that its GDPR policy has been devised for strategic commercial gain. At each of the four meetings Google held with publishers last week in New York; London; Chicago; and Washington, D.C., the tech giant stressed its intention has been only to comply fully with its own interpretation of the law. Afterward, Google published an FAQ document based on questions that arose at the meeting.  At the meetings, Struan Robertson, Google’s senior product counsel, said: “If regulators change or clarify their position on consent versus legitimate interests, we would change our policy,” a statement that was then emailed to attendees the following day.

A Google spokesperson said it contacted ad tech vendors a month prior to the GDPR enforcement date to warn them they’d need consent to work within its ecosystem. “We worked with our third-party exchange partners to develop an interim solution to minimize disruption while we finalize integration with the IAB framework,” the spokesperson added.

A couple of the larger exchanges, AppNexus and Teads, worked out ways to assure Google of their compliance over the first weekend of enforcement, and as such, can still have their targeted ads bought via Google DBM, which is used by most buyers, The Wall Street Journal reported. “We reached out to publishers earlier this week to let them know that despite a couple of days of disruption after the regulation came into effect on [May 25], spend in our marketplace in Europe has largely normalized,” said Steve Truxal, vp of product management at AppNexus. “We have the backing of our largest demand partners, including Google DBM, whose spend is almost back to pre-GDPR levels.”

That’s also helped publishers recover former programmatic revenue drop-offs seen in the first few days of the law’s arrival. But many others are still hurting.

Some publishers that saw their programmatic revenue nose-dive last week said Google account managers haven’t given them enough information about why. “We’re fumbling around in the dark,” said a publishing executive. This publisher determined that the composition of its display ad revenue from Google DBM and another major exchange, The Trade Desk dropped 250 percent on May 30. For some reason, video inventory has been less affected, just single-digit percentage points down. “We’re still trying to figure out why,” said the executive.

Ad operations executives at consumer titles spent the days following the law’s enforcement obsessing over programmatic ad campaign activity. Those that did have seen interesting patterns such as performance-based advertisers, like travel clients, pulling all spend.

One big publisher said it is examining its ad stack intently, watching factors like bid density, to try and understand why its programmatic ad fill rates are still down. “Our fill rate is our main cause of concern, and we believe this is linked to less demand from key [supply-side] partners,” said an executive at the publisher. “We could be anywhere from zero to 25 percent down.”

But even those publishers that have experienced moderate short-term dips are reluctant to count their chickens. GDPR arrived on the Friday before U.K. and U.S. national holidays on May 28 — a time when buyers typically look to offload budget. That fits with some big publishers reporting that brand programmatic ad spending spiked May 27-28, after dipping from May 24, the eve of the law’s enforcement.

There are also differences in how publishers are faring depending on the justification they use to collect visitors’ data. Publishers are divided between those that have tried to abide by GDPR to the letter, prioritizing opt-in consent from users for everything, and those that have relied on opt-outs or legitimate interest. Those that have gone the consent route believe they are getting the raw end of the deal compared to those that have relied on opt-outs or legitimate interest, or simply done nothing and hoped to skim under the U.K. regulator’s radar, according to sources.

One publishing executive is concerned the rest of the supply chain isn’t yet in a position technologically to be able to pass consent information back and forth, which could also be what’s causing a drop in its revenues. Not every publisher has a consent management platform running yet. Those that do aren’t sure the buy side is picking up on when consent is being passed back.

“We think we’re doing the right thing [in being consent opt-in driven], but we may be inadvertently penalized for doing the right thing,” said the executive, “because the publishers that haven’t seen as much of a drop-off are saying they have either not done much [to be compliant] or that they haven’t yet set what they’re doing live yet.”