Adtech consent is meaningless unless one stops data leakage

Dr Johnny Ryan GDPR

Websites and advertisers can not prevent personal data from leaking in programmatic advertising. If not fixed, this will render consent to use personal data meaningless.  The GDPR applies the principle of transparency:[1] People must be able to easily learn who has their personal data, and what they are doing with it. Equally importantly, people must have surety that no other parties receive these data. It follows that consent is meaningless without enforcement of data protection: unless a website prevents all data leakage, a visitor who gives consent cannot know where their data may end up. But the online advertising system leaks data in two ways. This exposes brands, agencies, websites, and adtech companies to legal risk. How data leakage happens  If “programmatic”advertising or “real time bidding” was ever a mystery to you, take 43 seconds to watch this PageFair video.…

Research result: what percentage will consent to tracking for advertising?

Dr Johnny Ryan GDPR

This note presents the results of a survey of 300+ publishers, adtech, brands, and various others, on whether users will consent to tracking under the GDPR and the ePrivacy Regulation.  In early August we published a note on consent, and asked whether people would click “yes”. We would like to thank the 300+ colleagues who responded to our research request. Now we present the results. UPDATE: 9 January 2018, SEE  MOST RECENT PAGEFAIR INSIDER NOTE ON GDPR CONSENT DIALOGUES from 8 January 2018.   Tracking for a single brand, on a single site. 305 respondents were asked by a publisher to permit a named brand and its analytics partners to track them on the site. A previous note explains the design of this notice.…

How the GDPR will disrupt Google and Facebook

Dr Johnny Ryan GDPR

Google and Facebook will be disrupted by the new European data protection rules that are due to apply in May 2018. This note explains how.  Google and Facebook will be unable to use the personal data they hold for advertising purposes without user permission. This is an acute challenge because, contrary to what some commentators have assumed, they cannot use a “service-wide” opt-in for everything. Nor can they deny access to their services to users who refuse to opt-in to tracking.[1] Some parts of their businesses are likely to be disrupted more than others. The GDPR Scale When one uses Google or Facebook.com one willingly discloses personal data. These businesses have the right to process these data to provide their services when one asks them to. …

Here is what GDPR consent dialogues could look like. Will people click yes?

Dr Johnny Ryan GDPR

THIS NOTE HAS NOW BEEN SUPERSEDED BY A A MORE RECENT PAGEFAIR INSIDER NOTE ON GDPR CONSENT DIALOGUES. PLEASE REFER TO THE NEW NOTE.  This note presents sketches of GDPR consent dialogues, and invites readers to participate in research on whether people will consent.  NoteIt is important to note that the dialogue presented in this note is only a limited consent notice. It asks to track behaviour on one site only, and for one brand only, in addition to “analytics partners”. This notice would not satisfy regulators if it were used to cover the vast chain of controllers and processors involved in conventional behavioural targeting. Consent requests In less than a year the General Data Protection Regulation (GDPR) will force businesses to ask Internet users for consent before they can use their personal data.…

The 3 biggest challenges in GDPR for online media & advertising

Dr Johnny Ryan GDPR

This note explains the three deepest challenges that the online advertising industry must overcome to survive the new European data rules. It also outlines our approach.  The General Data Protection Regulation (GDPR) and the ePrivacy Regulation (ePR) pose particular challenges for publishers, brands, and adtech companies. These go beyond the normal gap analysis and security overhaul that other businesses must undertake to comply with the new rules. Online advertising and media businesses’ ability to function online depends on the outcome of three deep challenges. Deep Challenge 1: Obtaining consent to process an internet user’s personal data. Despite some lingering debate to the contrary, businesses will need consent from internet users to use their personal data for online behavioral advertising. This poses a UX challenge.…

Risks to brands under new EU regulations

Dr Johnny Ryan GDPR

Brands face serious new risks under the GDPR and the ePrivacy Regulation (ePR), and agencies will not be able to shield them. This note explains why, and describes what these risks are.  When the GDPR and the ePrivacy Regulation (ePR) apply a year from now brands that use personal data in their marketing campaigns will become exposed to new legal risks, irrespective of their arrangements with ad agencies. Though the new rules are European, the exposure will be global.
Access the GDPR/ePR repositoryA repository of GDPR and ePrivacy Regulation explainers, official docs, and current status.Access Now Brands are directly exposed for two reasons. Why agencies can not shield brands The first reason is legal. The first reason is that the text of the General Data Protection Regulation (GDPR) says that “each controller or processor shall be held liable for the entire damage”, where more than one controller or processor are “involved in the same processing”[1]. …

PageFair statement at European Parliament rapporteur’s ePrivacy Regulation roundtable

Dr Johnny Ryan GDPR

Lightly edited transcription of PageFair remarks at rapporteur’s sessions at the European Parliament in Brussels on 29 May 2017, concerning the ePrivacy Regulation.  Statement at roundtable on Articles 9, and 10.  Dr Johnny Ryan: Thank you. PageFair is a European adtech company. We are very much in support of the Regulation as proposed, in so far as it relates to online behavioural advertising (OBA).…

Why pseudonymization is not the silver bullet for GDPR.

Dr Johnny Ryan GDPR

Pseudonymization will not save online advertising companies from having to seek consent to use browsing and other personal data. This note explains why. Personal data will become toxic in May 2018 when the General Data Protection Regulation is applied, unless data subjects have given consent.[1] Some businesses may try to rely on “pseudonymization”, a partial method of anonymization, to continue to use personal data without consent. This would be a mistake, as the GDPR (and a previous opinion from the Article 29 Working Party[2]).…

PageFair statement at European Parliament ALDE shadow rapporteurs session on the proposed ePrivacy Regulation

Dr Johnny Ryan GDPR

Lightly edited transcription of PageFair remarks at European Parliament ALDE session on 4 May 2017.  Dr Johnny Ryan: Thank you. It’s a pleasure to be with you this afternoon. I’ve been on both sides: the adtech side, and the publisher’s side, of the particular part of this story that I want to talk about. Several years ago I was at The Irish Times as Chief Innovation Officer, and my background before that was academic: I wrote a history of the Internet, which is now a standard text. Now I work at PageFair, a European adtech company, based primarily in Dublin. I want to make clear that my remarks are limited only to the ePrivacy Regulation as it affects online advertising. There may be issues with other domains.…

DSP ‘contextual’ targeting offers solution to strict GDPR regulations

David Barton GDPR

Programmatic online advertising will not cease to exist because of the GDPR or the proposed ePrivacy Directive. Personally-identifiable information (PII) may seem essential to digital advertising, but it is not the only way to target a relevant audience. Targeting based on context was a reliable method for decades before we came to rely on collecting and cross-referencing vast amounts of intrusive data.