As May 25 approaches—the date GDPR goes into effect in the E.U., and for any digital company that touches data from users in the E.U.—it just so happens that we here at AdMonsters are also gearing up for the 2018 Ops conference on June 4-5. Those two landmark dates set my own memory into motion, and remind me of what I was up to this time last year. I clearly remember chatting with privacy expert Alan Chapell prior to the 2017 Ops, and I remember being in the room for his Ops session on GDPR. It was an impressive presentation, several steps ahead of what most folks in the ad trades were saying about what “GDPR compliance” might possibly mean.
And there were fewer than 20 people in the room for it. Can you imagine how full that room would be if that session were held today? GDPR is a knotty issue, and the interpretation of who it affects and how has continued to change over the past year. One week ahead of its implementation, many publishers remain not only unprepared, but uncertain of what they need to do.
We’ve been warning pubs to get moving on GDPR compliance for over a year at this point. But now—and this is pointedly clear with Google announcing it was going to limit the number of tech vendors publishers can name in its consent management platform, Funding Choices—it’s facile to chide pubs and say, “You just didn’t plan far enough in advance.” Do publishers understand the risks of not being compliant? Heck yes, they do, and some have voiced willingness to simply cut off their E.U. ad business entirely rather than running afoul of the regulations.
No, even though many joined in on the late side, publishers want to play the game. But it’s really hard to play a game when the board keeps moving, and that’s what’s happening with GDPR. Scapegoating publishers for failing to do their due diligence isn’t all that fair when the generally accepted idea of what “due diligence” is changes so frequently. The language around the regulation should have been clearer. Unfortunately, it wasn’t, and now publishers are left dealing with it.
For some time, publishers and tech vendors were holding out hope that processing user data for the purposes of targeting ads would fall under the GDPR clause that holds explicit consent may not be required for certain “legitimate interests.” Many still are, but there’s more of a question of whether that’s a smart bet.
In a recent article, ExchangeWire’s Ciaran O’Kane said that “legitimate interest is not legally defensible” where publishers and their ad business was concerned. And while a lot of folks in the industry have predicted the E.U. regulators will make a big show of enforcement by hauling one of the Duopoly platforms out on the rug, O’Kane predicted it’ll be one or more publishers who’ll be made into an example. It’s easy to see the number of cookie syncs running on a publisher’s page, which could make major publishers easy-to-nail targets.
Of course, publishers should hope not, if they’ve taken the frequently offered advice that most commonly-practiced advertising and marketing efforts will still be fair game.
Google’s Funding Choices cap is another twist. Publishers using Funding Choices—a convenient and cost-effective enough consent management tool, relative to the alternatives—will be allowed to list only 12 ad tech vendors. Now, I don’t want to give too much away from AdMonsters’ upcoming playbook on demand partner evaluation, but we ran a publisher survey prior to writing the playbook, and we found 31% of respondents said they were working with more than 12 demand partners. That’s just demand! We can count the days until GDPR goes into effect, and Google has again thrown another wrench in the (already shadowy) works.
Were publishers, on the whole, slow to get on board with GDPR compliance? It’s safe to say that—compliance was always going to be a long process, involving multiple teams within the publisher org and any tech partners. If pubs were largely on top of it, Alan Chapell’s session would have been packed.
But all the twists we’ve seen in the narrative in the past year do seem a bit excessive. Ciaran O’Kane isn’t wrong in suggesting banking on “legitimate interest” was never the wisest strategy. Considering how complex and opaque the compliance process has proven to be, I hope his prediction of regulators making an example of a publisher is off. That would add insult to what’s now several months of injury.