‘It won’t be business as usual’: How Auto Trader is tackling GDPR

“We’re going to look at each partnership with the aim of ensuring that they are not just GDPR-compliant, but are also mindful of the cookie directive [ePrivacy Regulation] that’s coming after as well,” Izlan said.

Working with Deloitte, Izlan and her team are reviewing contracts with ad tech vendors to determine whether the way they process the publisher’s data is legal under the GDPR. These updated contracts will ensure Auto Trader is indemnified, should a third-party ad tech vendor violate the GDPR.

Like other publishers, Auto Trader is insisting all ad tech companies it works with undertake their own internal privacy impact assessments and run regular data protection reviews to ensure they fully comply with the GDPR.

However, Izlan doesn’t believe the reviews will force Auto Trader to walk away from any ad tech partners. The publisher has always worked with a small number of “quality technology partners,” said Izlan, who expects to maintain those partnerships, albeit with “more structure” around the use of data.

“We’re working through everything that’s been flagged as either a ‘priority one’ or a ‘priority two’ [under the GDPR] with the respective partners to make sure those processes are made more robust and stand up to regulation,” Izlan said. “It won’t be business as usual insofar as the way we continue to work with our programmatic partners, as that would defeat the purpose of what the regulation is trying to do.”

As both a publisher and an advertiser, Auto Trader is tackling the GDPR on two fronts: It is rethinking when it must have direct and nonliable relationships with ad tech vendors as a publisher, while simultaneously adapting to consumers who are starting to question how Auto Trader uses their data as an advertiser. Public scrutiny of how companies are using data has reached new heights following reports that data firm Cambridge Analytica misused Facebook data, allegations that have forced the duopoly to clamp down on third parties’ access to its data and advertisers to rethink how they personalize programmatic campaigns.

“We’re hearing in the market that certain parties are switching off third-party data partners, but that won’t impact us in any great way because we rely on our first-party data,” said Izlan

None of that matters if Auto Trader can’t convince enough people to willingly share their data, though. Questions remain about when businesses need to gain the consent of individuals to track their online behavior and when companies have grounds to claim legitimate interest to process data. For now, Auto Trader is focused on getting user consent, Izlan said. “I know that a lot of the larger businesses are looking at the other legal basis [for handling data], and we’ll do the same, too, but it won’t be to the level of one of the massive players in the market,” she added.

Auto Trader recently launched an email campaign to ask its most engaged opted-in users to give their consent again to be tracked, as the company’s existing permissions are not GDPR-compliant. Over the next month, the business will push the campaign out to its wider opted-in user base. Auto Trader’s marketers are also testing different versions of the same email campaign to determine what form of messaging will more likely convince customers to agree to share their data. The company is testing a system called a preference center where users can manage their own contact details and set their marketing preferences as well.

“We anticipate there will be a drop-off in the amount of [audience] data [we can use],” said Sarah Jones, Auto Trader’s senior CRM manager. “But we’re confident that this drop-off will result in better engagement on the whole, which will have long-term benefits.”

Want more around GDPR? Download Digiday’s comprehensive guide.