‘It’s impossible’: Google has asked ad tech firms to guarantee broad GDPR consent, assume liability

In signing Google’s consent guarantee agreement, the exchanges and SSPs as well as their respective publishers would assume liability for any corresponding GDPR violations that Google’s DBM is charged with, the execs said. Under the GDPR, any company found violating the law can be fined up to 4 percent of its annual revenue.

Google is asking that the exchanges and SSPs guarantee that their publishers have received consent for each of the roughly 200 vendors on Google’s commonly used vendor list. The ad tech platforms can compromise by creating their own whitelist with a subset of those vendors that they provide to Google, according to the execs. In either case, Google will assume that any exchange or SSP requesting personalized ads from DBM has received consent for all of the vendors on the respective whitelist, the execs said.

The ad tech execs don’t want to assume liability for violations against Google and they don’t think they could honor it in practice. Further, they said Google’s agreement goes against the spirit of the GDPR, which says people have to have the option to withhold consent from individual vendors.

“It’s impossible to get 100 percent consent for every reader for the entire vendor list because most consent management platforms have to, by GDPR law, allow the reader the option to select potentially opting out of specific vendors, and so there’s no way to guarantee 100 percent of readers for 100 percent of the partners or vendors have given consent,” said one of the ad tech execs.

At least one ad tech firm, Sovrn, has declined to sign the agreement. “The changing landscape of GDPR has brought a lot of uncertainty for publishers. Due to the strict requirements around consent in the Google agreement, Sovrn has elected to wait until Google joins the IAB consent framework, which will make it easier for publishers to comply,” Sovrn CTO Jesse Demmel emailed.

“The GDPR is a big change for everyone. We’ve been working hard to make sure that Google complies with its obligations under the GDPR, and to help our partners in their compliance efforts too,” a Google spokesperson said.

The Wall Street Journal reported in May that AppNexus and Teads said they have struck deals with Google to guarantee consent. Reuters earlier this month reported that AppNexus and Rubicon Project have guaranteed to Google that they will only sell inventory to DBM for which publishers have received people’s consent. The articles didn’t say if the agreements were initiated by Google or if the companies and their publishers assumed liability for GDPR violations charged against DBM. Spokespeople for AppNexus and Rubicon Project declined to say if their respective companies signed Google’s agreement and assumed liability. A spokesperson for Teads did not return a request for comment by press time.

If an exchange or SSP declines to sign the agreement, it is limited to only selling non-personalized ads through DBM. Those generic ads generate less revenue for publishers than personalized ads that are targeted to specific audiences based on data collected about them. Some publishers that are heavily reliant on DBM have seen their revenues decline by 70-80 percent since GDPR took effect because they were limited to non-personalized ads, said another ad tech exec. That revenue drop has put pressure on exchanges and SSPs to sign Google’s consent agreement lest their publishers move their inventory to other platforms that can run DBM’s personalized ads on their sites, the second exec said.

Google’s consent guarantee agreement is considered by the ad tech execs to be a stopgap measure until the tech giant adopts the Interactive Advertising Bureau Europe’s and IAB Tech Lab’s GDPR consent framework. Google has said that it plans to complete its integration of the industry framework by August, at which time publishers and ad tech platforms will be able to pass consent to Google on a per-visitor, per-vendor basis.