CTV Advertising Strategies:

Insights from CTV leaders at Dentsu, Horizon Media and more

SECURE YOUR SEAT

The Washington Post scrapped many programmatic tools to comply with GDPR

the washington post

The Washington Post went hard to make sure that programmatic advertising didn’t compromise its ability to comply with the General Data Protection Regulation. For European site visitors, the newspaper publisher stopped selling personalized ads through Google’s ad exchange and, for ads that the Post sold directly, it stopped using a third-party ad server to serve those ads. It shut off its data management platform and disabled all header bidding.

“We got rid of basically everything,” said Jason Tollestrup, vp of programmatic strategy and yield at the Post, at Digiday’s Programmatic Media Summit in Scottsdale, Arizona.

Months after the GDPR took effect, little has changed because there remains little indication of how exactly publishers are supposed to comply with the regulation.

“I’m needing the regulators to come in and comment at this point,” Tollestrup said, echoing a common sentiment among publishers in attendance.

Without much clarity for comfort, the Post has maintained its conservative programmatic advertising strategy in Europe. It still has Google’s ad exchange in non-personalized mode, and it still doesn’t allow third-party ad serving.

A major reason the Post has not turned programmatic back on “is because I’m still working through the contracts,” said Tollestrup. It’s not only contracts with programmatic technology vendors that need sifting through but also with advertisers.

Advertisers increasingly want to use their own first-party data to target ads on publishers’ sites. That’s fine in the U.S., but it’s problematic in Europe because of the position it puts publishers in. If an advertiser sends its data to a publisher to target ads on the publisher’s site, the publisher technically becomes the “processor,” a GDPR term that means the publisher cannot do anything with that data other than what the company providing the data has specified. But the “processor” label can be even more burdensome. “If you’re labeled as a processor, they basically have control over every part of your business — the vendors you select, every part of the business,” Tollestrup said.

The Post has pushed back against accepting the “processor” label in the same way it has pushed back against running personalized ads in Europe on the basis of GDPR’s legitimate interest clause, one of GDPR’s most glaring gray areas that companies have embraced to use people’s personal data without first obtaining consent. Other publishers have invoked legitimate interest to continue targeting ads to European visitors, and that has led agencies to pressure the Post to do the same.

“My sales team has to go out in the market, and agencies say, ‘Why don’t you third-party ad serve when this person does?’ or ‘Why don’t you allow personalized targeting when this person does?’” said Tollestrup.

In addition to disabling personalized advertising for European visitors, the Post gave those visitors the option of disabling advertising altogether. In May 2018, the publisher introduced a subscription tier for European visitors to pay $90 a year to visit the site without being shown ads or having their data tracked. People are still signing up for the GDPR-related subscription product. “Definitely not as much as general subscriptions, but there is an appetite for it in the marketplace,” Tollestrup said.

https://digiday.com/?p=312427

More in Media

Digiday+ Research: Publishers pull back their dependence on digital revenue

After a year in which publishers shifted their revenue dependence away from traditional channels and toward digital channels, 2025 has seen a shift back toward more of a balance between traditional and digital revenue sources.

LinkedIn makes it easier for creators to track performance across platforms

Creator data is becoming more accessible to third-party vendors via a new API — another step in LinkedIn’s creator platform evolution.

Ad Tech Briefing: The ‘plumbers’ posing as the unlikely saviors of the internet

After several false dawns, can Cloudflare’s ‘anti-AI scraping tool’ finally offer publishers a road to commercial redemption?