If you find it challenging to keep up with changes in privacy standards and regulation, you’re not alone. Twenty states have passed comprehensive consumer privacy laws, and more are expected to follow. Since a national privacy law does not yet exist, media companies must navigate a patchwork of state and international regulations.

Google’s recent announcement that it will no longer deprecate third-party cookies likely won’t diminish the need for publishers, advertisers and ad tech companies to continue to focus on privacy and protecting consumer data. Google says it will give users the option to consent to tracking. So, some leaders believe this could still lead to deprecation.

With the privacy landscape seemingly always in flux, where do media companies begin? Here’s an overview of what publishers need to know to plan for a compliant future.

Background: Where to start understanding privacy issues

As the digital advertising landscape has evolved, consumers have become increasingly concerned with how their data is collected, used and stored. These concerns led to calls for legislation and industry standards to protect their data and guide businesses on best practices.

The California Consumer Privacy Act (CCPA) was the first state law passed to address this. Key provisions included consumers’ right to know how their data is being used, and the choice to delete or opt out of data collection.

CCPA became a blueprint for other states to follow. But without national legislation, the result has been an assortment of laws that differ across jurisdictions. As advertisers and media companies attempt to navigate these regulations, the industry has recognized the need for solutions.

In March, the IAB released its State of Data 2024 report, which shares feedback from brands, agencies and publishers about current data practices and where the industry is headed. In the study, 95% of respondents expected continued legislation and signal loss this year and beyond. Because of these challenges, companies must significantly change their practices.

Most publishers are taking a state-by-state approach. Brand marketers are opting for a one-size-fits-all strategy aimed at the highest common denominator. Angelina Eng, IAB’s vice president of measurement, addressability, and data center, explained that as organizations navigate a world with greater signal loss, they need to think holistically about the data they’re collecting.

“Companies need to ask themselves who they’re sharing data with, how to activate and whether they have consumer consent. Our research found that nearly 70% of consumers are willing to share their personal data to support advertising overall, and nearly three in four consumers understand that sharing their data enables websites/apps to know more about them in order to serve personalized ads,” Eng said. “We need to provide consumers with guidance and education around the value of allowing advertisers to leverage some data points and provide ads relevant to consumers, which would in turn allow us to measure performance.”

Media industry compliance solutions are in the works

Several industry initiatives are being developed to streamline compliance and make it easier for businesses to implement industry standards.

The IAB Multi-State Privacy Agreement (MSPA) is a framework designed to help companies from all corners of the industry comply with various state-level privacy regulations. It ensures that companies can efficiently manage compliance across jurisdictions.

The Global Privacy Platform works with the MSPA to transmit consumer preferences across jurisdictions, ensuring compliance with privacy laws such as GDPR and state regulations.

Another element of the IAB’s privacy solutions portfolio is its Diligence Platform. This data privacy platform includes standardized privacy diligence questions for different segments of the advertising industry to help streamline the evaluation process and improve compliance efficiency.

Media companies need a roadmap to navigate privacy

As the industry experiences changes including signal loss and new privacy regulations, organizations must build strategies that allows them to continue to leverage first-party data while remaining privacy compliant.

There are new tools to help publishers better understand and navigate these challenges. ThinkMedium, a consulting firm founded by ad tech veteran Dennis Buchheim, recently released its Publisher Readiness Playbook. It Outlines the context, questions and steps for publishers to understand their preparedness for ongoing data- and identity-related shifts.

“Part of the challenge with privacy regulations is that they go beyond laws. It’s the platform policies that in many ways are having a huge impact on the industry,” Buchheim said.

Buchheim added that the number of policies publishers must be aware of can be overwhelming.

“The breadth of regulations and policies is tremendous. You really must understand what applies to you and what doesn’t. You can comply with the strictest interpretation, have a more bespoke plan, or take a blanket approach. Making very conscious decisions like these requires having a good understanding of what’s happening in the industry. We believe the Playbook can help provide some of that understanding.”

Media companies also can gain a better understanding of their level of compliance by participating in an industry certification program. These programs measure companies against current industry standards and can reveal gaps in compliance that may lead to process improvements to ensure they meet industry standards. While keeping up with privacy changes can seem daunting, solutions and guidance exist to help media companies navigate these complexities. Devising a plan and seeking help from industry resources can help media companies remain in good standing with advertisers, consumers and the law.