Tags containing: "GDPR"

What policy makers can learn from privacy-focused products

May 16, 2019 Chris Pedigo, SVP Government Affairs – DCN

The legal and policy community continues to debate the impact of General Data Protection Regulation (GDPR), the ins and outs of the California Consumer Privacy Act (CCPA), and how (or whether) Washington should regulate consumer privacy. While the debate rages on, we are seeing a stream of consumer-focused privacy-oriented product rollouts. It is interesting to look at what these controls actually do and how they might inform the policy debate.

In a concession to consumer privacy, Google recently announced that it would allow consumers to block companies from tracking them across the web when they are using Chrome. Specifically, they will differentiate between 1^st party and 3^rd party cookies. As such, they will allow consumers to delete 3^rd party cookies while preserving the 1^st party cookie, which, for example, allows a website to remember a consumer’s log-in information. In addition, Google will soon roll out features to prevent companies from identifying consumers via device fingerprinting, another method used to track consumers across the web.

Let’s be clear, Google is late to the privacy game given the long history of privacy protections offered by Apple and Mozilla. Apple has famously blocked 3^rd party cookies by default in Safari and recently introduced Intelligent Tracking Prevention (ITP), restricting the ability of companies to access cookies when a consumer is not interacting with that company.

Services that care for consumers

When a consumer visits YouTube on Safari, Google can access the cookies they have set on their browser. However, as soon as the consumer navigates to another website, Google can no longer access those cookies. ITP essentially breaks the ability to track consumers around the web. Apple has also worked to block loopholes where cookies, set by companies like Google and Facebook, pretend to be 1^st party but are then used for tracking and secondary use. Unfortunately, it is hard to muster much confidence that Google will be anywhere as diligent as Apple in closing loopholes, given its business model is built on its ability to expertly track consumers.

Mozilla, on the other hand, offers multiple ways for consumers to block third party tracking in Firefox. Mozilla is also considering rolling out a “Super Private Browsing” mode, which would incorporate Tor privacy features into Firefox.

Beyond the most commonly used browsers, a whole suite of new services have popped up. Duck Duck Go, a search engine, and Brave, a browser, offer strong privacy controls as their primary value proposition. As we’ve noted for several years now, more and more consumers are turning to ad blockers to protect themselves and/or improve their web experience. Forcing these massive platforms to once again compete on privacy will be good for everyone, particularly consumers. The question, of course, is whether some of these companies are simply too big to change at this point.

Policy implications

Back to my original question: What can policymakers learn from these new consumer privacy controls?

For starters, consumers increasingly demand more and stronger protections of their data and digital lives or the market wouldn’t be headed that direction. You can reasonably debate whether Google’s recent announcement went far enough. But the fact that a multi-billion-dollar company like Google did anything at all speaks volumes.

It’s also worth pointing out that all of these new controls, which curtail the ability of companies to collect consumer data at scale, are not actually breaking the internet despite the frequent claims of ad tech lobbyists. In fact, given this push to meet consumer demand for greater privacy controls, it’s funny and a little sad to look back at the hysteria from some of these lobbyists.

Meeting consumer demand

The big takeaway is how these companies and their engineers are designing services and features to meet consumer expectations for privacy. This new wave of privacy controls gives consumers the ability to stop companies from tracking them across the web. Yet, these services preserve the ability for websites and apps to collect and use consumer data when the consumer is interacting directly with that company.

This approach makes sense. Consumers share their data so that companies can use it to provide a service or content. In this fair value exchange, the consumer can choose to engage or not. Consumers do not expect companies to track them outside of that fair value exchange and doing so is simply bad business.

It isn’t a question of whether consumers want their privacy protected, these market moves demonstrate the demand and inevitability. And, as policymakers consider how best to craft consumer privacy protections, it’s worth noting how today’s best engineers have attempted to meet consumer demand and expectations for privacy.

Perspectives

Publishers face new risks in the wake of the CCPA

May 3, 2019 Steve Stup, CRO—The Media Trust

While the California Consumer Privacy Act (CCPA) is poised to present peace-of-mind for many, it could be crippling for any publisher that relies on their GDPR compliance framework. In light of recent updates to CCPA, it’s clear that publishers must get on board or face some seriously damaging consequences in the form of not only revenue loss but also severe financial penalties.

The CCPA ripple effect

When CCPA first passed in June 2018, just one month after GDPR’s enforcement, people were quick to refer to it as “GDPR light.” This was an indication that the landmark law will have significant ramifications on how companies that meet the thresholds and do business with Californians will have to change how they operate. At its core, CCPA signals a shift in business models, in particular where data is a revenue stream. What “GDPR light” downplays, however, is how significant that shift truly is.

The very fact that such regulations were passed in the world’s 5^th largest economy was a bold statement in itself. With California at the helm, it’s only a matter of time before the rest of the nation follows suit. Other states are not just going to sit back and have privacy issues impact their citizens after California has made the first move.

More legislation in the works

Already, several other states have already jumped on board with similar laws, some with pages pulled straight from CCPA. For example:

North Dakota: A proposed bill would require companies to provide to consumers (upon request) with information about the types of personal data that companies collect and possess.
New York: Two bills are on the docket: one addressing biometric privacy and another that would govern businesses’ collection and disclosure of personal information. Utah: A bill would require law enforcement to get a warrant from a judge to access electronic information.
Washington: Legislation would allow consumers to ask companies for a copy of their personal data and to delete or correct inaccurate data. It would also regulate facial recognition technology.
Texas: Two bills have been proposed that take more than a page, entire chapters in fact, from CCPA: TCPA and TPPA.

The results are clear: CCPA is about to shake the very foundation of how companies conduct business nationwide. Because of this, several federal regulations have also been proposed. And while it’s unlikely any of them will pass before CCPA is enforced on January 1, 2020, it’s vital to note that these things are currently being worked on behind the scenes. More importantly, since CCPA passed sooner than anyone expected, publishers should begin taking immediate action to align with the upcoming regulations. The groundswell of consumer privacy ballot initiatives is only growing stronger as consumers become more outraged with their lack of privacy rights in the digital landscape.

Proposed amendments

Every publisher, whether operating in California or not, needs to be fully vetted on the new law because it affects anyone who conducts business with California residents. It provides those residents with new rights to their information such as knowing what personal information is being collected, shared, and sold, and with whom.

Furthermore, it also allows them to access and delete, or decline the sale of their information while still receiving equal service and price from businesses. Meanwhile, publishers must inform their digital readers of what information is being collected and why. Publishers must also work to ensure that each vendor in their supply chain is operating within their contracted policies. Additionally, toll-free numbers, email, or websites must be provided to consumers so that they can easily request their information.

The latest on CCPA

Recent changes to CCPA include several notable items, but there are two amendments in particular that could affect businesses for years to come—SB-561 and AB-25. The first dramatically increases the legal risks of businesses that collect and keep information by allowing consumers to file suit for any alleged violation of their CCPA rights without any evidence of harm—even before the Attorney General publishes guidance. What’s more, if the amendment passes, businesses will no longer have the right to consult with the AG on such matters.

The second amendment deals with how the law defines “consumer information.” If passed, this amendment would exclude information collected by a business from a job applicant, employee, contractor, or agent. That’s a good thing, because without this change, consumer information will include business contact information and employee information, resulting in unintended consequences. Former employees will be able to request items from previous employer records, such as emails and other corporate documents that mention their name, including those that contain confidential corporate information and performance evaluations. They can also request emails to and from former contacts, enabling them to reach out to company clients and prospects.

Preparing for CCPA

At the end of the day, there’s no definitive answer on how CCPA evolves by the time it is enforced on January 1, 2020. Still, with less than a year to go, businesses need to take a risk management approach. They need to find out what information is collected and from whom, what information is shared and with whom, and how to secure that data. Operations, security, IT, and compliance teams will need to keep abreast of the regulations and their consequences for the organization. And in order to operationalize security and privacy, these teams will need to work together.

Those taking a wait-and-see approach should look no further than the average cost of GDPR compliance. It’s been noted that, after factoring in legal and other fees, the cost sits anywhere between $1M‐$10M. That number could quickly grow if a violation occurs, and the likelihood is high, given the increased right to personal information. To put it bluntly, waiting to see what happens next is not an option. Businesses of all sizes must act now to protect their bottom line or face the impending consequences.

About the Author

Steve Stup is responsible for developing and overseeing the revenue strategy at The Media Trust. He has experience developing high growth sales teams through the course of his career spanning around 30 years at The Washington Post, Lexis Nexis, and other recognized brands. During his tenure at The Washington Post, Steve built the company’s digital business and spearheaded successful sales and revenue operations teams. He is an alum of Virginia Tech and The George Washington University.

Perspectives

How consumer privacy regulation creates opportunities for publishers

February 8, 2019 Mike Pugh, Senior Manager, Client Solutions—IPONWEB

One of the main drivers behind programmatic’s meteoric growth (at least on the demand side) has been the ability to leverage data to find and buy specific users, out of seemingly infinite opportunities, wherever they might be online.

After all, this enabling of “audience-based buying” brought marketers closer to their long-held notion of advertising utopia: reaching the right person, with the right message, at the right time, in the right context.

Data Dilemma

It also, theoretically, went a long way to minimizing wasted ad spend and enabled significant performance gains. The ad dollars flowed. But this shift took its toll on the sell-side.

To secure programmatic budgets (which were growing steadily and taking dollars away from their direct IO business), publishers had to relinquish control over their hard-won audiences by allowing cookie access to DSP partners in real time via cookie syncing. In doing so, they allowed the buy-side to build up and store those valuable audiences in their own platforms, reducing the need to work with publishers directly to gain access to or insights about their users.

Regulation Matters

The rapid proliferation of user-based targeting has understandably been followed by recent increased focus on consumer privacy. The GDPR went into effect across EU member states in May of last year, limiting unfettered access to user information and the ability to share that information with multiple parties across the ecosystem.

With passage of the California Consumer Privacy Act (which really means all of the US, given California’s outsized influence) and the likely imminent passage of the ePrivacy Regulation in the EU in the second half of 2019, the push for greater consumer privacy legislation seems unstoppable. France’s recent lawsuit against Google also indicates that common industry solutions and frameworks for satisfying new consumer data collection, usage, and privacy regulations aren’t always holding up to legal scrutiny, making the prospect of sharing data widely across partners and vendors increasingly difficult in the future.

While the enactment of these measures on such a global scale erodes the value (and calls into question the long-term viability) of cookie-based buying, it may also open a door for publishers to regain over their data and audiences and re-assert their position in the advertising value chain.

Data Diligence

Here are three tips for publishers looking to capitalize on the moment:

Limit access to your pages

A quick Ghostery check across a number of premium sites shows just how easy it is for 3rd-parties to build pools of data on a given publisher’s audiences. Publishers should be constantly evaluating who has access to their users, and what they’re doing with the data they’re collecting. Partners who add value, either by enhancing audience segments with additional data, or providing analytics and attribution services, should be prioritized. Others, who may be packaging up and reselling data, should be de-prioritized or even culled. An added benefit to this pruning process: faster page loading for users.

Use your data to enhance deals with buyers

Creating greater audience scarcity (enabled through the culling process mentioned above) opens a door for publishers to work more closely with advertisers looking to gain access to their users (and maximize the yield they see from those users). Striking guaranteed and non-guaranteed deals directly with advertisers based on 1st-party audience segments gives publishers the ability to more closely link the cost of media to the value of audiences, and thereby extract greater revenue from their inventory, while also benefiting parties up and down the supply chain. Advertisers enjoy the confidence of targeting audiences using the most recent and accurate data pools. And DSPs and SSPs executing the deals incur less waste (and listening costs), because the inventory is pre-filtered to match only the audience the buyer wants.

Let advertisers bring their own data

More than just building and monetizing their own audiences, publishers should start allowing advertisers to bring their first-party data to the table. One of the main benefits to this strategy is that buyers are able to trust the veracity of the audiences they’re buying. From a publisher’s perspective, it opens up new options for inventory segmentation that may not have existed within their proprietary audience pools. Overlaying additional data will always limit scale, by matching cookies at the source of origin rather than through DSP and SSP intermediaries. And publishers and advertisers can at least maximize match rates, minimize data loss, and decrease the risk of inefficient decisioning down the line – thereby offsetting scale issues to the greatest extent possible (while also commanding very premium CPMs).

Audience First

Consumer privacy legislation is pushing us to the point where the party closest to the consumer – typically the publisher – will increasingly enjoy exclusive access to those audiences as well. When we add the unique ability to know who that user is and what their interests are, the value soars. Couple this with the decline in quality and scale in the open exchange and what you have is publisher data that hasn’t been this valuable since programmatic began to take off.

Following these three steps will help publishers maximize that value. It will also deliver greater efficiencies and performance to advertising partners as well as privacy consideration to valued users.

About the Author

Mike Pugh is a Senior Solution Consultant at IPONWEB where he acts as the intermediary between clients and IPONWEB’s design, delivery, and engineering teams to create custom ad tech projects. He is responsible for bringing client-specific solutions to market and ensuring a successful execution of the solution, strategy, and opportunity. Mike is currently the team lead on the TrustX SSP as well as other strategic business accounts. Prior to joining IPONWEB, he led a team of 14 programmatic traders at Accuen, Omnicom’s trading desk. Mike has experience managing programmatic buying campaigns across the Autos, Retail, CPG, Financial, and Pharma verticals on most major DSPs. Mike graduated from the University of Iowa with a Bachelor’s Degree in Economics and DePaul University with a Master’s Degree in Economics & Policy Analysis.

Perspectives

Striking the right balance: personalized and contextual advertising

January 7, 2019 Eric Shih, Chief Supply Officer - Teads

As online advertising has shifted predominantly to programmatic channels, personalized advertising has also exploded as marketers are able to leverage data at scale to reach their consumers. However, user privacy has increasingly become a global focal point for both consumers and the advertising industry as a whole. Both publishers and advertisers now need to adapt their methods in reaching consumers beyond just personalized, audience or behavioral targeting.

Personalization Matters

Leveraging data to make more informed ad targeting decisions is a breakthrough versus previous methods where ads were un-targeted. Personalized ads are a win for all parties. It is better for:

Users (connects them to more interesting and relevant ads)
Advertisers (results in higher return on investment)
Publishers (delivers higher CPMs and increased revenue)

Unfortunately, not all targeting is created equal. Certain industry practices have resulted in unpleasant user experiences. Needless to say, these should be avoided (i.e. excessive/ sticky re-targeting where ads follow users around the web).

Users should have the right to avoid cookies and personalized ads via an opt-out option in ads, or via their web browser settings. In Europe, GDPR legislation that went into effect in May 2018, now gives consumers in the EU even more control over their personal data – publishers in the region (as well as global publishers with European consumers) now need user permission for cookies for advertising purposes. It is striking to see that according to our measurement (GDPR barometer) which tracks the implementation of the new legislation in European countries, an average of only 5% of users opt-out from cookies. Therefore, 95% of consumers when asked are willing to consent to data-driven marketing! Contrary to negative press, users are generally not as annoyed by personalized ads as one would believe.

This article will dive into the realities facing publishers and brands today, and how to think differently about creating a more holistic solution when targeting users that is safe, compliant, and thoughtful about user experience.

The Shift Toward User Privacy

A number of pitfalls have emerged around user privacy that could potentially challenge personalized advertising tactics in various content consumption environments.

Government Regulations

GDPR , The California Consumer Privacy Act, Canada’s PIPEDA have all changed the way we think about user data and consent. Teads’ barometer of CMP (Consent Management Platform) adoption reveals that approximately 50% of European publishers’ traffic is filtered by a CMP. This means that almost half of traffic today would not be compliant for personalized advertising in Europe.
Ad targeting leveraging user data will become increasingly difficult in the foreseeable future given the expansion of government regulation. And if you’re not a large walled garden (i.e., Google, Facebook, Amazon), you will become more disadvantaged due to a lack of first-party data at scale.

Social Media & Politics

As hundreds of millions of consumers leverage social media and share substantial amounts of personal information online, the risks of data misuse and even potential hacking of that data continue to increase. This risk was best exemplified through a series of scandals impacting Facebook ranging from Cambridge Analytica’s harvesting of user data, to Russian meddling in the 2016 presidential election through targeted propaganda on the platform, to the most recent findings that Facebook shared user data with over 150 companies.The industry is now seeing huge consumer backlash against social media platforms as well as questions from marketers alike, which could ultimately add more fuel to the user privacy fire (while also providing a window of opportunity for publishers to provide a better marketing environment).

Technology Barriers

Beyond government regulation and industry self-regulation efforts in user privacy, technology companies are also implementing measures to prevent ad tracking and hence personalized ad targeting online.

Apple has been leading the charge for consumer privacy and most recently introduced Intelligent Tracking Prevention 2.0 (ITP) on Safari for iOS 12 in September 2018
Safari now blocks first- and third-party cookies and cookie trackers are now completely, which represents 50% of mobile web browser share, rendering the majority of mobile web inventory useless for user tracking and ad retargeting.
Mozilla followed suit by enabling Enhanced Tracking Protection in its latest Firefox web browser.

Brand Safety

Automation and data targeting at scale also have another downside for marketers beyond violating consumer privacy concerns: brand safety.

YouTube, which has heavily relied on its wealth of data and scale, has had a lengthy, recurring history of brand safety violations. Ads have run in objectionable environments ranging from pedophilia videos to extremist and hateful content.
Hundreds of brands have pulled their ads from YouTube in the past two years.
Contextual targeting tools not only provide a solution to avoid these brand safety snafus, but also ensure marketers reach the right audience that they’re paying for.

The Need for Context

Given these increasing challenges, contextual advertising, in addition to personalization, should be considered in a holistic advertising strategy. It serves as an effective, complementary solution in providing the right message to the right user. Contextual advertising also provides an advantage to premium publishers, particularly those lacking their own first-party data or enough scale to leverage data targeting.

Programmatic ad delivery is now the norm, and marketers have become increasingly reliant on user data to target their audiences. This over-reliance on data now creates substantial risk in the form of potential legal and monetary punishments, loss of consumer trust, limited scale as platforms adapt and negative perceptions towards brands appearing in questionable environments.

Contextual advertising – the targeting of ads based on the context of the content that a consumer is reading, watching or listening to – is not a new concept, but it is now an increasingly relevant and important tool in marketer’s toolkit as data becomes more challenged. Publishers can leverage context to extract the most value out of the content that they create to better compete against the walled gardens (which often only provide low quality scale). Marketers can still reach the most relevant (and likely more interested) audiences by placing ads in relevant environments. Users can still receive relevant messaging even when they’ve opted out of cookie-based targeting.

Whether it’s semantic, visual or audio analysis, the tools are available for contextual targeting in almost all content outlets.

A Holistic Targeting Solution

It is crucial to think about how to create relevant ad experiences for users leveraging both personalization and context. Publishers should think about a holistic strategy including targeting via dynamic creative optimization using their first- or third-party data, leveraging interest graphs to understand what content users are consuming, and analyzing content and identifying keywords on their pages to build the right context.

In order to adapt and succeed in a quickly evolving landscape for data and user privacy, we believe publishers and marketers need to exploit both identity and interest to maximize their potential reach and deliver the most optimal messaging.

Featured Post | Innovation | Perspectives | Revenue

In 2019, these 4 shifts offer opportunities for trusted media brands

November 29, 2018 Jason Kint, CEO – DCN

Successful media companies have always relied upon having a direct, trusted relationship with consumers and advertisers. Consumers want to know the brand and the experiences they’ll get from them. And advertisers that want to build this same level of customer relationship directly seek out these trusted media brands or tune advertising algorithms their way.

The teams at trusted content brands wake up every day and create content people love, products that serve them well, and safe and valuable advertising environments—all while maintaining the high level of ethics and professional standards that benefit viewers, readers, listeners, and a healthy marketplace. And we’re here to support you.

What makes our members unique is also what makes DCN unique. By focusing at the brand level across the entire media strategy, we’re able to advocate and work to advance the future of trusted news and entertainment and partner to develop all sources of revenues. We can also do it without needing to curry favor or meet the needs of a few large tech platforms with out-sized influence who are required partners for any modern publisher.

As we turn toward 2019, it is a good time to reflect on the top-of-mind trends for media companies. Here are four important shifts happening in digital media right now—all of which play into the strengths of trusted media brands:

1. Revenue, direct from audience.

With our quarterly and annual members-only benchmark report, DCN has unique access to market research specific to premium publishers. Importantly, our research isn’t skewed with numbers from Google and Facebook. (This is a very common issue in industry research. Always look “under the hood.”) Our research is based solely upon our members. One of the things our benchmarks tell us is that approximately 80% of members’ digital revenue comes from advertising. However, we’re finally seeing growth in direct revenue from audiences whether it comes in the form of membership, subscription, or donation.

Trusted publishers are uniquely positioned for this shift because they offer exactly what people want: high quality news and entertainment – that’s worth paying for. It remains to be seen how the market evolves in order for this revenue segment to grow as it must, but we’re thrilled to see our members playing a proactive role in shaping the opportunities.

2. Distributed platforms, going over the top

The list of platforms is endless and evolving: YouTube, Facebook, Snap, Twitter, Apple News, Flipboard. While publisher revenues on these distributed platforms have been promising at times (YouTube), they’ve often been disappointing (Apple News, Facebook Watch). But right now, quality content creators are seeing the fastest movement in the video space, particularly long-form and over the top (OTT).

Our best practice research on OTT earlier this year showed how our members are taking aim at these opportunities. However, new gatekeepers are surfacing in the OTT space like Amazon and Roku. And while Google and Facebook don’t like being called “walled gardens,” every new platform will no doubt be planting their own seeds to maximize their profits off your content. Experimentation is essential. But protecting your IP and deal terms early on is critical.

3. Ad targeting, rebirth of context

In the EU, the impact of GDPR has just started. There are new claims calling into question the entire way Google has collected consent for its ad supply, how real-time bidding operates, not to mention endless class-action suits mostly focused on Google and Facebook. DCN has distributed research on Google’s unique and unavoidable ability to mine behavioral and location data significantly beyond user expectations as you browse the web and walk the streets . We’ve argued towards raising the bar on companies who collect data across most of the web while recognizing the inherent trust in choosing to visit your environments, brands and context.

Global leaders are asking more questions than ever. Looming large over the discussion is a new law in California which will impact the very companies that are now (albeit, ironically) advocating for federal laws to save them through preemption. It’s been a wild year when Google, Facebook and its trade group, IAB, are now finally pushing for a federal privacy law thereby admitting their existing frameworks may be failing consumers. Quality publishers have a unique role in shaping any solutions as consumers seek more controls and alignment with their expectations. Consumers don’t know the hundreds of ad tech companies mucking up their web experiences, but they do know you and your brands. And, of course, this value then transfers to ads in this environment.

4. Advertising, direct to consumer

Research from the IAB, as well as industry discussions, has driven a DTC (“direct to consumer”) movement as the next big thing. Here is the great news about this conversation: It’s no longer focused on the plumbing, data, ad tech, and vendors. It’s focused on how brands have value and can connect directly with audiences and consumers, bypassing gatekeepers and intermediaries. This is the sweet spot for quality content companies. In fact, I’d say if anyone wants to better understand how to go direct to consumers, they should start with the members of DCN.

But here’s the rub: Many players in the market won’t ever really be able to go “direct to consumer” without relying on the brand equity of trusted media. In order to find scale, they’ll first need to build demand, be willing to bundle, and find quality brands to associate with and carry their flag. They’ll want to be near those with purpose and value recognized by the public.

I’m sure each of these movements will surprise us in ways we can’t predict. They may develop more slowly than anticipated or accelerate at light speed like the privacy regulation has with GDPR and Facebook’s mishaps hitting in the same quarter. But either way, premium publishers should be ready as, with the right proactive strategy, there are opportunities in all.

Perspectives

Three internet privacy acts every publisher should know

November 28, 2018 Trish Manrique, Content Marketing Partner—Sortable

Online, it can seem like the geographic borders of information and e-commerce are becoming more and more blurred. But as a digital publisher, if you’re serving ads to audiences in the US, Canada, or the European Economic Area (EEA), it’s good to be aware of regional privacy and data collection, processing, and disclosure laws, and how each change with different countries.

According to our data, publishers are seeing an average split of 40% US, 15% EEA, and 8% Canada traffic. So we’ve rounded up some information privacy laws and personal information-handling practices that you should keep in mind, whether you’re based in those countries, see visitors from them, or want to to grow your traffic from these regions.

On a serious note, complying with privacy laws and understanding the impending updates could help protect you from everything from fines and class action lawsuits to protecting your consumer confidence from a damaged brand reputation.

1. EEA: General Data Protection Regulation (GDPR) for Publishers

What is it?

GDPR came into effect May 25, 2018 and applies across the EEA. GDPR is considered the data processing standard. It takes a proactive, consent-first approach to the collection of data and analytics.

Why should it matter to publishers?

GDPR ensures that companies can’t collect data without a lawful basis and a reason for processing. GDPR has the broadest definition of the personal data that it protects of any major privacy law. So, if you collect any information from EEA-based users, GDPR should be on your mind. Sites offering goods or services to EEA buyers, or tracking their online activities, are now required to obtain consent from users on the data they collect and with whom they share it with. Consent Management Platforms, or CMPs, are used by many publishers to manage consent. (View trends in publisher decisions when it came time to implement GDPR).

If you’re found to be in breach of GDPR, you could see big fines, between 2 to 4% of your annual global revenue, in addition to €10 million to 20 million, depending on the severity of the offense. You can be found to be non-compliant with GDPR if you use data in a way that you do not have consent for, or in the event of data breaches—losing consumer information in a cyber attack.

2. US: California Consumer Privacy Act for Publishers

What is it?

Scheduled to come into effect in January 2020, California’s new privacy law AB 375 was signed in by unanimous votes in the summer of 2018. As the world’s fifth largest economy at $2.7 trillion GDP, it’s likely that businesses targeting US visitors will encounter California residents. Consequently, California could become the de facto approach for the US. While California’s privacy law has passed, the Internet Association (a lobbying group that represents companies like Facebook, Google, Uber, Amazon, and Microsoft), the US Chamber of Commerce (the country’s largest lobbying organization), and the Interactive Advertising Bureau (IAB) are encouraging US federal lawmakers to enact a federal privacy law. They want to avoid the confusion and complications of having to navigate a separate privacy law for every state in the US.

Why should it matter to publishers?

The California Act gives consumers the right to decide which personal data is collected and for what purpose. It also allows them to opt out of having their data sold.

Personal information as defined by the California Act are standard identifiers in the physical world (like driver’s license or social security numbers), digital identifiers (like email addresses or demographic data), online behaviors (like IP, search, browsing history, purchases, and interactions), and any inferred data.

The California Act isn’t quite as rigorous as GDPR. The California Act doesn’t require consent or permissions in the first place, instead focusing on a consumer’s control of who sees their data. Where it significantly differs from GDPR is the lack of a stop mechanism—companies can still collect information—and no initial consent is required.

Publishers who use ad tech that track visitors around the web with cookies and mobile advertising IDs should be aware that the California Act requires that publishers have an option to give people a way to ask for deletion of the information collected. If that personal information is sold or shared, the company must disclose the purpose.

3. Canada: Personal Information Protection and Electronic Documents Act (PIPEDA) for Publishers

What is it?

Canada’s PIPEDA came into effect in June 2015, with updates scheduled for January 2019. PIPEDA protects personal information entrusted to commercial organizations. Personal information includes a person’s age, name, ID numbers, income, ethnicity, blood type, comments, opinions, and employee records.

Why should it matter to publishers?

Targeting Canadians? Publishers will need to obtain their consent when they collect, use, or disclose the Canadian individual’s personal information in the course of any commercial activity. The federal-level PIPEDA gives the user the right to access any personal information gathered, and be informed if that information is used for any other purpose than the original communicated intent.

Like GDPR and the California Act, PIPEDA charges the publisher with protecting the personal information gathered, regardless of whether that is handled directly or by third parties. Interestingly, PIPEDA doesn’t cover any business contact information that an organization collects, uses, or discloses for the purpose of communicating. Note that PIPEDA is one of several laws in Canada that relate to privacy rights.

There are 10 principles for publishers to follow, which outline: accountability: identifying purposes; consent; limiting collection; limiting use, disclosure, and retention; accuracy; safeguards; openness; individual access; and challenging compliance.

Any publisher that breaches PIPEDA could face fines of up to $100,000 CAD.

Privacy Matters

There you have it, three major privacy acts you need to know about as a publisher in high economic demand areas. Privacy laws are complex and this article is meant as an overview, not a replacement for legal advice. The reality is that with increasing legislative and consumer focus on data breaches and digital privacy and protection, scrutiny and guidance is likely to increase. As such, we plan to keep a close eye on these important issues and think you should too.

About the Author

Trish Manrique is a Content Marketing Partner at Sortable, a Canadian customer-focused, data-driven ad tech company.

Footnote: What is the European Union (EU) and the European Economic Area (EEA)?

There’s some confusion as to what the EEA is, versus the EU. The European Union (EU) is a union of 28 member countries and both a political and economic grouping. (Source: https://www.gov.uk/eu-eea)

The European Economic Area includes EU member countries and includes countries from the Scandinavian region. We’ve listed it in a handy table below.

The European Economic Area (EEA) includes EU countries and also:
Iceland	(IS)
Liechtenstein	(LI)
Norway	(NO)
**Switzerland (Confederation of Helvetia) - Swiss nationals living in the UK are applicable	(CH)
The 28 EU countries and their country codes are: Austria, Belgium, Bulgaria, Croatia, Republic of Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and the UK.
Austria	(AT)
Belgium	(BE)
Bulgaria	(BG)
Croatia (Hrvatska)	(HR)
Republic of Cyprus	(CY)
Czech Republic	(CZ)
Denmark	(DK)
Estonia	(EE)
Finland	(FI)
France	(FR)
Germany	(DE)
Greece	(GR)
Hungary	(HU)
Ireland	(IE)
Italy	(IT)
Latvia	(LV)
Lithuania	(LT)
Luxembourg	(LU)
Malta	(MT)
Netherlands	(NL)
Poland	(PL)
Portugal	(PT)
Romania	(RO)
Slovakia (Slovak Republic)	(SK)
Slovenia	(SI)
Spain	(ES)
Sweden	(SE)
The United Kingdom	(UK)

**though neither an EU nor EEA member, Swiss citizens may reside and work in the UK, like other EEA nations.

In search of a Goldilocks solution to online privacy

October 4, 2018 Mark Glaser, Founder and Publisher – MediaShift

For years, large tech companies have spent millions on lobbying in Washington to make sure that they escape tough regulation. And until recently, they have been successful.

But today is a new day—one where tech companies are actually asking for regulation. How did we get here? Trust in tech giants is at an all-time low. And practices that include collecting untold amounts of data, even when consumers think they have privacy (see: Google Data Collection research); selling data to nefarious players (see: Facebook and Cambridge Analytica); and losing their data to hackers (see: Facebook’s newest data breach of data from 50 million users) has focused the attention of lawmakers in the EU and United States.

While past Senate hearings have at times felt like introductory classes to social media, with tech representatives slowly explaining how their platforms work, last week’s hearings on consumer privacy took on a different tone. “The question is no longer do we need a law for consumer privacy; the question is what shape these laws will take,” Committee Chairman Senator John Thune (R-SD) said in his opening remarks.

Now, the tech industry has come to realize it can’t escape regulation, and Facebook’s data breach has only heightened the stakes. But the question is how you make everyone happy with new regulation, with tech companies chafing at California’s strict new privacy laws and the European Union’s GDPR. How do we get to the “Goldilocks” policy? One that’s not too loose for consumers and not too strict for advertising and commerce. And how much will publishers need to change their ways to comply?

The Limits of Self-Regulation

In the past, as critics have expressed more and more concern over privacy — and investigations have revealed the ways in which nefarious players have mined user data for insidious targeting — tech giants have slowly policed themselves. Facebook, for example, announced in August that it would remove 5,000 options on its site that ask for “sensitive personal attributes” that enabled advertisers to hyper-target and limit their audiences.

Facebook says the move was more pro-active on its part and not in response to anything in particular, though the timing is suspicious after a lawsuit leveled by fair housing groups charging that advertising on Facebook could prevent minority communities from seeing housing ads. The routine is now becoming familiar: Scandal on a tech platform related to data. Platform tries to solve problem with new rules and its own regulation. Remember Cambridge Analytica? If not, look no further than what Facebook is currently facing with its latest data scandal.

But last week’s hearings revealed that representatives from major tech companies like Amazon, AT&T, Google and Twitter— along with the IAB, which had previously favored self-regulation — are warming up to the idea of some kind of federal legislation that, in theory, would mandate actions that might prevent future scandals. They said they’re in “widespread agreement” about that, which Google also acknowledged in a proposal for privacy regulation it published just a few days before the hearing.

Meanwhile, publishers have had to take action to comply with GDPR from Europe. And while they realize it’s a hassle, and privacy-policy pop-ups are annoying for users, there can be upsides. At a recent panel discussion at Marfeel in Spain, publishers noted that they now could take responsibility for first-party data they collect, and make sure it’s secure so that users are comfortable handing it over.

“So, I think if there’s any silver lining, it’s that publishers in general and the media companies in general are now actually taking responsibility to collect that first-party data instead of simply hoping that Google and Facebook would play nice and share some of that,” said Rithesh Menon, vice president of monetization and account management at Good Media Group.

Operating in the Shadow of Europe and California

While this may seem like a drastic change of stance among tech companies, remember they’ve already had to pivot to new privacy laws in Europe and California. In fact, the reasoning behind their embrace of federal privacy laws is that they’re trying to avoid legislation that’s as strict as Europe’s GDPR or California’s Consumer Privacy Act. That was obvious during the Senate hearing, where tech representatives called out both laws in urging Congress to “strike the right balance,” as Leonard Cali, AT&T’s senior vice president of global public policy, put it.

Representatives from Google, Apple, and Twitter, for instance, discouraged Congress from following in the footsteps of the GDPR by noting that small and medium-sized businesses might not have the financial backing to take on the compliance costs that would come with GDPR-like legislation. Amazon’s representative pointedly critiqued California’s privacy bill, arguing it doesn’t promote the best privacy practices.

Theoretically, if federal law is not as strict as state law, tech companies could bypass California’s strict regulations that might very well serve as a model for other states, because federal law would trump state regulations. But Congress also noted that strategy is not what it has in mind.

“Your holy grail is ‘preemption.’” Senator Brian Schatz (D-HI) said. “And we’re not going to replace a strong California law with a weaker federal one.”

Having a Seat at the Table

Having a seat at the table when it comes to drafting federal regulation is in the best interest of tech companies at this point. But the reality is that their huffs and puffs about how strict other legislative models are might not do them any good. With yet another Facebook data breach, consumers and lawmakers alike are fed up.

California’s new law requires that people can see what data companies have on them — which makes perfect sense from a consumer perspective. And the EU is still pushing social media platforms to adjust to a new way of operating under GDPR. European Commissioner Vera Jourova warned Facebook to change some of its terms and conditions by December, so the company can finally tell users how it utilizes their data for commercial purposes. It’s a wake-up call for tech companies that the EU is not going to budge — and that gives American lawmakers the chance to pile on with more conviction.

Now that the tech giants have asked for regulation (though of course of the weaker variety), it is up to Congress to take action. But first, they also have to listen to consumer groups — because a table of decision-makers that only includes one side would not look good. Senator John Thune said Congress is not in any rush toward a decision. But let’s hope one emerges before another data breach occurs.

Industry-Research

GDPR triggers many European news sites to reassess their use of third-party content

September 4, 2018 Rande Price, Research VP – DCN

News websites in Finland, France, Germany, Italy, Poland, Spain, and the UK are placing considerably fewer cookies without user consent post the implementation of General Data Protection Regulation (GDPR). According to Reuters Institute’s (RISJ) new research, Changes in Third-Party Content on European News Websites after GDPR (July 2018), news sites now have 22% fewer third-party cookies than they did prior to GDPR. This study’s findings add to RISJ’s earlier report, Third-Party Web Content on EU News Sites: Potential Challenges and Paths to Privacy Improvement (April 2018). The April research showed news websites tend to have a higher volume of third-party content and cookies than other popular websites.

Websites often use third-party content for advertising and marketing purposes, for audience measurement, to optimize website design, to facilitate social media sharing, to recommend articles, and to host content such as videos. Many of these common third-party practices fall under the GDPR guidelines. The GDPR may require websites and third parties which collect user data to obtain user consent before processing the data collected.

Reuters Institute utilized the webXray software to identify close to 500 different companies and services associated with third-party content across 200 news sites.

Additional research findings:

News sites hosting third-party social media content, such as sharing buttons from Facebook or Twitter, dropped significantly, from 84% in April to 77% in July.
On average, the number of cookies from design optimization tools is down 27%, advertising and marketing cookies down 14%, and social media cookies down 9%.
Overall Facebook, and Amazon have the largest presence across the European news sites. Aside from Google, the overall reach of the 9 other companies (Facebook, Amazon, comScore, AppNexus, Oath, Rubicon Project, AdForm, The Trade Desk and Criteo) declined in July 2018 compared to April 2018.

The findings presented here reflect site activity prior to obtaining consent. Importantly, these changes suggest that some news organizations are responding to GDPR either by obtaining consent for third-party tracking or by curbing the use of outside cookies in general. The research suggests that news sites recognized the potential risks posed by third-party content and removed it or ensured affirmative opt-in from their users.

Uncategorized

Policing third-party code is essential to digital vendor risk management

August 17, 2018 Chris Olson, CEO & Co-Founder—The Media Trust

Some of the biggest companies including Saks Fifth Avenue, Lord and Taylor, Best Buy, MyFitness Pal, and Applebees have been the victims of breaches due to third party code. Third parties provide services around content recommendation engines, ads, customer identification platforms, data management platforms, social media widgets, and video players, to name a few.

Oftentimes, these third parties turn to their own third parties to help deliver their services. When unknown third (or nth) parties become part of a website’s support structure, they can introduce more risks than they were brought in to reduce, because they lie outside of a formal IT organization’s control. Gartner predicts these “shadow IT” will be the root cause of 33% of security problems by 2020.

Throwing light on digital shadow IT

Last year, one of the world’s largest magazine publishers was shocked to find their sites were supported by over 1,000 third parties. This year, they were able to winnow down that number to 100 of the most trusted. In July 2018, random sample of 350 of The Media Trust’s publisher clients showed that each of their domains was supported by an average of 140 third parties, which provided anywhere from 50-95% of each site’s code. For the magazine publisher and those in the random sample, most of these third parties (much less their activities) were unknown to them.

Recently, The Media Trust digital security and operations team found and foiled a malware campaign that affected close to 60 major publishers whose audiences span the globe. These publishers’ trusted digital advertising partners had unknowingly served an ad with malicious code that would replace the legitimate creatives of a globally recognized brand. The code would redirect visitors to a Facebook popup informing victims that they had won a prize and encourage them to enter personally identifying information.

What sets apart this campaign from other redirects is its scale and its targets: some of the world’s most popular online publications that deal only with reputable digital partners. While the campaign was effectively halted, it spotlights the growing challenges of managing the risks third parties and their own vendors can introduce to today’s ever-more dynamic, complex digital ecosystems.

Third-party code putting companies at risk

Third parties can pose risks in several ways. First, they tend to have weaker security measures. This makes them ideal attack vectors for bad actors. The headline-grabbing breaches of Target, Equifax, Ticketmaster, and, more recently, Adidas, prove how popular third parties are to exploit because of their vulnerabilities. In this scenario, when taking on a large organization, hackers will first target a third party and use it as a gateway to enter the larger network.

Second, third party code operate outside the website operator’s cybersecurity infrastructure. Their activities, authorized or otherwise, can neither be monitored nor remediated by the publisher’s marketing and IT departments. As a result, user experience can deteriorate and erode a publisher’s topline and reputation.

However, another, more serious consequence is the unsanctioned collection of user data, which in the EU will expose the publisher to the risk of infringing the GDPR and, soon, the ePR, whose scope is expected to be broader and penalties equally stiff. In fact, the ePR could potentially override the GDPR. Non-compliance is therefore a risk, and will figure prominently in other sought-after markets like Canada, which will enforce PIPEDA later this year, and California, which recently passed the California Consumer Privacy Act.

Reining in risk

Unless they have the tools to actively monitor third party-code, website owners will likely remain unaware of the broad range of code that execute on their sites and of how unexpectedly and frequently new, unknown code appear. The ability to identify, document and authorize these ever-changing vendors is critical to properly mitigate risk. Not only do most enterprises not know the full scale of vendors executing code, but they would be surprised at the amount of consumer data collection activity, i.e., cookie drops, pixel fires, device fingerprint, etc.

Continuous monitoring from your customers’ points of view helps IT teams pinpoint how these vendors and their actions—specifically the domains executed and cookies dropped—change according to user geography, browser, or device. Collecting this type of vendor intelligence provides clear insight into third party behavior to protect customers and brand reputation from cyber threats.

Working with third parties toward strong security posture

Third-party application security is essential for today’s IT security compliance, especially now that regulations are proliferating. Even if the security risk resulted from a third-party compromise, the legal responsibility falls on the primary organization. Therefore, it is crucial that organizations take sufficient steps to manage third-party risk and ensure a safer online environment for themselves and their users.

To do that businesses need to ensure that both their systems and those that look beyond their perimeter to third and nth party codes are secure. First, they should carefully vet all third parties by conducting a risk assessment before bringing any third parties on board. Second, they should maintain a continuously updated inventory of their direct and indirect third parties. Third, they should spell out security policies and standards and use contract clauses and SLAs to enforce them. Fourth, they should follow through by conducting periodic audits of third party security measures. Finally, they should conduct continuous, real-time scanning of their websites to identify any unauthorized code and activities and then compare their findings with what is executing on their visitors’ browsers outside their firewall.

These steps will help to mitigate risk and lock out bad actors from digital ecosystems. Taking a proactive approach to cleaning up and protecting websites will improve the company’s security posture, ensure customers’ safety and protect organizations from the high, upcoming fines of the GDPR and other regulations that follow it.

About the Author:

Chris Olson co-founded The Media Trust with a goal to transform the internet experience by creating better digital ecosystems to govern assets, connect partners and enable Digital Risk Management. Chris has more than 15 years of experience leading high tech and ad technology start-ups and managing international software development, product and sales teams.

Perspectives

Post-GDPR, are data clean rooms the answer to accessing walled gardens?

August 15, 2018 Karen Moked, Vice President of Marketing–Digilant

As of May 25, 2018, Google announced that DoubleClick users will be unable to rely on cookies or mobile device IDs to connect impressions, clicks and site activities from DoubleClick logs. Instead, they will be limited to Google’s own Ads Data Hub for those metrics.

For some, this means that they are satisfied to stay within the Google stack. But not every brand’s solution will be and should be limited to Google. If media buyers want to analyze their spend outside of Google’s platform and offer up any attribution, then just using Google won’t work.

“Some marketers who spend 75 percent or more of their budgets on Google will be fine just letting Google do the analytics,” says Alice Sylvester of Sequent Partners.

Google wasn’t the only one to lock down its platform. In response to the combined pressure of GDPR and the Cambridge Analytica scandals (related to handling of personal information), Facebook decided that it would shut down ad tools called “Partner Categories” powered by outside data brokers. Those tools let Facebook advertisers target ads at people based on third-party data such as their offline purchasing history.

This means advertisers will have access only to their own data, and data Facebook collects itself. If an advertiser wants to pull campaign-level insights to inform future campaigns, or use the data for the basis of an attribution model, then they are out of luck.

Introduction of Data Clean Rooms

Data clean rooms allow large inventory partners like Facebook and Google to share customer information with brands, while still maintaining strict controls. Data clean rooms were named for the completely airtight rooms where microchips and other sensitive materials get made. In this case, the rooms enable a shared environment between two or more companies that are completely secure from external access (no wifi), and where each company decides the level of visibility to their data. This eliminates – or severely restricts – the possibility of data leakage (which is what happened with Facebook and Cambridge Analytica).

“We and a partner combine a data set with very specific rules and controls around how each party can operate within the shared environment,” said Scott Shapiro, a product marketing director for measurement at Facebook, who noted that Facebook didn’t invent the clean-room concept.

The driving force behind the concept is to create a safe space where data can be shared and manipulated without leaving the inventory partner’s environment. Specifically for Facebook, a brand can create an audience based on first-party data – like a list of email addresses – and then push that list into Facebook, match it, and grab a copy which they can later combine with their data as the basis for attribution, measurement, and modeling.

How it happens in reality is that an advertiser will load a clean or wiped laptop or device that has never been connected to the Internet with that advertiser’s first party data, which in most cases is an email list. A second clean computer is loaded by Facebook or Google with impression-level and non-personally identifiable information (“PII”) campaign data.

Maybe, The Answer to Scaling The Walled Gardens?

For advertisers with reams of data and substantial programmatic advertising budgets, this is a great opportunity to scale the otherwise elusive walled gardens. Data clean rooms create a safe environment for data providers to share marketing information that brands need and crave to model future media buys and advertising strategies. If managed properly, with appropriate methods and standards, this technique would allow brands to really understand their walled-garden ad spends within the larger marketing ecosystem. For both advertisers and publishers alike, the stakes are high in the post-GDPR world of data governance, and there is no room for unintended data sharing because consequences are severe.

Marketers have been eager to get more insights out of Facebook and other walled gardens, but it remains to be seen how aggressively brands and agencies will use data clean rooms to make the most of the spending with the largest inventory providers (e.g., Google, Facebook).

There are two prevailing views for what the future holds:

Glass half-empty: These same inventory providers lack a compelling incentive to play well with others in clean rooms, beyond delivering another level of customer service in a marketplace they continue to dominate.
Glass half-full: It’s been a daunting year or more for the industry category, with virtually continuous coverage related to privacy violations, bad actors influencing politics, and fraud and transparency challenges. The ‘clean room’ concept may be a half-step that the duopoly can get behind, if only as a signal of good faith to the industry.

There is also the overriding issue of what kind of manpower (likely significant) would be involved to make the clean room option a viable reality. The usefulness of data in this kind of an environment may also be somewhat limited No matter, though: The data clean room concept is one that’s getting some attention. And, considering its appeal among the dearth of options out there that seem appealing to all the affected players – brands, agencies and inventory providers – it could be one that ends up getting traction.

About the author

Karen Moked is the Vice President of Marketing at Digilant, a programmatic media company in Boston. A veteran of the advertising and technology industries, she previously worked for Akamai and O’Reilly Media. Karen is a graduate of MBA-ESG in Paris and York University in Toronto. Connect with her on LinkedIn and Twitter.

Advertising | Perspectives

Three inventory quality trends to watch in digital advertising

July 24, 2018 Eric Bozinny Director, Inventory Quality—PubMatic

Ensuring the high-quality of inventory across the PubMatic platform, as it flows from sellers to buyers, requires strong policy, which standardizes compliance enforcement and operational coordination across account teams so that we spot issues early and often. It also requires a strategic focus on identifying what lies ahead for quality.

I’d like to share my thoughts on a few growing trends I expect to see regarding inventory quality. These views come from an amalgamation of inputs: my 10 years of experience in managing inventory quality, the signals and other clues arising from my daily quality operational work, and deep-dive investigations. Buyers have shifted their emphasis to quality and are focused on working with other quality-centric professionals across the industry.

Here are three major inventory quality trends:

Over-Reliance on Fraud Detection Technology

The industry has clearly spoken – third-party fraud detection is now considered “table stakes” for any large player, buyer or seller, in the digital advertising ecosystem. Though fraud detection vendors play an important role in helping to identify and avoid invalid traffic (IVT), I would advise treating this service as one tool among others to help improve quality.

Why?

No vendor measures quality the same way, yet many of them share the same MRC certification for Sophisticated IVT (SIVT). PubMatic uses a combination of IAS and White Ops to monitor invalid traffic rates and identify problematic pockets of inventory. However, many buyers use different fraud detection vendors and they may report very different results for the same inventory. These variances can be explained by unique proprietary methodology and differences in sampling where one vendor may look at a completely different subset of the same inventory vs. another vendor.

For example, if “Buyer A” is reporting their inventory is 100% IVT, while PubMatic’s White Ops reporting is showing 1%, the promise of fraud detection technology as a standalone method to identify non-human traffic breaks down. Yet, when stepping back and viewing fraud detection as a starting point, conflicts between buyers and sellers are more likely to come to an agreement. I believe this because both parties can recognize that even with big differences in fraud reporting, a deep-dive investigation will uncover other signals that likely support one report or the other.

In this specific example, I may find other evidence supporting the buyer’s claim and could come to a mutually agreeable conclusion (e.g. refund, blacklisting, termination of supplier, etc.). However, as often as not, my investigation might raise no other red flags to indicate poor inventory, and thus I would propose limiting access to that inventory for this buyer.

Growing Importance of Content and Audience

GDPR has impacted the ability of marketers to fully utilize the targeting potential of cookies and audience profiles in EMEA due to the regulatory changes in consent and privacy. One could argue GDPR is a direct consequence of the rise of ad tech and the lack of self-regulation concerning how the data of consumers are used in the targeting of advertising. Therefore, it is not unlikely that similar consumer data privacy and consent laws will spread around the globe. This will further reduce the efficacy of cookies and precipitating the return of contextual targeting for online advertising.

What does this mean? An increased focus on the quality of content—addressing fake news and brand safety concerns—as well as the quality of the audiences who consume this content as important quality trends in the marketplace.

Recognizing the importance of content and audience to buyers, PubMatic evaluates domains and apps not only on the level of IVT but also on the value of the audience and originality of the content. For instance, an organic, loyal audience is preferred to consumers acquired from other sources. We also avoid content farms and look-a-like sites that exist only as a necessary backdrop to sell ad impressions.

The Importance of Whitelisting and Ads.txt

Since ads.txt was introduced in 2017, adoption has been accelerating. Pixalate reports that as of March 2018, more than 50% of the top 5,000 programmatic sites have adopted ads.txt.

While ads.txt is a valuable tool to combat domain spoofing, it provides no inherent protection against IVT (bots and fraud). Further, it does not guarantee the quality of a domain’s content and audience. For example, a domain created solely for the purpose of driving bot and/or acquired traffic through pages filled with content stripped from other sources can have an ads.txt file, but still be a bad source of inventory.

Thus, working with a whitelist of trusted domains is the single best practice for both buyers and resellers of inventory. Being familiar with the domains on which ads are running, and avoiding all other domains, is the best prevention.

I strongly suspect that most of the behavior leading to poor quality inventory comes from the point where money changes hands—the domains and apps where advertising is consumed. By wisely choosing which domains to work with and working with only whitelisted domains, many quality issues will be avoided entirely. Alternatively, when a small group of domains isn’t enough to meet inventory requirements, working with trusted partners can also provide improved inventory quality and improved brand safety.

Advertising | Revenue

6 Business questions to consider before investing in programmatic advertising

July 17, 2018 Margaret Farmakis. VP—Sovrn Services

Having worked for an email data company in a previous life, I’m used to the predictions that people love to make about the death of a specific marketing channel. Remember when Slack was going to kill email or Google+ was going to kill Facebook? We all know how those worked out.

With GDPR now in effect, I’ve been hearing a lot of predictions about the impending demise of programmatic advertising. What’s ironic is that greater transparency and protection of consumer privacy rights are very positive steps forward for the industry. So, for publishers who’ve never invested in programmatic, now is actually a great time to do so.

That being said, as with any investment of time, money and resources, companies should arm themselves with as much information as possible; consider what’s best for their business (instead of focusing on what everyone else is doing); and make sure that they understand the potential benefits and drawbacks of making such an investment.

Here are six business questions for publishers to consider before investing in programmatic:

1. What are your goals?

This may seem obvious, but beyond making money, it’s important for publishers to clarify exactly what success looks like and define their desired outcomes. In addition to a new revenue stream, do your programmatic goals include: gaining insights into your audience data and behaviors? Exposing your inventory to a new set of buyers? Expanding brand recognition? Gathering data to build a business case for a larger investment? Or perhaps you are considering using programmatic to drive ecommerce activity? Each of those goals requires a different approach, so it’s important to define the “why” before focusing on the “how.”

2. How much does the user experience matter?

Too often we see publishers making trade-offs with the quality of their user experience in favor of displaying more ads or using ad formats that aren’t in-line with IAB or Coalition for Better Ads standards. It can be tempting to forgo best practices when revenue is the only metric that matters (which it shouldn’t be).

Your users—and their willingness to visit and spend time on your site on a consistent basis—are even more valuable. That’s why it’s important to ensure you have a responsive site with load times of three seconds or less (Google shows quicker-loading mobile pages higher up in its search results) and a design that is uncluttered and easy to scroll and click-through. Don’t let first-order thinking trump what’s best for your users.

3. What is your biggest fear?

Before investing in anything new, it’s a good idea to go through a fear-setting exercise. Tim Ferris has a great template that he designed to be used for working through personal and life decisions, and it can also be applied to business decisions. This includes:

Defining your fear (what is the worst thing that could happen);
Outlining what steps you could take to prevent the worst possible outcome;
If the worst outcome happens, defining the steps you would take to repair the damage; and
Determining the short- and long-term costs of taking no action at all and sticking with the status quo.

For most publishers, this exercise would likely involve fears related to ad quality or fraud issues. If that’s the case, consider using anti-malware software (like Confiant), which can help prevent malvertising. It’s not foolproof, so to repair the damage, publishers should have a plan for investigating and taking down these ads. For example, have a segment of super users you can rely on to report issues and test fixes. And work with reputable partners who have rigorous approval standards in place and will be responsive to your support requests.

4. Are you taking a collaborative or siloed approach?

If you’re a larger publisher, you may have the budget to invest in creating fully-staffed teams to focus on sales, ad ops, and editorial. If so, don’t make the mistake of running those teams in silos with little to no opportunity for cross-functional collaboration.

When it comes to programmatic advertising, everything is connected, and shared goals are critical for successful outcomes. Decisions involving how your inventory is sold and trafficked and the page(s) it’s displayed on require ongoing and frequent communication between the sales, ad ops and editorial teams to ensure the best possible results. For successful collaboration to take place, it’s important to define the dependencies between teams and how each individual team contributes to the bigger picture of increasing user engagement through producing original content that also displays relevant advertising.

5. How important is testing and optimization?

I don’t know of a single marketing channel where the marketer doesn’t gain performance improvements by adopting a learning cycle of testing, adjusting, and optimizing. Often, the whole point of investing in a new channel is to gather data you didn’t have before. Then you can use the data to test a variety of hypotheses that result in varying degrees of ROI. This means it’s important to consider if you have the tools, resources and tolerance for continually tweaking what’s working (and what isn’t) to produce the best possible results and get the highest return possible on your investment. It’s an art and a science and it takes time to perfect, but it’s worth it.

6. What type of company do you want to work with?

The ad tech space is full of companies providing a wide variety of products and services for publishers. Not all of them will suit your needs or align with your business practices, so it’s important to do your research. Pay particular attention to claims that seem too good to be true (for example, promises of 100% fill rates). Ask questions about a company’s support model (for example, what are the average response times, how are requests prioritized, and what is the coverage model on weekends and holidays).

It’s also important to understand how each company is (or isn’t) compliant with the various US and international data collection and privacy laws governing digital advertising (i.e., GDPR, COPPA, PIPEDA, CAN-SPAM, etc.) and whether they’ve implemented the bare minimum for compliance or adhere to both “the spirit and the letter” of the law. For example, Sovrn is the only exchange offering a free Consent Management Platform (CMP) to help publishers with GDPR compliance, instead of putting the burden on the publisher to figure out how to be compliant on their own.

According to eMarketer’s “US Programmatic Ad Spending Forecast 2018,” almost $47 billion will go to programmatic advertising this year. And, by 2020 programmatic will account for 86.2% of digital display spend. Now is a great time to explore if programmatic is worth investing in for your business. Start by focusing on what makes your content and audience unique, your tolerance for risk, your desired outcomes and what you want to learn.