Google searches for a GDPR edge
FROM Friday, the EU’s new General Data Protection Regulation (GDPR) will be in effect and European citizens will have greater control and oversight over how their data is used. The most obvious manifestation of this to date? A deluge of emails, pop-ups and other messages from sites and services about updated privacy policies.
But plenty of businesses are also struggling with similarly turgid terms and conditions.
One sector that’s well used to struggles is digital publishing. And GDPR has opened up a whole new can of worms for digital publishers that rely on advertising. Google’s DoubleClick is the technology that almost all websites use to serve ads. And the search giant is changing the terms of use of ad-serving technology to comply with GDPR.
There’s no doubt GDPR has the potential to be a long-term boon to European businesses. It will also place Europe ahead of the rest of the world in terms of data protection and it will force European firms to innovate in relation to users’ privacy. But, in the short term, there’s a feeling that Google is using its market dominance to ensure its continued dominance. So just how pushy is Google getting with digital publishers?
Well, it is insisting that the publisher is a co-controller of any data used to serve personalised ads.
That means websites must obtain end users’ consent to use and store cookies, to collect and share personal data — including IP addresses — that allow for the personalisation of ads. As a result, websites are going to have to start telling you which advertisers can access your information on their sites, what those advertisers are doing with that data, and keep a record of users’ privacy settings. Expect more pop up messages. Lots of them.
Where websites can’t get consent from users for their data to be shared, Google is offering a new, non-personalised ad offering. These ads won’t use cookies for personalisation, but they do use cookies to facilitate frequency capping, reporting, and to combat fraud. Publishers, therefore, still need to get consent for the ads for which they don’t need consent. It’s all gone a bit Catch 22.
There are other problems. Because the programmatic advertising supply chain is both murky and dynamic, website owners can’t tell who’s bidding on their inventory.
There isn’t always a comprehensive list of advertisers that can appear on their pages. So publishers have no way of informing users who might be using their IP addresses to serve personalised ads. Any publisher that accepts responsibility for gathering the consent to serve ads is also opening themselves up to considerable risk. If they fail to obtain consent on Google’s behalf, they can be fined 4pc of their annual turnover.
Google has also ruffled feathers by not yet signing up to the Interactive Advertising Bureau’s GDPR framework. This framework is far from perfect, and hasn’t had much overt support from publishers, but it is an attempt at an independent standardised approach to safeguarding users’ online security.
Google’s absence leaves it dead in the water and leaves publishers without any a unified approach to managing consent. Google has said it is working with IAB Europe to support the framework, but hasn’t said whether it would register as a vendor.
Publishers haven’t been shy in voicing their irritation to Google. Late last month, four major publisher trade groups boasting a joint membership of about 4,000 newspapers and magazines, wrote to Google. They didn’t hold back.
They accused Google of brinkmanship, saying it was waiting to the last minute to announce its GDPR plans, giving publishers little time to assess the legality or fairness of their proposals. They accused Google of looking after number one, saying Google was more concerned with protecting its business model rather than helping publishers to comply with the letter and spirit of the law.
They also said Google is potentially overstepping the mark by claiming it’s a co-controller of the data it receives from publishers or collects on publisher pages. “Claiming such broad rights over all data in the ecosystem”, the letter says, “without full disclosure and without providing publishers the option for Google to act as a processor for certain types of data, appears to be an intentional abuse of your market power.”
This is fighting talk from the publisher trade groups. But time is running out. The big question is come next Friday, will they have softened their cough? Will they have reluctantly been forced to agree to Google’s terms? Do they have any choice?