GDPR Will Drain the AdTech Cookie Pool

The EU's General Data Protection Regulation (GDPR) and its companion the ePrivacy Regulation may be dense with ambiguous language and legal jargon, but one thing is unambiguous: if your business collects data from EU citizens, the world looks considerably different as of May 25, 2018.

Most provisions in both regulations carry some degree of pain for the online advertising industry, but one section of the GDPR stands out as particularly consequential — the rules around user consent.

Here's the plain-language version:

Any company that wants to track EU citizens online and collect data about them must obtain clear, voluntary consent. Pre-marked opt-in boxes don't qualify. Companies cannot deny users access to a service if those users decline to consent. Consent must also be obtained separately for each distinct activity — so if a company wants to run web analytics AND use behavioural data for advertising, it needs consent for both.

Today, companies and publishers can collect behavioural data for analysis or ad targeting without asking anyone's permission. The real-world impact of this new consent framework won't be fully apparent until implementation begins — but a report from PageFair has already offered the industry a preview of that post-GDPR reality, and it isn't particularly encouraging.

PageFair Surfaces Some Uncomfortable Truths About User Consent

The PageFair survey, which drew over 300 respondents, produced results that should give pause to anyone in the behavioural advertising business.

1. Consent rates for sharing browsing habits will likely be very low

Under the GDPR and the ePrivacy Regulation (still being finalized at the time of writing), publishers must obtain explicit consent before sharing users' web behaviour with other companies — whether for advertising or simply for analysis through services like Google Analytics.

The survey data makes clear that users are broadly unwilling to see their data passed to third parties, even for something as routine as web analytics. One practical path forward for publishers: switching to a self-hosted web analytics platform so that data collection, storage, and use remain in-house rather than flowing to a third party.

2. First-party cookie strategies will have a meaningful advantage

The survey also surfaced something that will surprise very few practitioners:

"The very large majority (81%) of respondents said they would not consent to having their behaviour tracked by companies other than the website they are visiting."

That figure directly implicates third-party cookies — the cross-site tracking mechanism that the majority of AdTech companies and advertisers currently depend on for behavioural targeting. An 81% refusal rate for third-party tracking would hollow out the addressable audience for most programmatic campaigns.

The picture is less dire for large first-party data holders. A platform like Amazon, for instance, can continue leveraging behavioural data through first-party cookies as long as it secures consent. E-commerce operators running content personalization or product recommendation engines are similarly positioned — their first-party data remains usable under GDPR, provided they collect consent properly.

3. Publishers stand to become consent gatekeepers — and may price accordingly

Consent will need to flow through to every company that wants to track and analyze user behaviour, but in practice it will almost certainly be collected at the publisher level. That puts publishers in a uniquely powerful position: they sit between users on one side and advertisers and AdTech platforms on the other, and they may reasonably conclude that managing consent on everyone else's behalf warrants financial compensation.

One telling detail from the survey: 32% of AdTech companies believe publishers will ask for compensation for consent collection, compared to only 27% of publishers who say they plan to. AdTech companies appear more convinced of this dynamic than publishers themselves.

What the Data Actually Tells Us

The PageFair findings point to two conclusions:

• A large majority of users will decline consent for behavioural tracking and the data use that powers targeted advertising.
• Advertisers and publishers built around first-party data strategies will be better positioned than those dependent on third-party cookies.

Where Does AdTech Go From Here?

The instinct of many AdTech businesses reading reports like this will be to look for workarounds — ways to minimize GDPR friction or route around the consent requirements. That's the wrong frame. The more durable response is to build for a future where collecting user-identifiable behavioural data is simply not the default.

That means investing in genuinely innovative approaches to serving relevant advertising to engaged audiences without the behavioural tracking infrastructure that has defined the industry for twenty years. That kind of technology doesn't fully exist yet — but it rarely does at the moment a regulatory forcing function appears. History across other industries suggests that hard compliance requirements have a way of unlocking innovation that wouldn't otherwise have arrived.

GDPR is that forcing function for AdTech.

This article was originally published on ExchangeWire.