Cookie Syncing Is Growing, Posing Data Leakage and Revenue Threats to Publishers

No one likes an uninvited guest showing up at a private party and snooping on every conversation. For some publishers, that's playing out on their sites, but with more damaging repercussions, like exposing them to data leakage, damaging audience trust and leading to missed revenue opportunities. Cookie syncing is when ad tech companies map a user from one system to another in the digital supply chain by dropping cookies on a publisher's website. Ad tech partners match cookies, allowing them to communicate user identities through the chain. Essentially, this makes a publisher's audience addressable to the buy side. When an ad tech company drops a third-party cookie on a publisher's website without the publisher's authorization or knowledge, the practice is known as piggybacking. This allows third parties to reach audiences elsewhere without buying any media from the original publisher. Besides compliance issues, the publisher also misses out on revenue. And it's a technique that is growing, based on research of more than 63,000 domains by data management solution Sincera and identity provider ID5. Upcoming statewide privacy laws, combined with an increase in cookie syncing, require publishers to be more privacy compliant, preventing unauthorized third parties from using the data to build user profiles. What Sephora’s $1.2 Million CCPA Settlement Signifies for Brands For its part, The New York Post began the process of launching its own identifier two weeks ago, the company’s head of technology, Ariscielle Novicio, told Adweek. “Having a unique ID gives us the ability to know that the same user we see on a website is the same New York Post ID user that visits an app and any other product that we own," she said. "This makes the user more valuable." The Post is also collecting more behavioral data directly from audiences on its properties, as opposed to relying on partners to drop third-party cookies to track people across the web. Novicio has hired an external ad tech and identity consulting partner to help with those efforts. If it gets into [the ad buyer’s] money allocation, market behaviors will change.Mathieu Roche, CEO, ID5 The Post, founded more than 220 years ago, is currently testing the efficacy of its own ID by comparing it with ID5's ID. When a match exists, segments are published to supply-side platforms for buyers. Testing for ID efficacy is extensive, Novicio said. "We test against technical and advertising KPIs such as cookie persistence by browser and also against expected match rates," she added. While advertisers are more willing to pay for ad space to show relevant ads to people, leading to higher monetization for publishers, issues with adverse cookie synching, such as page latency and data leakage, mean publishers are on the alert to control its prevalence. Cookies that aren't consented to by publishers lead to unnecessary network traffic, resulting in inefficient cookie matching, regulatory risks and privacy concerns. “Publishers prefer a controlled cookie syncing to preserve the revenue gains, but reduce the compliance risk and the enormous amount of network traffic that takes place,” said Patrick McCann, svp of research at CafeMedia. Cookie syncing is big and energy-intensive The study by Sincera, commissioned by ID5, found an average of 62.44 unauthorized cookies on an ad-supported publisher. By comparison, the number of cookies directly approved by publisher partners averages 14.84, Sincera co-founder Mike O’Sullivan told Adweek. “Essentially, for every cookie that the publisher approves there are four more being written that they don’t directly control,” he said. Multiple cookie-syncing requests from piggybacking ad-tech companies lead to energy inefficacy. While these requests don’t consume a lot of energy on the user’s machine, a lot of requests result in duplicative network traffic. A demand-side platform would need to maintain a fleet of energy-consuming servers around the world to respond to these requests. “They are all returning the same data—the identifier—just to different ad tech companies on the same page,” said O'Sullivan. Monthly audits and SPO Although publishers have limited control over cookie syncing, they can ensure their syncing is only conducted when the user has granted consent to specific vendors. The New York Post is conducting a monthly cookie audit to keep this issue in check. In its latest auditing process, the publisher found one of its partners had dropped cookies on a social media site that wasn’t a part of their contract. After the audit, the company was able to rectify this. Social Logins, Increasingly a Liability for Publishers, Are Fading From Sites Ad tech players can sync to a universal ID to solve the downside of cookie syncing. The Trade Desk's adserver.org allows ad tech companies to collaborate on the foundation of anonymous identity. “This massively reduces the carbon footprint, the complexity and lack of control that we have with cookie syncing today,” said Mathieu Roche, co-founder and CEO of ID5. Supply path optimization—where buyers find the most efficient path to purchase—can help reduce the negative impacts of adverse cookie synching. For instance, an ad buyer might move their budget to a publisher where less negligent synching activity is happening. “If buyers track and understand this data, they can inform their supply path optimization with it. And that will influence the market,” Roche said. “Ultimately ad spend talks. And if it gets into [the buyer’s] money allocation, market behaviors will change.”