What data privacy regulation pressure on Google means for ad tech

What’s clear is that Google’s image as the bright beacon of infallible technological innovation is under strain. Stricter rules on how companies collect, store and use people’s personal data for purposes like ad targeting, have extended beyond Europe’s borders to the U.S. and other countries like Australia and Japan. The U.S. Congress is now weighing whether to pass a federal privacy law, following California’s lead with its Consumer Privacy Protection Act — the state’s equivalent to Europe’s General Data Protection Regulation. Meanwhile, the Justice Department is preparing to launch a fresh antitrust probe into Google, according to the Wall Street Journal.

“It’s significant because the general view from Washington just a couple of years ago was that Google could do no wrong — there was a halo around them. That’s now gone,” said Jason Kint, CEO of U.S. publisher trade body Digital Content Next.

Added to that, Apple has aggressively marketed its position as a user data privacy-conscious business and blocked third-party cookie tracking by default on its Safari browser. Google won’t want to appear on the back foot of such a powerful marketing message.

Most ad execs believe that Google’s future products will have data-privacy features, so as to avoid further financial penalties, stay competitive with Apple, and position itself as a company that cares about its users’ privacy.

To some publishers and ad tech vendors, that spells trouble. The old rule of thumb is regulation inevitably favors incumbents — and is often used by the powerful to cement their dominant positions. Google’s last-minute changes to its GDPR strategy, which caused initial disarray to publishers, agencies, and ad tech vendors, is a memory that hasn’t faded. When YouTube blocked third-party ad tech vendors from accessing its platform, citing GDPR compliance as its reason, it also caused discomfort. Now, the platform has reopened access, but with targeting restrictions, according to ad tech sources.

Meanwhile, agencies still lament the loss of DoubleClick user IDs from Google log files, which the tech platform pulled last year citing GDPR as its reason. “That killed a number of products across the industry,” said an agency executive.

Google’s latest Chrome privacy update was by no means the catastrophe many in the ad tech world had braced for. Rather than follow directly in Apple’s ITP footsteps, Google released a more measured update in which it gave users the choice to block third-party cookies. While that smoothed many wrinkled brows, a lot believe that update to be the precursor of more strict future changes, albeit rolled out on a more gradual level so as to protect its own ad business interests and avoid being accused of anti-competitive behavior.

“Any knock-on effect will be a very slow burn,” said Brian Wieser, global president, Business Intelligence at GroupM.

Google in a privacy era
Others aren’t so calm about the potential ramifications. Some publishers have interpreted the Chrome update and the potential that Google may close off its platform more in the name of data privacy compliance, as a bad omen for it joining the industry attempt at a GDPR compliance standard (Transparency and Consent Framework) led by the Interactive Advertising Bureau Europe.

“The problem is, much as the TCF is a good initiative, it is moving too slowly,” said a publisher executive at a major news brand on condition of anonymity. “The slower it moves the more opportunity Google has to bring out something themselves, and then they will have the monopoly on some kind of privacy tool.”

Google has repeatedly maintained its commitment to joining the TCF once the second version of it is implemented.

“We are in the final throes of the existence of the third-party cookie,” said Stuart Colman, sales vp at ad tech vendor InfoSum. As it stands today that is a huge boon for Google — the way we are set up as an industry currently makes privacy a massive revenue opportunity.”

Many are confident Google is taking its data privacy responsibilities seriously, and doing what it can to meet requirements on all sides. Ultimately, the industry must look inward for its own solutions rather than sit back and wait for Google’s next data privacy update.

“In the short term, people will scream and run around saying it’s all doom, gloom and misery,” said Tom Kershaw, CTO of Rubicon Project. “Then they’ll wake up the next morning and see we’re still here. People forget ads didn’t have third-party cookies 10 years ago, it worked OK. There are plenty of ways the industry will and can provide ads beyond third-party cookies.”

Nevertheless, data privacy could soon become the battleground for the top four tech platforms, according to some ad tech executives.

“Google now sees Amazon coming up as a viable ads competitor,” said Andrew Buckman, COO of ad tech vendor Sublime. “There will be finger pointing between the four top players [Apple, Google, Facebook, Amazon] to show up those that aren’t completely buttoned up [data privacy-wise].

Either way, that will have long-term ramifications for ad tech.

“Apple is playing the data privacy offensive, while privacy has become table stakes for Google,” said Dan Wilson, CEO of London Media Exchange. “Google has persistent IDs, email addresses, everything it needs to build a successful ads business and protect its interests [in a strictly regulated data privacy world]. They can say, ‘We act in the best interest of consumers, and by the way, we’ve yanked up the drawbridge for all ad tech vendors.’”

Apple’s Safari, Mozilla, Firefox and Brave are all browsers limiting tracking across the web.

“Chrome could have waited a year or two and said we will react when we start to lose market share in the browser,” said Kint. “Or they could be proactive in tracking prevention too but keep control of the rules of the game. The big question is how does this affect Google’s tracking — will it have a different set of rules to all other ad tech companies?”

Google largely benefited from GDPR
Prior to the introduction of GDPR, the general consensus was that Google and Facebook both stood to gain from the law — an ironic twist given GDPR was partly conceived to prevent further dominance of the major platforms in Europe as well as protect consumer privacy rights. The mass of logged-in users each business has, would easily hand each an advantage over any other publisher for instance, and supposedly render it easier to gain consumer consent to use their personal data. Naturally, some took the counter view.

A year on, and most still believe GDPR inadvertently strengthened Google. “The legislators were trying to limit the power and control of Facebook, Google and Amazon in controlling this data — but they have in effect given them carte blanche to ring-fence that data and use it for their own purpose — it’s one of those unintended consequences,” said Simon Thorne, managing director of ad server Flashtalking.

Google has played cat and mouse with European regulators for years, the result of which has been the accumulation of antitrust fines to the estimated tune of €8.2 billion ($9.3 billion.) Latterly, there have been smaller fines such as those imposed by French data protection authority CNIL which fined Google €50 million ($57 million) for allegedly flouting GDPR.

In April, Google parent Alphabet revealed a slowdown in ad revenue growth, rising 15% to $30.72 billion, down from 24% growth the year prior. It was widely reported that the European Union’s $1.7 billion fine for abusive advertising tactics weighed on Google’s profits. Growth across Europe, Middle East and Africa dropped from 29% to 13% year over year.

YouTube also experienced a drop in clicks. At the time, Ruth Porat, Google’s chief financial officer, attributed the deceleration in clicks on YouTube to necessary algorithm changes made to tighten brand safety controls.

“The main point is not why revenues decelerated but why they were so elevated in the prior two years,” said Wieser. “They were able to hold onto to 20% growth for so long — that was the more remarkable thing. Deceleration is inevitable.”

Others believe the drop is more significant.

“When Google drops in growth by 1%, that’s over a billion dollars a year globally,” said Kint. “So these small fluctuations really matter.”

The results, which prompted an 8% drop in Alphabet shares, started speculation as to what could have caused that dip. There are likely numerous factors like increased advertiser caution caused by Brexit uncertainty and currency fluctuations, to name a few.

GDPR also prompted advertisers to think more carefully around who and what controlled their data, and who had access to it. “Another knock-on-effect of GDPR legislation is a lot of tech contracts have gone from being agency-led and at a holding-group level to advertisers needing to have contractual relationships with individual tech companies. That can slow down movement in the industry and make it harder for smaller players,” said Thorne.

Some media agency executives have attributed the market shift from second to first-price auctions as a potential reason for a reduction in ad rates, because media agencies are now more cautious with their bidding strategies.

Nevertheless, GDPR likely contributed to the drop, many ad industry executives believe. “I’d be very surprised if GDPR wasn’t one of the factors and the responses they have had to make [to be compliant],” added Thorne.