Privacy Orgs Are Media Agencies’ Next Big Investment

Since the introduction of the General Data Protection Regulation (GDPR) in 2018 and privacy laws in the U.S. like the California Consumer Privacy Act (CCPA), media agencies have spent the past four years building privacy departments, requiring them to make significant financial investments. For instance, digital agency Rakuten Advertising hired data protection officers to keep up with all the privacy regulation changes. Over time, Rakuten has built out an entire privacy task force that spans departments. “You’re getting much more detailed questions [from clients] about where data is stored, where data is processed, et cetera,” said Stephanie Liu, a privacy analyst at Forrester Research. “As a result of that, we’re seeing agencies make those investments—getting more headcount, bringing it in-house and really building out the privacy practice.” How agencies are pushing privacy Given the vastness of privacy as a topic and the speed with which lawmakers and tech companies are making changes, there’s no one-size-fits-all agency approach to addressing these issues. “Agencies traditionally have stacked their privacy teams with lawyers,” said Liu, noting that this is changing. “I’m seeing that much more often these days, it’s an in-house full-time employee,” she said. Many networks now have a hodgepodge of privacy departments that extend to the holding company level, the group level, the agency brand level or all three, plus the advice from in-house or external legal counsel. Agencies’ approach to building out privacy departments can take a few forms. Some agencies work in partnership with trade body Interactive Advertising Bureau (IAB) to keep up with legislative changes. Other organizations, like Mediahub, have gone the in-house route. Omnicom Media Group’s (OMG) team is split into mar tech experts and legal counsel, and it also consults on privacy matters with its sister agencies within the Omnicom umbrella, like Credera. VaynerMedia has invested in understanding privacy, drafting in staffers from its legal team specializing in data privacy issues, who work hand-in-hand with the media and operations teams. “We’re handling all sorts of legal and finance-related things far and beyond digital media intricacies,” said Jon Morgenstern, svp and head of investment at VaynerMedia. “That’s what [clients] rely on us for, to simplify that complexity and distill down what matters.” By contrast, holding companies like IPG and Publicis acquired data companies like Acxiom and Epsilon that had already built strong privacy departments. This gives those agency networks a leg up because they have deep expertise in data handling and management. IPG’s Acxiom and Kinesso subsidiaries each have privacy teams staffed by experts in privacy law, technology and operations governance, as well as privacy analysts. Acxiom uses its own legislative monitoring services to track bill developments, along with working on notifying stakeholders in case legislation breaks. Then it flags any changes to stakeholders to determine the legislation’s impact on the business or create a remediation plan when necessary, according to its chief data ethics officer, Jordan Abbott. Epsilon, for its part, has a global data privacy office that helps make sense of policy developments. This department contains experts like lawyers, privacy-certified operational staff and data stewards, and people who help make sense of contractual obligations with clients and third-party data vendors. The cost of compliance Establishing an in-house privacy team has worked well for Rakuten. “It is a time saver for us, versus others that lean almost 100% on external parties,” said Anthony Capano, who is the company’s managing director, North America. But building practices from scratch and staffing them with experts isn’t cheap. A leading media agency, speaking anonymously, invested more than $5 million over the last three years in staffing the team and setting up data-governance related technologies. These new hires often come from banking industries or state agencies, with a typical salary bracket ranging between $200,000 and $250,000. Many agencies’ in-house privacy groups are still nascent, with many contending with the cost of building out in-house departments right now. Mediahub last year hired a director of data privacy governance and is currently hiring to fill the team. “We have made some key investment hires over the last nine to 12 months to really make sure that we are at the forefront of all these privacy regulations that are coming down for all of our clients,” said Jade Watts, Mediahub’s chief media officer. “These hires aren’t necessarily covered by client’s scopes. So that is a significant out-of-pocket cost,” she added. Media agencies as privacy experts? Clients’ expectations are one reason agencies are making this change. According to Morgenstern, it’s now more common to see brands’ data experts, like CIOs, sitting in on agency pitches. Clients commonly ask agencies to address privacy in RFPs, and they conduct data audits on potential agency partners, suggesting that privacy has become a deciding factor. Marc Rossen, svp, investment and activation analytics at OMG, described how these proceedings include tactical audits of data infrastructure, covering who has access to that infrastructure, data security and how data is separated from clients, vendors or suppliers who may bring their own data, and how the agency treats different data types. As new legislation rolls out and cookie deprecation draws nearer, privacy departments continue to proliferate. “What I see across the rest of the holding company—in agency land? They are developing privacy teams and developing the expertise to support clients,” said Sheila Colclasure, global chief digital responsibility and public policy officer at IPG’s Kinesso. “We see that coming fast and furious.” Here’s What You Need To Know About Data Privacy Day