The forces of regulators, consumers, and tech giants on data privacy are enough to push the industry in a new direction.
Why it matters — The race for tech giants to earn consumer trust is heating up as regulators worldwide create laws that protect consumers' data online. Tech giants are signaling their desire to leverage their first party relationships with consumers while consumers are choosing options that mean a decrease in the effectiveness of attribution-led advertising. This combination will force the industry in a new direction with massive change. There will be new winners and losers. The publishers and advertisers that adopt new ways of delivering ads to audiences and measuring results in a privacy-centric manner with adtech partners ready for the future will not only survive this shift but will see outsized gains.
Online advertising is undergoing one of the largest sea changes in its history.
As consumers increasingly spend more time online shopping, socializing, and relaxing, awareness of privacy and data protection has grown. Regulators around the world are working to create laws that protect consumers while enabling economic growth. Privacy-centric rights advocates have turned their attention to internet data collection, and tech giants are working to earn consumer trust to continue to collect consumer data. Each of these groups: regulators, consumers, and tech giants are forces shaping the future of online advertising in a privacy-conscious world.
Regulators
The right of privacy began as the right for individual privacy against government intrusion into personal life, and for many years centered on protecting against governments. Privacy rights were strongly correlated with property rights, such as an individual’s right to prevent government employees from entering their home to collect information. Technological progress long before the Internet pushed the conversation on privacy towards individual rights vs corporations and other individuals. The invention of telephones triggered regulators to create laws protecting individuals from having their conversations recorded without their permission, and the invention of cameras pushed regulators to create laws protecting against photographing private moments. The technological wave of the internet is squarely here, and regulators are paying close attention and getting involved.
For years the industry largely avoided regulatory oversight by regulating itself through industry codes of conduct and transparency and interest-based advertising opt-out solutions through groups like the Network Advertising Initiative, the IAB and the Digital Advertising Alliance and providing industry interpretations to regulations like the Children’s Online Privacy Protection Act.
The biggest official regulatory intervention into the internet in the name of data protection and privacy is the GDPR, covering the activities of the 3rd largest economy and 450 million consumers. The GDPR went into effect in 2018, creating a new era in online privacy. The GDPR is in line with most privacy jurisprudence, offering consumers protection from unexpected uses of their data, the ability to opt into and out of data uses, and consumer data portability requirements. The GDPR lays out a hierarchy of data type sensitivity, and ascribes higher protection for data elements that are more sensitive, and incentivizes companies to collect less sensitive data and less data overall in order to achieve their goals.
In 2019, California’s CCPA preparations swept across companies doing business in California as they prepared for a January 1st, 2020 enforcement date. Similar to the GDPR, the CCPA offers customers protections from some unexpected data uses, gives them the right to opt out of certain uses of their data, and gives them the right to delete data about themselves from companies. Unlike the GDPR, the CCPA places more emphasis on the “sale” of information. Like the GDPR, the CCPA distinguishes between primary collectors of consumer data (“businesses” in CCPA, “controllers” in GDPR) and subsequent recipients of the data (“service providers” in CCPA, “processors” in GDPR), but applies slightly different requirements to the roles. It would be a mistake to assume that because one is a service provider under the CCPA that they are not a controller under the GDPR, or vice versa as they’re defined slightly differently.
Regulators everywhere are now looking at the impacts of the GDPR and CCPA on the economies and consumer rights of their respective jurisdictions and weighing whether the outcomes are something they want to bring to their constituents. In all cases, regulators want to ensure that consumer privacy is protected and that businesses are able to continue to generate jobs and growth, and their task is to make the tradeoffs to achieve those goals.
The primary impact of regulatory action on online advertising has been the tech giants’ responses to limit access to consumer data and shifting away from allowing cross-site advertising and individual attribution to only single-site advertising and individual attribution on sites where consumers both see an advertisement and later convert to meet the advertiser’s goals.
Consumers
Consumers view ads, consume content, and purchase online more than ever. Advertisers savvy to this have pushed online ad spending to 138 billion dollars. Consumers also increasingly turn to privacy protecting or privacy enhancing technologies that impact advertising. For example, tech-savvy consumers frequently use adblocking scripts. Some use browsers that block vendors that websites rely on for advertising and marketing by blocking third party cookies or third party scripts. Consumers state in surveys that they are concerned about hackers and want to reduce their digital footprint.
Many of the options elected by consumers result in a decrease in the effectiveness of advertising that relies on individual attribution cross-site, or where an ad is shown to a user on a property different from where the individual ultimately converts. Branding, awareness, and broad reach campaigns are less impacted than DTC direct response campaigns.
Tech Giants
The tech giants that have large online advertising business lines are also making many changes under the banner of protecting their customer’s privacy; often from other companies and competitors. Browsers are reducing the amount of information that websites can collect from their web visitors. Mobile operating systems are reducing the ability of apps to correlate an individual across apps; siloing each app’s view of a consumer causing cross-app campaigns and app-to-web campaigns to suffer. Some are experimenting with re-inventing their own ad infrastructure to introduce private audience matching and attribution even within their own properties. While these experiments are in their early stages; they send the signal that the tech giants want to ensure that a first party relationship with a user from ad exposure all the way to attribution is the path to a successful ad business.
The paths the tech giants have chosen all share some characteristics. First, they prioritize first party relationships with customers, playing to their strength of having an established user base. Second, they increase the value of end-to-end integrated ad stacks, creating difficult choices for advertisers and publishers that want the flexibility to work with the best company for each task, rather than having to choose from integrated stacks. Finally, they trend towards keeping individual user data on device, in-app, or in-browser, rather than permitting other companies to access it.
Where does this lead?
The force of any one of these groups alone is enough to push the industry in a new direction, and that they’re unified in a rough direction guarantees massive changes are coming. There will be new winners and losers. The publishers and advertisers that lean in to choosing audiences in new ways and measuring results in a privacy-centric manner with adtech partners that are ready for the future will see outsized gains. We at TripleLift are investing deeply in predicting and shaping the privacy and identity future for our publishers and ad buyers, and are listening to our partners to ensure that they can achieve their advertising goals.
