Tags containing: "data collection"

Advertising | Featured Post | Perspectives

Being big and behaving badly

May 23, 2018 Jason Kint, CEO – DCN

On a panel a few weeks ago, Makan Delrahim, a top antitrust official at the Department of Justice, said that “Being big is not a violation of antitrust policy. Being big and behaving badly is a problem.”

We’ve established without debate that Facebook, Apple, Amazon, and Google are big. As their Q1 earnings showed, they’re extraordinarily big. Rockefeller big. Carnegie big. But how have they been behaving? Rather than make any assumptions, I went to Twitter knowing many of my followers work in the press, inside the beltway, or across our industry and are very close to the behavior of the tech giants.

The results were surprising to me. Not because Facebook came out on top. But that one out of three voters chose Google over Facebook. (Apple and Amazon didn’t even come close.)

I thought it was worth examining the parallel paths of these two “winners,” to consider some facts that may not be on everyone’s radar.

Facebook and Cambridge Analytica

Everyone has had their punch lines about the ineffective ten hours of United States Congressional hearings with Mark Zuckerberg in Washington last month. We can add this week’s meeting in Brussels to the joke. But not everyone has been paying attention to the work being done by the UK Digital, Culture and Sports Committee, which has been digging into the case for nearly 18 months and asking really smart questions. Here are a few facts established as of today. I’ll let you read through them and determine who is behaving badly:

Last month, Facebook disclosed that up to 87 million Facebook users’ data was harvested in 2014 by GSR and then sold to infamous Cambridge Analytica (now being dissolved). These disclosures were made after joint reporting by The Guardian and The New York Times, and after legal threats by Facebook were reported by The Guardian. Facebook later admitted these warnings were not their wisest move and offered an apology.
Facebook has refused to clarify exactly when Mark Zuckerberg or Sheryl Sandberg first became aware of GSR or Cambridge Analytica. Though The Guardian first reported on both companies in a report on December 11, 2015 and a Guardian reporter started asking questions in December 2014.
GSR was launched and run by two “equal partners,“Joseph Chancellor and Dr. Aleksandr Kogan.

It was recently disclosed that Facebook signed a confidentiality agreement with Kogan. This confidentiality agreement was signed by Kogan and an undisclosed Facebook executive on June 24, 2016. (Interestingly, this was the date results of the vote on the Brexit referendum were announced.)
Lesser known fact: In November 2015, Facebook hired Chancellor and he signed a confidentiality agreement as an employee of Facebook. Yes, Facebook hired someone who participated equally in what Facebook characterized to The New York Times as a scam and a fraud.

This leaves us with a minimum of 27 months (December 2015 through March 2018) and a maximum of 39 months (December 2014) in which Facebook was aware of the records being harvested and sold to Cambridge Analytica. Yet, they’re still not sufficiently answering questions about the matter.

What is next here:

The emerging pattern appears to be a massive cover-up. So far, despite a threat of future arrest, Mark Zuckerberg has refused to give testimony in the UK where the toughest questions will be asked. The Federal Trade Commission is investigating the issue raised by Senator Kamala Harris’s questions about who made the decision and why Facebook didn’t inform its users back in 2015 when they knew the “fraud and scam.” Being big and behaving badly.

Google and GDPR

For a while now, DCN has been analyzing, advocating, and lobbying on GDPR, which will come in to enforcement this Friday, May 25th in the European Union. The law, which applies to data collection of EU residents, was approved in April 2016 so it’s anything but new at this point. However, despite DCN and publishers inquiring for many, many months, we only found out what Google was up to in the 23rd month of the two-year grace period. And then only after the Wall Street Journal scooped Google on their plans. (Un)fortunately, this news happened in the same week the Facebook and Cambridge Analytica news was breaking so its plan didn’t get the attention it deserved. And to be clear: Google’s plans are fairly offensive.

Google’s Privileged Position

Let’s take a step back and look at how Google operates as a privileged platform in the advertising marketplace where they can set the rules of the game while also playing and winning the game. What gives Google the most leverage is its market power and unprecedented amount of data collection in this market (all estimates courtesy of Arete Research).

Google DBM (their advertising bidding solution on the demand side) has $1.7B net revenue vs Google’s nearest peer (The Trade Desk) at $308 million. MediaMath is in third place at around $220 million.
Google DoubleClick AdX (their exchange sitting in the middle) has $1.9B revenue vs nearest peer at $155 million.
Google DFP (their solution on the supply side) has $700 million net revenue vs nearest peer with significantly less.
Google’s measurement/attribution solution has $600 million net revenue vs nearest peer at under $100 million.

In other words, Google is 5-10x its nearest competitor in every stage of the digital advertising supply chain — where Google both creates the market and makes the market. So, the question becomes what is Google’s responsibility in rolling out the GDPR, the most significant data protection law in history? We know our members depend on Google for nearly every component of their advertising revenues (which drive on average 80% of our members’ overall revenues.) It’s a simple fact that nearly every one of DCN’s members use Google DFP as their ad server.

The Monopolist Move

So DCN was rightly concerned by Google’s vague policy updates where they attempted to retain all of the rights to the data harvested by each and every one of Google’s ad services without details in how they would use this data. And that they did this while the risk was being assigned to the publishers was, as I previously said, fairly offensive. They might as well don a top hat and cane. It’s the move of a monopolist.

Taking on Google regarding their policies in protecting one of their most treasured assets, their data collection, isn’t for the faint of heart. So, we worked with three other major global trade bodies representing more than 4,000 publishers and sent a letter of concern to Google CEO, Sundar Pichai. In the month since we’ve sent this letter, Google has continued to set up private meetings with publishers. However, we’ve consistently been told Google is unwilling to commit to the necessary terms for publishers and when they even begin to approach something workable, they will not put anything in writing.

Hence the open public letter by DCN with our seven key questions.

We’ve found it unfortunate that Google has refused to answer our questions and has since moved on to public relations tactics including organizing a “collaboration meeting” on May 24th — the last day before GDPR enforcement begins. We took the counsel of the other associations, their members and the legal and legislative experts across our DCN membership and declined Google’s invitation for a private, off-the-record event.

What is next here:

At this point, it’s unequivocal that Google has strategically waited until the final months with the goal of protecting its own interests. This serves to push the market towards systems orchestrated by Google and the trade bodies that represent it and protect its interests above the interests of the public and the publishers. Again, given the dominance of Google throughout the digital advertising supply chain, publishers don’t have a reasonable choice to not sign Google’s terms and essentially shut down advertising revenue on May 25.

The key question will be whether Google and its trade bodies roll the EU regulators. It’s worth noting Facebook’s troubles and a high-profile 60 Minutes report on Google last Sunday won’t help their cause. Being big and behaving badly.

When I do the math on these companies’ actions, they both add up to being big and behaving badly. And that’s a big problem. Being big is not inherently bad. Power can — and should — be used for good. But with great power comes great responsibility. And these are not the actions of responsible companies.

Perspectives

How consent fragmentation could alienate users and undermine the GDPR

May 23, 2018 Roy Smith, Founder and CEO—PrivacyCheq

After a two-year grace period to allow time for preparation, GDPR finally goes into effect this week. For most enterprises, mapping and remediation of private data storage has been the focus. But now it is time to focus on sustainable operational compliance starting on May 26^th and continuing for years into the future.

If you monetize with programmatic ads, we’ll assume that your legal team has made the (very typical) decision that “consent” is the best legal basis for processing data under GDPR. Regardless of which basis you choose, data subjects must be given a clear and understandable explanation of what data you will use, how you’ll protect it, who you will share it with, and how long you’ll keep it. When the user gives his (now “informed”) consent, a transparent, trusting, ongoing relationship is formed – exactly what the authors of the GDPR intended.

Because it can be revoked at any time, and processing must stop when it is, consent must now be easily checkable by both internal company activities, and also by third parties (called “Data Processors” in GDPR lingo) that utilize the data (for example, ad networks). Clearly, “consent” has become a very important new corporate asset.

The Programmatic Problem

The AdTech industry has realized that under GDPR, lack of consent could quickly lead to the end of programmatic ads. Last November, the IAB trade group proposed the Transparency Consent Framework (TCF), an open source consent solution that it believes will allow the ads to keep flowing. Many observers, (including DCN) have criticized it for technical and functional shortcomings.

The purpose of this post is not to dissect the flaws of the IAB TCF. My goal is to make clear that even if it worked properly, the IAB’s solution could never be considered a complete consent solution for a publisher. Its only purpose is allowing programmatic ads to continue to flow.

As this point, you may think “So, what? It will keep my ads running. Why not use a free solution to manage the programmatic ad part of the GDPR consent puzzle?” I submit that consent needs to be handled centrally as a key corporate asset, just like accounting, HR, strategic, and other corporate data.

Consent Deconstructed

Here is a real-world example illustrating what will happen when consent is not handled centrally. A mid-sized publisher runs ads (of course) but also offers newsletters, email-based promotions with sign-ups, and an affinity / personalization program with a persistent login.

If the publisher chooses the IAB TCF solution to run ads, they still have no solution for storing or managing user consent to their internal GDPR uses. (This could include email newsletters and affinity programs, but potentially many more. Today’s digital marketing creates a lot of data ingress points).

The publisher chooses a “GDPR compliant” third party email provider that gathers consent and stores it internally (not accessible to publisher). For their affinity system, the publisher creates a basic consent flag system on their internal servers. In theory, the publisher is now covered for GPDR consent.

A Poor Patchwork

In actual practice, this “patchwork” solution is very unpleasant for users. They will be interrupted and asked for their consent for ads the first time they come to the site post-GDPR. They will again be interrupted and asked for consent (by a different vendor and with a different UX) when they join the email list. Then, they will again be interrupted and asked for their consent with a different UX when they join the affinity program.

Because of the disjointed consent strategy (known as “Consent Fragmentation,” the user has been interrupted 3 times for consent, shown 3 different notices, and given their consent using 3 different user interfaces. At a certain point, users will become frustrated with the continual interruptive requests for consent, something the GDPR authors envisioned and referred to as “Consent Fatigue”

It gets worse. Under this patchwork, when a user decides to revoke or modify their consent, their path to success is extremely arduous (the opposite of GDPR’s “easy as giving consent” wording in Article 7).

Since the IAB TCF does not provide any user interactivity, the publisher must use an IAB approved Consent Management Platform (CMP) to provide users with required rights management capability. To modify their ad consent, users must use the CMP dashboard that the publisher has chosen.

To revoke email permissions, the user would have to visit the “unsubscribe” page of the email vendor. Finally, for the loyalty program, they would need to use a “revoke my consent” function from the publisher’s in-house consent manager.

Centralized Consent

Consent fragmentation is the result of using different “Band-Aid” systems to hold user consent, and there is no positive aspect to it. This situation came about because the publisher did not understand the true importance of consent. No publisher would ever hold separate general accounting ledgers in multiple unconnected silos. It would be a certain recipe for disaster.

This disconnected experience is bad enough for a single site. Now imagine how users will feel if most sites ask their consent three or four times. This is the nightmare scenario that risks the failure of GDPR because users will simply stop giving consent.

I think you can see where this is going. Post GDPR, user consent is a vital corporate data asset, a key gating item for all user interactions. As such, consent must be gathered wherever needed. However, it must stored in a central repository, where is easily accessible to all internal activities, and to a curated group of external partners (email services, analytics, ad partners and downstream ad partners.)

With a single consent repository, users are presented with the experience they expect: one single sign-on dashboard. It will provide them with an accurate and easy to understand notice of the uses of their private data, easy access to exercise their rights, the ability to selectively opt-in or out of each of the services used by the publisher, and a secure point of access for SAR and breach notification. The solution must be an easy to use, single sign-on privacy management is evidence of “Privacy by Design,” as envisioned by the authors of GDPR.

Roy Smith is founder and CEO of PrivacyCheq, a leading provider of SaaS privacy compliance services to enterprises and small business worldwide.

Perspectives | Policy

Why the GDPR will force you to understand your customers’ needs

September 14, 2017 Chris Pedigo, SVP Government Affairs – DCN

When I was 14, I walked door to door selling subscriptions for the local newspaper. It paid a lot better than ditch digger (which I also tried), but it also required thick skin. I quickly learned that I needed a good elevator pitch that captured the essence and value of what I was selling and that helped me make a connection with the person on the other side of the door-frame. If I could do all of that in 10 seconds, then the conversation almost always went well. Sometimes it led to a sale, sometimes it led to “come back later,” and sometimes it just led to a pleasant conversation. All of those outcomes were infinitely better than getting a door slammed in my face. I imagine it was also a much better experience for the prospective subscriber who had just been interrupted by some 14-year-old kid ringing their door bell.

One key to improving my elevator pitch was having a thorough understanding of the product. In this case, the local newspaper. Then I needed to master the value proposition, which meant tuning into the customers’ needs. The key value for most subscribers was the connection to their local community. This was the 1980s, so the paper was the primary way to keep abreast of local politics, sports, events, weather, and to read the classifieds. It was impossible to communicate the value proposition to a prospective subscriber without understanding how a subscription would be helpful to them.

Now, we get all this local information in a very different way. But, what’s now often missing in today’s digital ecosystem is the basic communication with consumers. Some companies do it well – see Apple’s just-in-time notices that allow apps and websites to ask consumers for permission to collect and use sensitive data like location and contacts. However, entire categories of companies aren’t communicating with consumers AT ALL. Just look at the thousands of ad tech companies that track unwitting consumers across the web.

Maybe there’s value to data collection in these contexts. But companies that don’t have a solid value proposition on the added value that they can effectively communicate to consumers better be ready for the door to slam.

The coming enforcement of the General Data Protection Regulation (GDPR) and the likely passage of ePrivacy Regulation in Europe will force companies to better explain what they are offering to consumers. In short, they’ll have to develop an elevator pitch.

For years, industry trade groups have heralded the consumer benefits of big data. But these benefits are often articulated in long-winded, research white papers designed to justify unbridled data collection to regulators. The fact is that, like their predecessor, direct mail, these “highly targeted ads” are more often viewed as creepy than carefully customized. Certainly, customers sometimes appreciate experiences tailored to their past behavior and preferences. However, giving them control over what data is collected and telling them why does not negate that possibility. Effectively communicating the “why” is the essence of the elevator pitch after all.

Starting in the spring of 2018, ubiquitous, non-transparent data collection is not going to fly in Europe. And in a global economy, that means marketers and advertisers everywhere need to pay attention. Companies will have to figure out concise and compelling ways to explain their value proposition to consumers in order to get their consent.

As a young newspaper salesman, I had to knock on the door and—if a customer was willing to open it—I had a brief opportunity to demonstrate the value the local newspaper could deliver. Otherwise, that door would close and I might not get another chance.

Based on my experience, the companies that understand why consumers value their product will be the ones that emerge victorious in this new landscape. Along the way, the whole digital experience might be improved for everyone. And the result will certainly be better than a potential customer opting to download an ad blocker instead.

Industry-Research

Today’s paradox of privacy

August 16, 2017 Rande Price, Research VP – DCN

The Privacy Act of 1974 emphasizes the need for both “notice and choice” to protect consumer privacy online. “Notice” gives consumers the information about data collection and use, and “choice” allows consumers to determine whether their data is collected and shared. But do the checks and balances of “notice and choice” really help to protect consumer privacy?

The Digital Privacy Paradox: Small Money, Small Costs, Small Talk Report by Susan Athey, Christian Catalini and Catherine Tucker from the National Bureau of Economic Research, offers insight on the privacy paradox and the inconsistencies between privacy preferences and actual consumer privacy choices. The research examined how more than 3,000 undergraduates engaged in privacy preferences while choosing an online wallet to store and manage digital bitcoin currency.

Different wallets, different incentives and encryption offerings were proposed to evaluate privacy offerings of different dimensions. Students could choose between four wallets: Blockchain, a hybrid web/self-managed wallet, Circle or Coinbase, both web wallet services or Electrum, a self-managed wallet. Participants were also asked about their preferences in privacy features (privacy from peers, intermediaries and government) and their degree of trust in financial institutions, startups and government to ensure a balanced and randomized sample.

Findings showed that regardless of their privacy preference, students shared their friends’ data when given a small incentive. Surprisingly, even the more privacy-sensitive students responded to the incentive offering.

One incentive gave students a pizza in exchange for three friends’ email addresses. Interestingly, a clear majority of the students chose pizza. Neither gender or levels of privacy sensitivities had any effect on choices. Six percent of the students appeared torn in the decision process and provided invalid emails.

In addition, when privacy required additional effort — such as encryption technology — students often went with without it in their transactions. In total, 55% of participants tried adding encryption and only 49% of those who tried succeeded. The remaining participants transacted without encryption.

Small incentives can misdirect people. To ensure privacy practices, current policies should be reviewed to determine how people can be protected from their willingness to discard privacy practices. Consumers need to make meaningful choices when it comes to privacy and incentives often cloud the decision-making process.