How the Media Ecosystem Is Adjusting to a New Privacy Landscape

Key Insights:Big Tech has helped forge industry standards, but not without a struggle.Former outliers such as Google are beginning to yield to those standards. Politicians around the world are under pressure to lean on digital media, forcing the biggest players in the sector to strive for consensus around data-sharing practices. Some believe U.S. data laws, which are being drafted ad hoc, will soon resemble sterner transparency requirements in other countries. While this is welcome news for privacy lobbyists, it poses operational challenges for the wider digital media landscape, especially with Big Tech's historic preference for a proprietary approach to data sharing. The intricacies of automated media trading mean audience data often makes its way into the hands of anonymous middlemen. To many, this is the evolution of the trade-off for free online content, but the concept still spooks members of the general public. The central premise of laws such as the European Union's General Data Protection Regulation and the California Consumer Privacy Act is that businesses are more transparent with consumers over data sharing. But laws in the U.S., including CCPA, are widely considered to be less stringent. GDPR requires companies that collect personally identifying information on EU citizens to provide them with protections such as gaining their consent to use their data, especially to share it with third parties. CCPA asks that companies give users the ability to opt out by providing a clear "do not sell my personal information" button, but California residents are essentially opted in by default. Many believe GDPR requirements have unfairly burdened publishers whose monetization partners, such as SSPs and measurement providers, rely on them as their interface with the public for gaining consent. Even after GDPR enforcement started in 2018, "sequential liability" was a hot-button issue among players in the ecosystem. Partners often tried to offload, or at least limit, their legal culpability for any data leakage along the supply chain. Google joins IAB framework Further complicating matters, Google was a notable holdout in the first iteration of the IAB's Transparency Consent Framework. Sources told Adweek at the time that Google's reticence to sign on to the data-sharing accord was due to questions about whether it was fit for purpose. But the online behemoth has signed on to the second version of the TCF, which now boasts close to 600 advocates. "This new framework standardizes the process of gathering, managing and communicating user permissions for how their information may be used in the advertising supply chain," wrote Chetna Bindra, senior product manager of user trust and privacy at Google, in a blog post. "Our integration with the TCF v2.0 applies to ads we serve on publisher inventory and not Google-owned and operated inventory, for which consent is obtained through our own consent flows." Some have attributed Google's U-turn to increased levels of regulatory scrutiny, both in the EU and at home, and the result of the stark realities of the market. Wayne Blodwell, CEO of The Programmatic Advisory, told Adweek that he thinks the online behemoth, whose ad stack contains both buy- and sell-side operations, wanted to designate itself as a "data controller" instead of a "data processor," a scenario that would have ensured it has more control over potential liabilities. "They realized over time that they can't do that and that they have to get the publisher to get consent for them," Blodwell said. "So, that's why they thought they may as well get involved with TCF 2.0." Pending regime change in the U.S. Gary Kibel, a partner specializing in digital media at U.S. law firm Davis & Gilbert, said it's not unusual for tech giants to perform their own due diligence before deferring to industry standards. Legal experts also told Adweek to expect similar debate as occurred in the EU over data sharing and sequential liability in the U.S. market ahead of upcoming legislation, starting with a pending overhaul to CCPA. California residents will vote on the California Privacy Rights Act, or CPRA, in November. Sources told Adweek the proposed legislation would mean privacy laws in California would more closely adhere to GDPR. They also pointed to a recent open letter from high-profile elected officials asking the Federal Trade Commission to investigate potential data vulnerabilities in online ad auctions as an example of the heightened awareness among members of the public. "What I found really interesting about that letter is that it really got into the weeds," Kibel said. "It wasn't just the standard 'we don't like the creepy ad industry' stuff. It was talking about the data [that can leak] from a losing bid in RTB [real-time bidding] transactions." Jessica Lee, co-chair, privacy, security and data innovation at law firm Loeb & Loeb, said matters are likely to come to a head over the next two years with Google poised to sunset third-party cookies in its market-leading Chrome browser by 2022. "That's also the same timeline as CPRA, and I anticipate over that period, we'll start to see what the new version of RTB and rules of the road look like," she said. Lee also explained that privacy promises from Google and Apple (with its pending iOS 14 update) are going to raise "interoperability challenges" that groups representing each tier of the industry will have to address by 2022. "If you look at things like [the IAB's] Project Rearc and PRAM [Partnership for Responsible Addressable Media] ... you have different frameworks being proposed with different technical limitations. And then, each platform requires something different, and it just gets harder and harder to operationalize, and then you obviously have to accommodate the biggest players," Lee said. "My hope is that we can get everybody around the table and try to achieve some kind of uniformity or interoperability. It won't be easy, but everyone can come out better on the other side."

Mediaweek

How the Media Ecosystem Is Adjusting to a New Privacy Landscape

European-style data laws requiring opt-ins expected in the U.S.

Ronan Shields

About

Subscriptions

Events

Publications

WORK SMARTER - LEARN, GROW AND BE INSPIRED.

Subscribe today!

Ronan Shields