The Future of Ad Tech Lies in Privacy-Enhancing Technologies

A Brief History of Privacy in Ad Tech

In the early days of programmatic advertising, ad targeting was a fairly blunt instrument. Campaigns were limited to the context of the webpage and whatever could be inferred from the user-agent string — an IP address for rough location, little else.

That changed when companies began using web cookies to identify individuals across different websites. These third-party cookies multiplied rapidly and were soon tracking millions of users across the internet. The ability to tie a single individual to activity on multiple sites gave rise to behavioural ad targeting, audience segmentation, campaign measurement, frequency capping, and attribution.

News outlets eventually caught on. Stories emerged about companies — ones most consumers had never heard of — quietly tracking web users from site to site. It wasn't long before governments took notice.

The European Union was among the first to act, enacting the Privacy and Electronic Communications Directive (the ePrivacy Directive) in 2002, followed by the General Data Protection Regulation (GDPR) in 2018. Both were designed to protect user privacy and impose meaningful constraints on personal data collection.

But the most consequential privacy shifts were still ahead.

In 2017, Apple released the first version of Intelligent Tracking Prevention (ITP), targeting the very cross-site identification mechanism that third-party cookies enabled. Mozilla followed with similar tracking protections in Firefox. Google then announced it would shut off third-party cookie support in Chrome — a move expected to take effect in 2024.

On the mobile side, Apple has changed how its Identifier for Advertisers (IDFA) can be accessed on iOS, and Google has signalled plans to implement analogous restrictions on its Google Advertising ID (GAID) within Android.

The Privacy Landscape in 2023

Fast forward to today: the programmatic advertising industry finds itself in a situation where approximately 50% of global traffic is already unaddressable using traditional identifiers, according to ID5's 2022 State of Digital Identity Report.

The current privacy landscape has been shaped by two distinct forces. The first is government regulation — frameworks designed to protect user data and limit how personal information can be collected and processed. The second is technical intervention by platform companies — Apple, Mozilla, and Google — changing how their devices, operating systems, and browsers handle personal data collection.

Together, these forces have meaningfully eroded the effectiveness of programmatic advertising as it has traditionally been practiced.

Alternatives Taking Shape

From these changes, a set of alternatives has emerged to power the core processes programmatic has relied on for over a decade. The main ones include:

• Universal IDs and ID graphs — approaches that attempt to identify users in a more limited, consented way than third-party cookies
• Google Privacy Sandbox — Google's suite of proposed APIs intended to enable interest-based targeting and measurement without cross-site tracking
• Contextual targeting — placing ads based on the content and context of a page rather than user history
• IAB Tech Lab's Seller Defined Audiences (SDA) — a framework allowing publishers to categorize their audiences using first-party signals

New infrastructure solutions have also emerged. Data clean rooms allow two parties — say, an advertiser and a publisher — to match their datasets and run key programmatic processes without either side gaining access to the other's raw data. Self-serve ad platforms give publishers a way to offer advertisers direct access to their inventory and audiences, bypassing third-party data sharing while also reducing the fees and commissions paid to intermediary ad tech companies.

Most of these alternatives represent a genuine improvement over third-party cookies and mobile IDs from a privacy standpoint — though there remains considerably more room for the industry to move.

Universal IDs currently attract the most attention as the apparent front-runner, but the broader fixation on finding a direct replacement for third-party identifiers arguably misses the point. As one industry observer noted on ExchangeWire, "the obsession with finding a replacement for IDs and third-party cookies shows we have not moved with the times." The framing of the challenge as a swap-in, swap-out problem understates how much the underlying approach needs to change.

Adapting to a Privacy-First World

If the previous three decades of programmatic advertising were defined by mass data collection, the next decade should be defined by adopting privacy-enhancing technologies and techniques that reduce that collection and protect what is gathered.

Privacy-enhancing technologies (PETs) focus on three things: reducing the volume of data collected in the first place, maximizing security around data that is collected, and minimizing the amount of data that actually needs to be processed. All three dimensions matter, and progress on each one helps companies adapt to a privacy-first operating environment.

There is a genuine opportunity right now for all participants in the ad tech and programmatic industries to build new solutions — or update existing ones — to incorporate these privacy-focused technologies into their businesses. The companies that do so are better positioned to thrive in the next era of the industry.

A Necessary Reckoning

As an industry, ad tech failed to build privacy into its foundational technologies and processes from the start. That failure is why the sector now faces a scramble to retrofit privacy into systems designed with very different priorities.

The pattern in ad tech has long been one of reluctance to move until there is either a compelling commercial reason or sufficient scale to justify the shift. That mindset is no longer workable. The regulatory environment, the platform-level technical changes, and the growing portion of traffic that is already unaddressable all point in the same direction.

The motto "evolve or die" has rarely been more applicable. The future of ad tech will centre on privacy — and innovation in that space is shaping up to be a primary driver of new growth and competitive advantage.