Did you know, the adverts you close, skip, and scroll past online are the end result of a complex auction process, which allow brands working with adtech providers to compete in real time to serve their advertising content to you?  Do or should you care, how those ads are served so long as you can access freely online content and services funded by advertising revenue?  Privacy regulators and activists seem to think so, this article explores what all the fuss is about.

How does it work?

Adtech is a term which describes tools used in online advertising campaigns, one particular application of the technology, real time bidding (or “RTB”) allows for automated ad placement, which can be combined with contextual (e.g. information about the page you are visiting) and audience insights (information based on assumed profiles about you or others with similar characteristics to you) to deliver tailored online advertising. The process replaces more traditional forms of advertising, such as the direct purchase of ad-space between publishers (websites) and  advertisers (brands).

For an introduction to programmatic advertising/adtech please click here.

What is all the fuss about?

Following a series of privacy complaints, a number of regulatory decisions and a period of regulatory review of the industry as a whole by competition and data protection authorities, the RTB process through which we all receive targeted advertising is now under a microscope, and the industry is braced for change.

A key moment for those operating in the UK, was the publication of the UK data protection authority’s (the ICO’s) 2019 RTB and Adtech Update Report. Following a period of industry engagement, the regulator found many of the practices to be disproportionate, intrusive and unfair making them in contravention of European data protection rules. Their specific concerns include:

1.     Poor understanding of data protection rules (e.g. the use of legitimate interests for cookie placement) 2.     Insufficient consent collection for the data sharing, ‘cookie’ technologies and special category data 3.     Poorly established legitimate interests and associated safeguards 4.     Invisible processing and lack of transparency

5.     Poor compliance with DPIA requirements leading to unmitigated risks 6.     Disproportionate data sharing, and use of data profiles 7.     An excessive use of personal data 8.     Overreliance on contractual limitations  9.     No guarantee for individual rights and the safeguarding of their personal data

 

At the time the ICO was clear, RTB was an industry problem, and it was for industry to come up with a solution if it wanted to avoid external sanctions from regulators. Following the publication of the report, the ICO engaged in a sixth month period of engagement and additional fact finding, working with industry bodies attempting to come up with solutions to the regulators concerns.

Response to regulatory concerns

Following the publication of the report, publishers, ad vendors, advertisers, and advertising agencies have had to review their practices (where applicable) and those of their supply chain  looking to minimise the regulators concerns, developments include:

• a review of data protection positioning (focusing on taking responsibility for processing purposes, lawful bases, and transparency)
• an increase in industry engagement, education and guidance from industry groups
• the development of an updated Transparency and Consent Framework (focusing on transparency, and user consent and opt out controls)
• a move toward first party solutions, including 

  a. increased usage of first rather than third party cookies;
  b. a small move towards use of login/account data rather than data derived from cookies (where possible);
  c. potential development of first party browsers by larger technology companies

• an announcement by Google to stop using content categories in RTB signals.

What next?

Although positive steps have been taken by Google, IAB and various advertising trade groups, the concerns of data protection and competition authorities remain. As such they are continuing to monitor developments and proposed changes closely.

It is time for organisations operating in or associated with the industry to review their practices and supply chain, and to accept and embed change if they are to avoid incurring or being associated with regulatory sanction.

What does this mean for the industry? Larger players like Google can be expected to reduce ties and reliance on third party tracking technologies, as part of a wider move towards first party solutions and environments. Time will tell whether intervention from competition authorities will prevent other players such as Facebook and Amazon from following suit. For smaller organisations, they should continue to review their practices, which should be aligned with industry good practice, in particular we are likely to continue seeing increasing adoption of the Transparency and Consent Framework.

What is clear is that for those who have not yet responded to the concerns of privacy regulators, the window for engagement and transformation is closing. In the UK in particular, the ICO has confirmed it will not allow less engaged market actors to gain a competitive advantage over those who are putting measures in place to ensure a fair and transparent use of personal data in online advertising

• Share this blog

• Twitter
• Facebook
• Linkedin