Inside YouTube’s Latest Privacy Updates And How They Affect Advertisers

The company has reinstated third-party ad serving (kind of) as its GDPR-compliance policy on tracking goes global

Ads Data Hub policies mean third parties can only extract a limited amount of insights from the platform. Photo Illustration: Trent Joaquin; Sources: YouTube, Getty Images
Headshot of Ronan Shields

Sandwiched between the enforcement of stringent privacy rules on either side of the Atlantic, YouTube has made a series of adjustments on how advertisers can work with third parties to assess the performance of ad campaigns on the industry’s largest video-sharing network.

The moves come as U.S. advertisers increasingly turn to such audience hubs as an alternative to the broadcast reach that television was able to play in the execution of their media plans with more than $27 billion spent on video ads last year, almost 25% of total digital budgets, per eMarketer.

While the research firm claims Facebook dominates the space with a 25% market share, eMarketer noted that while it doesn’t count YouTube as a social network, “its importance in the video ad space is too large to ignore.” When you generate $3.36 billion in ad revenue in the U.S. alone (approximately 11% of Google’s ad revenue there) you really shouldn’t be ignored.  

To that end, YouTube used its recent Upfront dog-and-pony Brandcast to announce that all of its original programing would be free to the end-user and supported by ad revenue, indicating the future role it will play in disrupting the traditional TV media space.

At the same time, YouTube’s chief business officer Robert Kyncl kept describing advertisers as “our partners” ahead of its annual pitch to TV buyers, signaling perhaps the video platform’s new approach of how brands can use the platform as an advertising clearinghouse.

A recent YouTube policy updated concerns of how brands work with third-party tech companies when it comes to serving ads on the industry’s largest video website. The update, effective April 24, has origins dating back to early 2017 when YouTube said it was to roll back third-party ad tracking, with only a handful of advertising measurement providers such as Nielsen and ComScore (among others) able to do so. 

YouTube’s GDPR-inspired changes will go global

At that time, YouTube was planning for the enforcement of General Data Protection Regulations in the European Economic Area on May 25, 2018, and it ceased to support third-party ad serving, seeking alternative means of working with such parties while not running afoul of the data privacy regulations. 

Effectively, this shut off third-party ad serving in the EU with a global rollout of the same policy planned as lawmakers elsewhere prepared to shore-up privacy, as signaled by the planned introduction of the California Consumer Privacy Act in 2020.

Skeptics assert that Google (and YouTube’s) GDPR-compliance policies announced in May 2018 were a means of it using regulation as an excuse to erect its walled garden even higher. One of the reasons is that during this time, it also pressed ahead with the rollout of Ads Data Hub (ADH) whereby approved third parties such as Adform, Extreme Reach, Flashtalking, Innovid and Sizmek among its official partners could measure campaigns. 

From April 24, YouTube recommenced supporting third-party ad serving using a new API-based framework with the above-named independent ad tech companies as launch partners via way of their ADH integration, which introduced limitations on how they can access consumer data.

Despite criticisms around walled gardens, a statement from a Google spokesperson asserted that its recent policy update is pragmatic both in terms of regulation compliance and user experience. 

“This framework, now available globally, benefits both advertisers and users as it increases privacy protections and decreases ad load times,” it read. 

How the latest YouTube policies actually work 

Adweek spoke with several sources from the independent ad-tech sector, including those directly involved with the latest API initiative, to better understand the changes over the past 12 months. 

Formerly, third parties could drop a pixel on YouTube and then track a user retrospectively, but this is now only possible by working with approved third parties and in a limited capacity via ADH. 

This means that an advertiser’s ad-tech partner can then go into ADH and analyze the data within the YouTube platform but not extract it. 

So, if they want to assess how many impressions a YouTube campaign generated, they can now only extract a campaign summary from the platform, not the raw data. 

Tal Chalozin, CTO of Innovid, said this effectively shored-up earlier gaps that had inadvertently led to a “wild west” scenario as the certification bar was comparatively low.

Now, third parties that want to serve ads on YouTube have to receive permission from a client and upload campaign creative via the Google AP whereas formerly this was done directly, a process that enabled third parties to retrospectively track users. 

“Essentially, what they are doing now is introducing a layer of [software] code that you have to write to a Google API,” added Chalozin. “This is basically tightening up the enablement process.” 

John Nardone, CEO of Flashtalking, told Adweek, “Basically, with ADH you can’t take the data out and you can’t get it at any more granular a level than 50 users, so you can’t see [and identify] individuals.”

The difficulty this creates  

Nardone added, “The only way you can combine it with any kind of data is to introduce your outside data into the Google hub.” 

This involves cookie-matching within ADH, a process that can prove difficult and costly, according to Nardone. 

One source speaking upon the condition of anonymity noted how the latest YouTube policies along with Google’s recently unveiled Chrome updates demonstrate “coherent reasoning” and speculated that they could presage an upcoming launch, which could better help advertisers conduct cross-channel campaigns.

The move to ADH removed third-party tracking pixels from the video-sharing network and was likewise reflected by the removal of the DoubleClick ID from its data logs (as part of its GDPR preparations). 

“It’s obvious that what they’re doing is removing IDs in all places where a third party can extract that,” added the source.  

“It’s my best bet–although I have no definite knowledge–that they will announce something that will connect it all altogether for advertisers,” they noted. 

“So, if you want to do attribution across everything from search and maps and GDN [Google Display Network] and whatever, then if you’re using Google, you can connect it all in a privacy-safe way.”         

YouTube’s owner is poised to host its annual flagship conference Google Marketing Live, where a series of product and policy updates are expected to be unveiled.    

@ronan_shields Ronan Shields is a programmatic reporter at Adweek, focusing on ad-tech.