Login
close
Login is restricted to DCN Publisher Members. If you are a DCN Member and don't have an account, register here.
Search

Digital Content Next logo

Menu

Tags containing: "privacy"

Featured Post | Innovation

The New York Times helps consumers decide where to draw the line on privacy

The waves of negative press about privacy intrusions and breaches are becoming a regular occurrence. Yet the outrage cycle seems to have a short lifespan and there’s confusion and a range of expectations when it comes to data collection and usage. That said, consumers need to remain vigilant about new and unexpected ways digital organizations leverage personal data collection.

Already, we face some pretty significant questions: Do you want your genealogy company to sell analysis based in your DNA? Your smart doorbell clips accessible by warrant? Mugshot-matching facial recognition capabilities?

That’s why Stuart A. Thompson, graphics director of The New York Times Opinion section, and his team set out to figure out how people report their comfort levels in terms of sharing different kinds of personal information. The work, published earlier this month, is part of the ongoing Privacy Project at the paper. It’s a series examining the different ways private groups and governments are using personal information.

Understanding the limits

Perhaps encouragingly, The Times found that consumers are taking notice of the data collection policies of the services they chose to use. But they’re not exactly excited about it when they find out. Many of the activities asked about — which were found to be outside of 90% of respondents comfort levels — are already employed by tech companies.

Readers were asked about their comfort level about the various ways companies use, or could use, personal information. Credit: New York Times.

Thomson also said that there the results offered clear take always for digital publishers. Acknowledging the reliance on third party tracking in the news site business, he explained that blind acceptance of those practices could be coming to an end. “Even if you have an airtight privacy policy that you feel ok with now, you might not feel as okay with it when people start paying attention to what you’ve done or criticizing what you’ve done,” said Thompson.

Privacy by design

Thompson said the goal of this project is to learn what was “the line” for his readers and he used a pretty clever page layout to do so. Readers scroll through increasingly intrusive privacy scenarios and then place a line over the example which they felt uncomfortable with. This skeuomorphic interaction is a technique that The Times has previously used with good results.  

“Drawing things was a New York Times/Upshot trademark way to get people to interact with us,” said Thompson. “We were talking through as a group, and I think we kind of fixated on the line.”

One element Thompson wanted to address head-on was the idea that consumers continue to make privacy related decisions that aren’t in their interest, dubbed the privacy paradox.

Understanding the big picture

However, to Thompson, they’re not acting irrationally or unexplainably. People are just caught in larger systems. Individuals aren’t given real opportunity to give consent of the personal data use, such as in cases where data is required to be handed over in order to access a service, and there aren’t consumer guardrails around those practices.

With appropriate regulation, consumers shouldn’t “have to read every detail of a data policy or a privacy policy to consent to what’s happening, because you have to do that a dozen times a week,” said Thompson. “We’re not prepared for that kind of activity and we’re not very good at it.”

He added that tech companies have taken advantage of consumers’ difficulty with risk management. As a result, governments and regulatory bodies have had to enact legislation like the General Data Protection Regulation in the European Union.

The stakes get bigger

Another example of the push back against the surge in the surveillance economy was a lawsuit against the efforts by Alphabet subsidiary Sidewalk Labs in Toronto. The plan to build a smart city in the portland’s of Canada’s largest city could incorporate any number invasive new forms of data collection.

To nip that in the bud, the Canadian Civil Liberties Association launched an application to sue on the grounds that the wholesale data collection of people who just happen to be in the area aren’t allowed under the Charter of Rights and Freedoms protections including against unreasonable search and seizure. While this case is immediately relevant for the smart city project, it could help society establish a point at which it “draws the line” about privacy overall.

But at the end of the day, the path to better privacy management could start closer to home.

“As publishers are working in the public interest, maybe they have an additional responsibility to declare what they’re doing,” said Thompson. “You could argue that they are acting in this pure business sense and they have their own lines that they’re willing to to draw, [but] maybe publishers should think about what they’re comfortable with.”

Perspectives

My data, my rules

Recently, Facebook CEO Mark Zuckerberg published a new company manifesto called “A Privacy-Focused Vision for Social Networking.” In it, Zuckerberg acknowledged Facebook’s poor privacy track record: “frankly we don’t currently have a strong reputation for building privacy protective services.” Who knew he had such a gift for understatement?

Zuckerberg outlined a new approach for the company, in which Facebook will build services that allow people to communicate privately. Apart from acknowledging the extreme examples of “child exploitation, terrorism, and extortion,” Zuckerberg doesn’t say how he will address the very real concern that he may be enabling the more problematic aspects of Facebook’s effects on society to flourish without scrutiny. Nor does he say that he is changing Facebook’s basic model of hoovering up data about its users and monetizing it through marketing.

However, Zuckerberg is clearly responding to growing concerns about how the digital world impacts our privacy. I share these concerns. I also have a suggestion for how they should be addressed.

The Problem With Privacy Policies

Let me start with two questions. Have you ever read a company’s terms of service or privacy policy all the way through? Have you navigated through the bowels of your social media service’s privacy settings to establish what data they can collect and how they can use it?

If you are like most people, the answer to these questions is “no.” According to Deloitte, 91% of us don’t read the terms of service. Most of us are not equipped with the knowledge base or willing to spend the time needed to navigate through privacy policies and privacy settings. In 2008, one study estimated it would take a typical internet user 244 hours a year to do so! And it is surely worse today.

The Cost of Free

We sort of get that when we use a “free” service, the real “cost” of that service involves giving a company access to data about ourselves. But we only sort of get it because we don’t really know what we are giving up, and therefore we are not in a position to assess whether it’s a good deal or not. Spoiler alert: it’s not.

For starters, the value exchange between consumers and service providers is completely opaque, with only one side of this transaction really understanding what is going on. Without knowing the terms of a deal, how can you be sure it’s fair?

As my colleague Pooja Midha says, with transparent value exchange, everybody can win. Before the rise of the internet, the value exchange for all advertising was relatively clear: The ads were the cost (or part of the cost) of access to the content. If you wanted the content, you “paid” for it by giving your time and attention to the ads. Sure, we can turn the pages of the magazine, or grab a sandwich at a commercial break, but that behavior was expected and factored into the price. Both consumers and marketers had a pretty clear idea what they were getting and what they were giving up.

The Data Dilemma

With the internet, that all changed. Free services like those offered by Facebook and Google didn’t offer content, they offered functionality. And they offered it in exchange for consumers’ time and attention paid to advertising. Or, at least, so it seemed. But the unique, bi-directional nature of internet-based services allowed for a second source of value to flow to a service provider – data. And data is where the real money is.

A recent survey asked consumers whether they would be willing to share their data for a price and what price. A majority (57%) said it was worth a minimum of $10, while 43% valued it at less than $10. The higher the income, the more likely they were to want more for their data.

This stands in stark contrast to the true value of their data. Facebook’s average annual revenue per users in the US and Canada was reported to be near $112 in 2018. Think about that. US consumers think their data is worth $10 or less, and just one company is generating $112 from their data.

Regulatory Restrictions

Transactions where consumers are faced with huge information imbalances are often targets for government regulation. It is no surprise to see the GDPR efforts in Europe and the activity happening in California with the passage of the California Consumer Privacy Act, and the Governor’s recent call for a data dividend to be paid to consumers. While renewed interest in privacy and more transparent value exchange is great, it doesn’t address the core issue. Let me explain.

Today consumers have to choose whether or not they are willing to abide by the myriad privacy policies of all the different companies they engage with over the internet. In my view, that is exactly backwards. It puts the burden on the party with the least information, and in the worst position to understand the details of what they are getting into.

Personal Control

I have a better idea: My data, my rules. Imagine if you could go to a central site and establish what data can and cannot be collected from you, and at what price. This becomes your personal privacy policy. It follows you around the web, and any service you interact with has to abide by it. If you set your privacy policy to be too restrictive a service may not be willing to work with you, or work with you for free. But that’s ok! The value exchange is completely transparent. You both know what you are giving up and getting – unlike today.

This would be a huge step forward, empowering consumers, and making the digital world easier to navigate effectively, and the costs of doing so more transparent.

In a “my data, my rules” world the consumer is empowered and the value exchange is clear, with information and understanding similar on both sides. In a “my data, my rules” world, marketers can be confident that the data they are using is permissioned. This will reduce their exposure to brand damaging charges of “surveillance capitalism.” Like marketers, in a “my data, my rules” world, technology companies can engage with consumers more safely, knowing that the data they are collecting is permissioned, reducing the risk of ugly articles in the New York Times, and political fallout.

Personal Data Protection in Practice

There are two ways this change can happen. The first is government regulation. Think of it as the ‘do not call’ list on steroids. It may well be that this is the only way to flip current practice.

But there is another way. All it would take would be for a few key players to adopt this policy and refuse access to their platforms for any entity that doesn’t abide by a consumer’s stated privacy policy. For example, what if Apple or Google established rules that no app could be available in the app store unless it abided by the user’s stated privacy policy? Or if a large network operator like Comcast, Verizon, or AT&T required that everyone engaging with their customers abide by that customer’s privacy policy?

With one large player having established this as standard operating procedure, it would be hard for other companies not to follow. What consumer wants to use a service that refuses, as a matter of policy, to follow their preferences?

It is time for a change. Let’s stop hiding behind opacity and complexity. Instead let’s all live by a simple principle on the internet. My data, my rules.

Perspectives

How consumer privacy regulation creates opportunities for publishers

One of the main drivers behind programmatic’s meteoric growth (at least on the demand side) has been the ability to leverage data to find and buy specific users, out of seemingly infinite opportunities, wherever they might be online.

After all, this enabling of “audience-based buying” brought marketers closer to their long-held notion of advertising utopia: reaching the right person, with the right message, at the right time, in the right context.

Data Dilemma

It also, theoretically, went a long way to minimizing wasted ad spend and enabled significant performance gains. The ad dollars flowed. But this shift took its toll on the sell-side.

To secure programmatic budgets (which were growing steadily and taking dollars away from their direct IO business), publishers had to relinquish control over their hard-won audiences by allowing cookie access to DSP partners in real time via cookie syncing. In doing so, they allowed the buy-side to build up and store those valuable audiences in their own platforms, reducing the need to work with publishers directly to gain access to or insights about their users.

Regulation Matters

The rapid proliferation of user-based targeting has understandably been followed by recent increased focus on consumer privacy. The GDPR went into effect across EU member states in May of last year, limiting unfettered access to user information and the ability to share that information with multiple parties across the ecosystem.

With passage of the California Consumer Privacy Act (which really means all of the US, given California’s outsized influence) and the likely imminent passage of the ePrivacy Regulation in the EU in the second half of 2019, the push for greater consumer privacy legislation seems unstoppable. France’s recent lawsuit against Google also indicates that common industry solutions and frameworks for satisfying new consumer data collection, usage, and privacy regulations aren’t always holding up to legal scrutiny, making the prospect of sharing data widely across partners and vendors increasingly difficult in the future.

While the enactment of these measures on such a global scale erodes the value (and calls into question the long-term viability) of cookie-based buying, it may also open a door for publishers to regain over their data and audiences and re-assert their position in the advertising value chain.

Data Diligence

Here are three tips for publishers looking to capitalize on the moment:

Limit access to your pages

A quick Ghostery check across a number of premium sites shows just how easy it is for 3rd-parties to build pools of data on a given publisher’s audiences. Publishers should be constantly evaluating who has access to their users, and what they’re doing with the data they’re collecting. Partners who add value, either by enhancing audience segments with additional data, or providing analytics and attribution services, should be prioritized. Others, who may be packaging up and reselling data, should be de-prioritized or even culled. An added benefit to this pruning process: faster page loading for users.

Use your data to enhance deals with buyers

Creating greater audience scarcity (enabled through the culling process mentioned above) opens a door for publishers to work more closely with advertisers looking to gain access to their users (and maximize the yield they see from those users). Striking guaranteed and non-guaranteed deals directly with advertisers based on 1st-party audience segments gives publishers the ability to more closely link the cost of media to the value of audiences, and thereby extract greater revenue from their inventory, while also benefiting parties up and down the supply chain. Advertisers enjoy the confidence of targeting audiences using the most recent and accurate data pools. And DSPs and SSPs executing the deals incur less waste (and listening costs), because the inventory is pre-filtered to match only the audience the buyer wants.   

Let advertisers bring their own data

More than just building and monetizing their own audiences, publishers should start allowing advertisers to bring their first-party data to the table. One of the main benefits to this strategy is that buyers are able to trust the veracity of the audiences they’re buying. From a publisher’s perspective, it opens up new options for inventory segmentation that may not have existed within their proprietary audience pools. Overlaying additional data will always limit scale, by matching cookies at the source of origin rather than through DSP and SSP intermediaries. And publishers and advertisers can at least maximize match rates, minimize data loss, and decrease the risk of inefficient decisioning down the line – thereby offsetting scale issues to the greatest extent possible (while also commanding very premium CPMs).

Audience First

Consumer privacy legislation is pushing us to the point where the party closest to the consumer – typically the publisher – will increasingly enjoy exclusive access to those audiences as well. When we add the unique ability to know who that user is and what their interests are, the value soars. Couple this with the decline in quality and scale in the open exchange and what you have is publisher data that hasn’t been this valuable since programmatic began to take off.

Following these three steps will help publishers maximize that value. It will also deliver greater efficiencies and performance to advertising partners as well as privacy consideration to valued users.

About the Author

Mike Pugh is a Senior Solution Consultant at IPONWEB where he acts as the intermediary between clients and IPONWEB’s design, delivery, and engineering teams to create custom ad tech projects. He is responsible for bringing client-specific solutions to market and ensuring a successful execution of the solution, strategy, and opportunity.  Mike is currently the team lead on the TrustX SSP as well as other strategic business accounts.  Prior to joining IPONWEB, he led a team of 14 programmatic traders at Accuen, Omnicom’s trading desk.  Mike has experience managing programmatic buying campaigns across the Autos, Retail, CPG, Financial, and Pharma verticals on most major DSPs.  Mike graduated from the University of Iowa with a Bachelor’s Degree in Economics and DePaul University with a Master’s Degree in Economics & Policy Analysis.

    Perspectives

    Striking the right balance: personalized and contextual advertising

    As online advertising has shifted predominantly to programmatic channels, personalized advertising has also exploded as marketers are able to leverage data at scale to reach their consumers. However, user privacy has increasingly become a global focal point for both consumers and the advertising industry as a whole. Both publishers and advertisers now need to adapt their methods in reaching consumers beyond just personalized, audience or behavioral targeting.

    Personalization Matters

    Leveraging data to make more informed ad targeting decisions is a breakthrough versus previous methods where ads were un-targeted. Personalized ads are a win for all parties. It is better for:

    • Users (connects them to more interesting and relevant ads)
    •  Advertisers (results in higher return on investment)
    •  Publishers (delivers higher CPMs and increased revenue)

    Unfortunately, not all targeting is created equal. Certain industry practices have resulted in unpleasant user experiences. Needless to say, these should be avoided (i.e. excessive/ sticky re-targeting where ads follow users around the web).

    Users should have the right to avoid cookies and personalized ads via an opt-out option in ads, or via their web browser settings. In Europe, GDPR legislation that went into effect in May 2018, now gives consumers in the EU even more control over their personal data – publishers in the region (as well as global publishers with European consumers) now need user permission for cookies for advertising purposes. It is striking to see that according to our measurement (GDPR barometer) which tracks the implementation of the new legislation in European countries, an average of only 5% of users opt-out from cookies. Therefore, 95% of consumers when asked are willing to consent to data-driven marketing! Contrary to negative press, users are generally not as annoyed by personalized ads as one would believe.

    This article will dive into the realities facing publishers and brands today, and how to think differently about creating a more holistic solution when targeting users that is safe, compliant, and thoughtful about user experience.

    The Shift Toward User Privacy

    A number of pitfalls have emerged around user privacy that could potentially challenge personalized advertising tactics in various content consumption environments.

    Government Regulations
    • GDPR, The California Consumer Privacy Act, Canada’s PIPEDA have all changed the way we think about user data and consent. Teads’ barometer of CMP (Consent Management Platform) adoption reveals that approximately 50% of European publishers’ traffic is filtered by a CMP. This means that almost half of traffic today would not be compliant for personalized advertising in Europe.
    • Ad targeting leveraging user data will become increasingly difficult in the foreseeable future given the expansion of government regulation. And if you’re not a large walled garden (i.e., Google, Facebook, Amazon), you will become more disadvantaged due to a lack of first-party data at scale.
    Social Media & Politics
    • As hundreds of millions of consumers leverage social media and share substantial amounts of personal information online, the risks of data misuse and even potential hacking of that data continue to increase. This risk was best exemplified through a series of scandals impacting Facebook ranging from Cambridge Analytica’s harvesting of user data, to Russian meddling in the 2016 presidential election through targeted propaganda on the platform, to the most recent findings that Facebook shared user data with over 150 companies.The industry is now seeing huge consumer backlash against social media platforms as well as questions from marketers alike, which could ultimately add more fuel to the user privacy fire (while also providing a window of opportunity for publishers to provide a better marketing environment).
    Technology Barriers

    Beyond government regulation and industry self-regulation efforts in user privacy, technology companies are also implementing measures to prevent ad tracking and hence personalized ad targeting online.

    • Apple has been leading the charge for consumer privacy and most recently introduced Intelligent Tracking Prevention 2.0 (ITP) on Safari for iOS 12 in September 2018
    • Safari now blocks first- and third-party cookies and cookie trackers are now completely, which represents 50% of mobile web browser share, rendering the majority of mobile web inventory useless for user tracking and ad retargeting.
    • Mozilla followed suit by enabling Enhanced Tracking Protection in its latest Firefox web browser.
    Brand Safety

    Automation and data targeting at scale also have another downside for marketers beyond violating consumer privacy concerns: brand safety.

    • YouTube, which has heavily relied on its wealth of data and scale, has had a lengthy, recurring history of brand safety violations. Ads have run in objectionable environments ranging from pedophilia videos to extremist and hateful content.
    • Hundreds of brands have pulled their ads from YouTube in the past two years.
    • Contextual targeting tools not only provide a solution to avoid these brand safety snafus, but also ensure marketers reach the right audience that they’re paying for.

    The Need for Context

    Given these increasing challenges, contextual advertising, in addition to personalization, should be considered in a holistic advertising strategy. It serves as an effective, complementary solution in providing the right message to the right user. Contextual advertising also provides an advantage to premium publishers, particularly those lacking their own first-party data or enough scale to leverage data targeting.

    Programmatic ad delivery is now the norm, and marketers have become increasingly reliant on user data to target their audiences. This over-reliance on data now creates substantial risk in the form of potential legal and monetary punishments, loss of consumer trust, limited scale as platforms adapt and negative perceptions towards brands appearing in questionable environments.

    Contextual advertising – the targeting of ads based on the context of the content that a consumer is reading, watching or listening to – is not a new concept, but it is now an increasingly relevant and important tool in marketer’s toolkit as data becomes more challenged. Publishers can leverage context to extract the most value out of the content that they create to better compete against the walled gardens (which often only provide low quality scale). Marketers can still reach the most relevant (and likely more interested) audiences by placing ads in relevant environments. Users can still receive relevant messaging even when they’ve opted out of cookie-based targeting.

    Whether it’s semantic, visual or audio analysis, the tools are available for contextual targeting in almost all content outlets.

    A Holistic Targeting Solution

    It is crucial to think about how to create relevant ad experiences for users leveraging both personalization and context. Publishers should think about a holistic strategy including targeting via dynamic creative optimization using their first- or third-party data, leveraging interest graphs to understand what content users are consuming, and analyzing content and identifying keywords on their pages to build the right context.

    In order to adapt and succeed in a quickly evolving landscape for data and user privacy, we believe publishers and marketers need to exploit both identity and interest to maximize their potential reach and deliver the most optimal messaging.

    Perspectives

    The cookie conundrum: Complexity for publishers in the age of ecommerce and cybercrime rings

    Media publishers in 2018 are at a historical juncture as they face new pressures from many directions. These pressures included competing content providers who provide a wider array of products to draw site users; readers with changing habits, expectations, and preferences; and a growing number of data privacy regulations that are forcing businesses, in general, to change how they operate.

    Publishers in the increasingly diversified digital media landscape have had to revise their business models along with the introduction of paywalls, multi-tiered subscription packages, and merchandise. Not only are they content providers but full-blown ecommerce businesses, a change that comes with its own set of challenges.

    Cookies and commerce

    That fact is that, if a website accepts any form of payment, it is running an ecommerce platform. Actually, media companies are unique in that they can have three disparate revenue channels all tied to their digital environment: advertising/sponsorships, subscriptions and merchandise. More likely than not, these three channels are managed by various internal groups with different objectives. The absence of a single throat to choke for the digital environment at a time when the latter is under mounting cyberattacks and a growing number of data privacy regulations raise these companies’ exposure to a host of digital risks.

    The most significant challenge is managing all the third parties and digital partners who help make the ecommerce websites’ user experience a success. That experience involves providing content to users based on their subscription level and enabling payment for subscriptions and—for a growing number of publishers—merchandise.

    The problem is, most of these third parties, and the cookies they use to identify visitors/users, are unknown to publishers. On average, the cookies they drop into an ecommerce site can account for anywhere between 50-95% of all cookies on that site. Left unmonitored and unchecked by publishers’ digital policies, those largely unknown cookies can degrade the user experience by driving up latency, collecting information from unsuspecting users, or both.

    Regulation ups the stakes

    While latency might not break any laws, collecting information without users’ informed, specific consent violates a rising number of data privacy regulations. We have seen the impact of changes to the legislative landscape on publishers. Privacy laws such as the EU’s GDPR and the state of California’s Consumer Privacy Act have created an increasingly dangerous environment for data processors who fail to adhere to them.

    In May of this year, after GDPR came into effect, large US based publishers such as The Chicago Tribune became unavailable to EU readers, due to the mismatch in privacy laws in the European Union, and the code operating on these sites. At the time of writing, the Tribune remains offline in the EU, highlighting how seriously even the largest publishers are taking the legislative changes we have witnessed this year. The proposal of a U.S. federal Consumer Data Privacy Act, which would jail CEOs for misleading regulators makes compliance even more urgent, especially for large companies.

    The mood of publishers’ audiences is also changing. As the Cambridge Analytica scandal has proven, users of all types of platforms are increasingly aware and suspicious of how their own data is collected and used. The last year’s mega breaches such as Equifax have only escalated consumer wariness of the security and use of the data they willingly provide to publishers.

    Bad actors

    To further muddy the waters, we have seen the exponential growth of malicious campaigns targeting publishers. Increasingly sophisticated cybercrime groups such as Magecart, widely believed to be responsible for the British Airways breach, and, more recently, 3ve, are exploiting vulnerabilities around payment pages, capitalizing on digital advertising’s obscure processes, and targeting users of digital wallets.

    As if all of this wasn’t enough, publishers also have to contend with upstream partners who process or use the data harvested on their platform whose consent management process, or lack thereof, could put publishers at risk of infringing data privacy laws.

    Digital cookies are routinely dropped on with 65% of cookies collecting personal data, and 28% of cookies lasting longer than a year. While they allow publishers to provide a better experience for readership, it can also mean that they are in direct conflict with the latest data privacy laws.

    Getting cookies right

    Publishers can take proactive measures to stay compliant by ensuring that executives in charge of the various ecommerce revenue streams align their goals, objectives and policies in order to safeguard and enhance the user experience. Understanding the landscape of your digital ecosystem is essential. Make sure that you are monitoring your website for the code being run, and proactively question why it is running. Furthermore, the third parties running code, and the companies in their own supply chain who process data need to understand the players and activities in their own digital landscapes.

    However, taking these steps are just the start. Publishers must also prove such measures are being taken. Therefore, publishers, their third-party partners and any other relevant parties should undertake rigorous audit trails to retain proof of regulatory compliance. This allows you to make the case for your overall legislative posture, if it is called into question.

    In addition to this, there are industry organizations which aim to create a set of standardized compliance-related practices in order to create a more transparent culture around cookies. The International Advertising Bureau have attempted to deliver and enforce a framework via their CMP Validator. The AOP (Association for Online Publishing) UK has engaged in similar activities with their Cookie Consortium. Involvement of as many publishers and technology vendors as possible in these industry initiatives is crucial to the continued success of publishers and other players along the digital supply chain.

    Why it matters

    It’s important to establish that the running of cookies on web pages is a fundamental part of how the internet functions in 2018. It makes life significantly easier for both publishers hoping to keep users happy, even working to turn this hope into an actionable reality. It also benefits users hoping to access content, and marketers hoping to build a strategy.

    However, they can only provide these useful functions if the organizations that use them do so with the appropriate regard for any regulations that govern them, as well as for the users whose data is stored in them. In fact, publishers stand to gain the most from the changing regulatory environment, which provides an opportunity to collaborate more closely with third parties and digital partners, and ultimately build customer trust by improving their user experience.

    About the Author

    Chris Olson co-founded The Media Trust with a goal to transform the internet experience by creating better digital ecosystems to govern assets, connect partners and enable Digital Risk Management. Chris has more than 15 years of experience leading high tech and ad technology start-ups and managing international software development, product and sales teams. Prior to The Media Trust, Chris created an Internet-based transaction system to research, buy and sell media for TV, radio, cable, and online channels. He started his career managing equity and fixed income electronic trading desks for Salomon Brothers, Citibank and Commerzbank AG.

    Innovation | Perspectives

    Mozilla’s path to enhanced tracking protection

    Mozilla’s user research, and research conducted by universities and independent experts, consistently shows that most people who use the web do not approve of many of the ways in which their personal data is collected and shared for targeted advertising. In fact, people consider some practices to be invasive, creepy, and even scary. User tracking can also create real harm, including enabling divisive political advertising and affecting health coverage decisions. To help make the web more trustworthy for our users, Firefox is developing, testing, and deploying new privacy features to protect them.

    As a leader of Firefox’s product management team, I am often asked how Mozilla decides on which privacy features we will build and launch in Firefox. Since transparency is fundamental to our way of doing business, I’d like to tell you about some key aspects of our process, using our recent Enhanced Tracking Protection functionality as an example.

    Mozilla is a mission-driven organization whose flagship product, Firefox, is meant to espouse the principles of our manifesto: “A Pledge for a Healthy Internet.” Firefox is our expression of what it means to have someone on your side when you’re online. We believe in standing up for consumers’ rights while pushing the web forward as a platform that is open and accessible to all. As such, there are a number of careful considerations we must weigh as part of our product development process in order to decide which features or functionality make it into the product, particularly as it relates to user privacy.

    A focus on people and the health of the web

    Foremost, we focus on people. They motivate us. They are the reason that Mozilla exists and how we have leverage in the industry to shape the future of the web. Through a variety of methods (surveys, in-product studies, A/B testing, qualitative user interviews, formative research) we try to better understand the unmet needs of the people who use Firefox.

    Another consideration we weigh is how changes we make in Firefox will affect the health of the web, longer term. Are we shifting incentives for websites in a positive or negative direction? What will the impact of these shifts be on people who rely on the internet in the short term? In the long run? In many ways, before deciding to include a privacy feature in Firefox, we need to apply basic game theory to play out the potential outcomes and changes ecosystem participants are likely to make in response, including developers, publishers and advertisers. The reality is that the answer isn’t always clear-cut.

    Balancing the pros and cons

    Recently we announced a change to our anti-tracking approach in Firefox in response to what we saw as shifting market conditions and an increase in user demand for more privacy protections. As an example of that demand, look no further than our Firefox Public Data Report and the rise in users manually enabling our original Tracking Protection feature to be Always On (by default, Tracking Protection is only enabled in Private Browsing):

    Always On Tracking Protection shows the percentage of Firefox Desktop clients with Tracking Protection enabled for all browsing sessions. (Note: the setting was made available for users to change with the release of Firefox 57.)

    The optimal outcomes are clear. People should not be tracked across websites by default and they shouldn’t be subjected to abusive practices or detrimental impacts to their online experience in the name of tracking. However, the challenge with many privacy features is that there are often trade-offs between stronger protections and negative impacts to user experience. Historically this trade-off has been handled by giving users privacy options that they can optionally enable. We know from our research that people want these protections but they don’t understand the threats or protection options enough to turn them on.

    We have run multiple studies to better understand these trade-offs as they relate to tracking. In particular, since we introduced the original Tracking Protection in Firefox’s Private Browsing mode in 2015, many people have wondered why we don’t just enable the feature in all modes. The reality is that Firefox’s original Tracking Protection functionality can cause websites to break, which confuses users. Here is a quick sample of the website breakage bugs that have been filed:

    Bugs filed related to broken website functionality due to our original Tracking Protection.

    In addition, because the feature blocks everything, including ads, from any domain that is also used for tracking, it can have a significant negative impact on small websites and content creators who depend on third-party advertising tools/networks. Because small site owners cannot change how these third-party tools operate in order to adhere to Disconnect s policy to be removed from the tracker list, the revenue impact may hurt content creation and accessibility in the medium to long-term, which is not our intent.

    Finding the right tradeoffs

    The outcome of these studies caused us to seek new solutions which could be applied by default outside of Private Browsing without detrimental impacts to user experience and without blocking most ads. This is exactly what Enhanced Tracking Protection, being introduced in Firefox 63, is meant to help with. With this feature, you can block cookies and storage access from third-party trackers:

    The feature more surgically targets the problem of cross-site tracking without the breakage and wide-scale ad blocking which occurred with our initial Tracking Protection implementation. It does this by preventing known trackers from setting third-party cookies — the primary method of tracking across sites. Certainly consumers will still be able to decide to block all known trackers under Firefox Options/Preferences if they so choose (note that this may prevent some websites from loading properly, as described above):

    Sometimes plans change. So we test

    As part of our announcements that ultimately led to Enhanced Tracking Protection, we described how we planned to block trackers that cause long page load times. We’re continuing  to hone the approach and experience before deciding to roll out this performance feature out to Firefox users. Why? There are a number of reasons: The initial feature design was similar in nature to the original Tracking Protection functionality (including ad blocking). But blocking only occurred after a few seconds of page load. In our testing, there was a high degree of variability as to when various third-party domains would be blocked (even within the same site). This could be confusing for users since they would see blocking happen inconsistently.

    A secondary motivation to block trackers and ads on slow page loads was to encourage websites to speed up how quickly content loads. With the tested design, a number of factors such as the network speed played a part in determining whether or not blocking of trackers and ads would occur on a given site. However, because factors like network speed aren’t in the control of the website, it would pose a challenge for many sites, even if they did their best at speeding up content load. We felt this provided the wrong incentive. It could cause sites to prioritize loading ads over content to avoid the ads from being blocked, a worse outcome from a user perspective. As a result, we are exploring some alternative options targeted at the same outcome, much faster page loads.

    Open, transparent roadmaps

    We work in the open. We do it because our community is important to us. We do it because open dialog is important to us. We do it because deciding on the future of the web we all have come to rely upon should be a transparent process — one that inherently invites participation. You can expect that we will continue to operate in this manner, being upfront and public about our intent and testing efforts. We encourage you to test your own site with our new features, and let us know about any problems by clicking “Report a Problem” in the Content Blocking section of the Control Center.

    I hope this glimpse into our decision-making process around Enhanced Tracking Protection reaffirms that Mozilla stands for a healthy web — one that upholds the right to privacy as fundamental.

    About the Author

    Peter Dolanjski is the product lead for Firefox on Windows, Mac, and Linux. Along with a team of like-minded internet advocates and a vibrant open source community, he fights for the fundamental right to online privacy through innovative browser features and meaningful privacy defaults.

    Featured Post | Perspectives

    In search of a Goldilocks solution to online privacy

    For years, large tech companies have spent millions on lobbying in Washington to make sure that they escape tough regulation. And until recently, they have been successful.

    But today is a new day—one where tech companies are actually asking for regulation. How did we get here? Trust in tech giants is at an all-time low. And practices that include collecting untold amounts of data, even when consumers think they have privacy (see: Google Data Collection research); selling data to nefarious players (see: Facebook and Cambridge Analytica); and losing their data to hackers (see: Facebook’s newest data breach of data from 50 million users) has focused the attention of lawmakers in the EU and United States.

    While past Senate hearings have at times felt like introductory classes to social media, with tech representatives slowly explaining how their platforms work, last week’s hearings on consumer privacy took on a different tone. “The question is no longer do we need a law for consumer privacy; the question is what shape these laws will take,” Committee Chairman Senator John Thune (R-SD) said in his opening remarks.

    Now, the tech industry has come to realize it can’t escape regulation, and Facebook’s data breach has only heightened the stakes. But the question is how you make everyone happy with new regulation, with tech companies chafing at California’s strict new privacy laws and the European Union’s GDPR. How do we get to the “Goldilocks” policy? One that’s not too loose for consumers and not too strict for advertising and commerce. And how much will publishers need to change their ways to comply?

    The Limits of Self-Regulation

    In the past, as critics have expressed more and more concern over privacy — and investigations have revealed the ways in which nefarious players have mined user data for insidious targeting — tech giants have slowly policed themselves. Facebook, for example, announced in August that it would remove 5,000 options on its site that ask for “sensitive personal attributes” that enabled advertisers to hyper-target and limit their audiences.

    Facebook says the move was more pro-active on its part and not in response to anything in particular, though the timing is suspicious after a lawsuit leveled by fair housing groups charging that advertising on Facebook could prevent minority communities from seeing housing ads. The routine is now becoming familiar: Scandal on a tech platform related to data. Platform tries to solve problem with new rules and its own regulation. Remember Cambridge Analytica? If not, look no further than what Facebook is currently facing with its latest data scandal.

    But last week’s hearings revealed that representatives from major tech companies like Amazon, AT&T, Google and Twitter— along with the IAB, which had previously favored self-regulation — are warming up to the idea of some kind of federal legislation that, in theory, would mandate actions that might prevent future scandals. They said they’re in “widespread agreement” about that, which Google also acknowledged in a proposal for privacy regulation it published just a few days before the hearing.

    Meanwhile, publishers have had to take action to comply with GDPR from Europe. And while they realize it’s a hassle, and privacy-policy pop-ups are annoying for users, there can be upsides. At a recent panel discussion at Marfeel in Spain, publishers noted that they now could take responsibility for first-party data they collect, and make sure it’s secure so that users are comfortable handing it over.

    “So, I think if there’s any silver lining, it’s that publishers in general and the media companies in general are now actually taking responsibility to collect that first-party data instead of simply hoping that Google and Facebook would play nice and share some of that,” said Rithesh Menon, vice president of monetization and account management at Good Media Group.

    Operating in the Shadow of Europe and California

    While this may seem like a drastic change of stance among tech companies, remember they’ve already had to pivot to new privacy laws in Europe and California. In fact, the reasoning behind their embrace of federal privacy laws is that they’re trying to avoid legislation that’s as strict as Europe’s GDPR or California’s Consumer Privacy Act. That was obvious during the Senate hearing, where tech representatives called out both laws in urging Congress to “strike the right balance,” as Leonard Cali, AT&T’s senior vice president of global public policy, put it.

    Representatives from Google, Apple, and Twitter, for instance, discouraged Congress from following in the footsteps of the GDPR by noting that small and medium-sized businesses might not have the financial backing to take on the compliance costs that would come with GDPR-like legislation. Amazon’s representative pointedly critiqued California’s privacy bill, arguing it doesn’t promote the best privacy practices.

    Theoretically, if federal law is not as strict as state law, tech companies could bypass California’s strict regulations that might very well serve as a model for other states, because federal law would trump state regulations. But Congress also noted that strategy is not what it has in mind.

    “Your holy grail is ‘preemption.’” Senator Brian Schatz (D-HI) said. “And we’re not going to replace a strong California law with a weaker federal one.”

    Having a Seat at the Table

    Having a seat at the table when it comes to drafting federal regulation is in the best interest of tech companies at this point. But the reality is that their huffs and puffs about how strict other legislative models are might not do them any good. With yet another Facebook data breach, consumers and lawmakers alike are fed up.

    California’s new law requires that people can see what data companies have on them — which makes perfect sense from a consumer perspective. And the EU is still pushing social media platforms to adjust to a new way of operating under GDPR. European Commissioner Vera Jourova warned Facebook to change some of its terms and conditions by December, so the company can finally tell users how it utilizes their data for commercial purposes. It’s a wake-up call for tech companies that the EU is not going to budge — and that gives American lawmakers the chance to pile on with more conviction.

    Now that the tech giants have asked for regulation (though of course of the weaker variety), it is up to Congress to take action. But first, they also have to listen to consumer groups — because a table of decision-makers that only includes one side would not look good. Senator John Thune said Congress is not in any rush toward a decision. But let’s hope one emerges before another data breach occurs.

    Uncategorized

    Policing third-party code is essential to digital vendor risk management

    Some of the biggest companies including Saks Fifth Avenue, Lord and Taylor, Best Buy, MyFitness Pal, and Applebees have been the victims of breaches due to third party code. Third parties provide services around content recommendation engines, ads, customer identification platforms, data management platforms, social media widgets, and video players, to name a few.

    Oftentimes, these third parties turn to their own third parties to help deliver their services. When unknown third (or nth) parties become part of a website’s support structure, they can introduce more risks than they were brought in to reduce, because they lie outside of a formal IT organization’s control. Gartner predicts these “shadow IT” will be the root cause of 33% of security problems by 2020.

    Throwing light on digital shadow IT

    Last year, one of the world’s largest magazine publishers was shocked to find their sites were supported by over 1,000 third parties. This year, they were able to winnow down that number to 100 of the most trusted. In July 2018, random sample of 350 of The Media Trust’s publisher clients showed that each of their domains was supported by an average of 140 third parties, which provided anywhere from 50-95% of each site’s code. For the magazine publisher and those in the random sample, most of these third parties (much less their activities) were unknown to them.

    Recently, The Media Trust digital security and operations team found and foiled a malware campaign that affected close to 60 major publishers whose audiences span the globe. These publishers’ trusted digital advertising partners had unknowingly served an ad with malicious code that would replace the legitimate creatives of a globally recognized brand. The code would redirect visitors to a Facebook popup informing victims that they had won a prize and encourage them to enter personally identifying information.

    What sets apart this campaign from other redirects is its scale and its targets: some of the world’s most popular online publications that deal only with reputable digital partners. While the campaign was effectively halted, it spotlights the growing challenges of managing the risks third parties and their own vendors can introduce to today’s ever-more dynamic, complex digital ecosystems.

    Third-party code putting companies at risk

    Third parties can pose risks in several ways. First, they tend to have weaker security measures. This makes them ideal attack vectors for bad actors. The headline-grabbing breaches of Target, Equifax, Ticketmaster, and, more recently, Adidas, prove how popular third parties are to exploit because of their vulnerabilities. In this scenario, when taking on a large organization, hackers will first target a third party and use it as a gateway to enter the larger network.

    Second, third party code operate outside the website operator’s cybersecurity infrastructure. Their activities, authorized or otherwise, can neither be monitored nor remediated by the publisher’s marketing and IT departments. As a result, user experience can deteriorate and erode a publisher’s topline and reputation.

    However, another, more serious consequence is the unsanctioned collection of user data, which in the EU will expose the publisher to the risk of infringing the GDPR and, soon, the ePR, whose scope is expected to be broader and penalties equally stiff. In fact, the ePR could potentially override the GDPR. Non-compliance is therefore a risk, and will figure prominently in other sought-after markets like Canada, which will enforce PIPEDA later this year, and California, which recently passed the California Consumer Privacy Act.

    Reining in risk

    Unless they have the tools to actively monitor third party-code, website owners will likely remain unaware of the broad range of code that execute on their sites and of how unexpectedly and frequently new, unknown code appear.  The ability to identify, document and authorize these ever-changing vendors is critical to properly mitigate risk. Not only do most enterprises not know the full scale of vendors executing code, but they would be surprised at the amount of consumer data collection activity, i.e., cookie drops, pixel fires, device fingerprint, etc.

    Continuous monitoring from your customers’ points of view helps IT teams pinpoint how these vendors and their actions—specifically the domains executed and cookies dropped—change according to user geography, browser, or device. Collecting this type of vendor intelligence provides clear insight into third party behavior to protect customers and brand reputation from cyber threats.

    Working with third parties toward strong security posture

    Third-party application security is essential for today’s IT security compliance, especially now that regulations are proliferating. Even if the security risk resulted from a third-party compromise, the legal responsibility falls on the primary organization. Therefore, it is crucial that organizations take sufficient steps to manage third-party risk and ensure a safer online environment for themselves and their users.

    To do that businesses need to ensure that both their systems and those that look beyond their perimeter to third and nth party codes are secure. First, they should carefully vet all third parties by conducting a risk assessment before bringing any third parties on board. Second, they should maintain a continuously updated inventory of their direct and indirect third parties. Third, they should spell out security policies and standards and use contract clauses and SLAs to enforce them. Fourth, they should follow through by conducting periodic audits of third party security measures. Finally, they should conduct continuous, real-time scanning of their websites to identify any unauthorized code and activities and then compare their findings with what is executing on their visitors’ browsers outside their firewall.

    These steps will help to mitigate risk and lock out bad actors from digital ecosystems. Taking a proactive approach to cleaning up and protecting websites will improve the company’s security posture, ensure customers’ safety and protect organizations from the high, upcoming fines of the GDPR and other regulations that follow it.

    About the Author:

    Chris Olson co-founded The Media Trust with a goal to transform the internet experience by creating better digital ecosystems to govern assets, connect partners and enable Digital Risk Management. Chris has more than 15 years of experience leading high tech and ad technology start-ups and managing international software development, product and sales teams.

    Advertising | Featured Post | Perspectives

    Duopoly dystopia

    Google and Facebook’s dominance of the digital advertising market is well documented. Pivotal Research’s Brian Wieser estimated at the end of 2017 that these two companies “accounted for 73% of all digital advertising.” In the same report, he also estimated that the duopoly accounted for 83% of all growth, which means their grip is only getting tighter.

    Scale is the main reason these companies dominate. Facebook has a huge user base, particularly when you factor in its ownership of Instagram and WhatsApp. And let’s not forget its “like” buttons on more than 8.4 million websites, a number Facebook recently disclosed in its answers to lawmakers’ questions during the Cambridge Analytica hearings. Despite lingering legal questions, those “like” buttons continue to collect data about the sites visited by Facebook users regardless of whether those consumers are logged in to the platform. Even more concerning, the buttons also collect data about non-Facebook users. The result is a massive and rich database of consumers’ personal information and activity, which Facebook offers to advertisers for targeting ads to very specific audiences on and off Facebook’s properties.

    Google also offers hugely popular consumer services including its search, Gmail, Chrome, and maps applications. Of course, it mines them for very sensitive information about consumers (e.g. personal messages, friend networks, interests, location). Oh, and let’s not forget that Google has a hand in every part of the digital advertising supply chain. Like Facebook, Google is ubiquitous and nearly impossible for consumers to avoid.

    No competition

    Some might be tempted to argue that these companies serve as competitors to one another. Except that they don’t compete on price. The fact that these services are offered free of charge has enabled their lawyers to shield them (so far) from any antitrust scrutiny in the U.S. What they really compete over is which company can collect more data about consumers. This unbridled competition for data is even more corrosive as it lacks transparency and they offer no effective choice mechanisms for consumers.

    Consumer groups assert that this dynamic is bad for privacy. And, they might have a point: Consumer trust is at all time low while adoption of ad blockers continues to rise. Yet, Google and Facebook haven’t felt the impact of this lack of consumer trust. That’s because these companies don’t care where ads are served and they have virtually unlimited places to serve ads (meaning ads can appear near any content, which can create a negative impact by association). Instead, other tech companies, marketers, and publishers bear the brunt of consumer ire.

    A dangerous game

    But, there is more going on here. Facebook and Google have created a feeding frenzy in the vast, and expanding, data pool. Other companies recognize that have to jump in or risk their ability to compete for digital advertising dollars. Verizon bought AOL and Yahoo! solely to have more ad technologies and inventory. Combined with the significant information about the activities of their user base, this might give them an opportunity to compete for the duopoly-dominated digital advertising dollars. Not to be outdone, AT&T bought AppNexus, the largest independent ad technology company. It’s hard to fault these companies for joining forces given the world they’re competing in.

    From my perspective, the duopoly is creating a giant game of musical chairs. If this dynamic is allowed to continue, it’s not hard to imagine that publishers will be forced to pair up with a telecom provider or to form giant conglomerates in order to ensure that they have a chair when the music stops.

    Unfortunately, this will have profound effects on well-known premium publisher brands and an even more devastating impact on the ability for new voices to emerge. Ironically, the internet was supposed to increase the number and diversity of voices. Instead, the duopoly is quietly reshaping the web into a dystopian data collection machine.

    Featured Post | Perspectives

    Once bitten: Comparing Apple and Facebook’s privacy policies

    These days, it’s hard to trust any tech company with your personal data. Between hacking, leaks, misuse, and unfettered tracking, you can’t blame consumers for being more than a little wary. Sure, companies use our information for lots of reasons. However, when you compare two tech giants – Facebook and Apple – there are distinct differences in their approaches to collecting and using personal information. And the distinction says a lot about building a business model based on devouring data.

    Their diverging approaches could be written off to business model differences. Facebook sells access to a massive data set to serve up ads to granular groups of people that meet advertising objectives. Apple’s goal is to sell hardware and use data to customize your experience. While plenty of people don’t trust either company, it is interesting and illuminating to contrast the two systems.

    Right on Cue

    Eddie Cue set out to do just that when he was interviewed by Dylan Byers on stage at South by Southwest in March. He sees a big difference between how his company approaches privacy and those from other companies like Facebook and Google because of what he sees as the fundamental difference in how they make money.

    “We’re not collecting a ton of information about you, where you are, what you do, etc.. We are really not interested in it in most cases. When we do, we keep the minimal amount that we need in order to do exactly what we tell you we are going to do with it. We don’t make our money off of advertising,” Cue said in March.

    Message Delivered

    In a Fortune commentary from Alex Salkever that came out after news surfaced that Facebook had been scraping call and text history from users on Android phones, Salkever saw clear differences. And this was just one of many data privacy issues Facebook has faced this year. Salkever wrote:

    Apple emphasized user privacy long before its rivals did. The company built end-to-end encryption into iMessage and FaceTime from their inception. Apple also makes it exceptionally easy to encrypt your entire hard drive; in fact, this is a core feature of the Mac laptop operating system. And Apple Pay is designed in way that really enhances privacy—by not storing actual credit card information on users’ phones or computers and instead using one-way encryption for payments.

    Ben Goodman, vice president of Global strategy at identity management firm, ForgeRock sees Facebook as more like television network than a hardware company. He believes that this accounts for the differences in the way they approach privacy.

    Getting Personal

    “There is a misconception that Facebook is selling our personal data. In reality, Facebook is collecting data to enable high levels of personalization and targeting in advertising. When you view their data privacy through those lenses, it is easy to understand why Apple prioritizes privacy by not having personal information leaving the device; meanwhile, Facebook wants users to be comfortable with sharing as much personal data as possible,” Goodman said.

    When Apple has run into problems it’s mostly when there is information being stored off-device as in the infamous iCloud celebrity hacks.

    Certainly Facebook CEO Mark Zuckerberg acknowledged in his prepared statement before the U.S. Congress earlier this year that his company needed to be more careful with user data on the platform. ‘But it’s clear now that we didn’t do enough to prevent these tools from being used for harm as well. That goes for fake news, foreign interference in elections, and hate speech, as well as developers and data privacy,” he told Congress in April.

    Privacy Please

    That’s not to say that Apple doesn’t get questioned about its approach to privacy even as it tells people how much better it is. Cue’s boss Tim Cook was more than happy to dance on Facebook‘s misfortune when its privacy woes surfaced earlier this year. Cook said that what differentiated them from the others (besides what Cue had articulated at SxSW) was encryption, not allowing sensitive data to leave the device, and collecting less information than everyone else.

    But when Apple released the iPhone X last year and with it brought 3D face recognition to the device, it did raise privacy concerns, especially since that was being shared with some third-party apps on-device. (How do you think you can make that personalized animated poop emoji?)

    Then, at the most recent WWDC keynote, Apple introduced in-browser Safari tools to block Facebook tracking. Apple software executive Craig Federighi pointed out that Facebook Like buttons and comment fields on a web page can be used to track you whether you click on them or not. Starting in the next version of Safari, you can choose whether you want to allow that or not from a warning box that pops up whenever these entities are on a page you are viewing.

    Just this week, the company updated its App Store guidelines in a move a Bloomberg report suggests could be directed at a Facebook book app called Onavo Protect. “The iPhone maker’s updated App Store Review Guidelines ban applications that “collect information about which other apps are installed on a user’s device for the purposes of analytics or advertising/ marketing.” This could give Apple grounds to remove the Onavo app, although the software is still available despite the rules kicking in last week,” according to the Bloomberg report.

    Governing Privacy

    Of course, GDPR is forcing everyone’s hand to at least some extent as the EU implements a new set of regulations designed to put the user in control of his or her own data. Other countries including the U.S. might not be far behind.

    As Cue pointed out, attitudes have shifted about privacy, but Apple feels it was ahead of the curve. “If you look over the last 10 years, when we started talking about privacy and security and all these things, they weren’t top of mind, and in a way most people were [thinking] ‘Who cares?’ It wasn’t that important, but now people realize the importance of it and what the ramifications of it are,” he said.

    And as consumers see how some companies have been misusing their data, they are beginning to compare the privacy records of the biggest tech players. And perhaps they are seeing that while none has a perfect record, they may not all be equally bad either. As consumers decide who to trust, who to do business with, and who to block, companies will need to do more than comply with regulation. They’ll need to develop a strategic approach to data, and business, that respects consumers’ privacy expectations.

    Advertising | Featured Post | Perspectives

    Being big and behaving badly

    On a panel a few weeks ago, Makan Delrahim, a top antitrust official at the Department of Justice, said that “Being big is not a violation of antitrust policy. Being big and behaving badly is a problem.”  

    We’ve established without debate that Facebook, Apple, Amazon, and Google are big. As their Q1 earnings showed, they’re extraordinarily big. Rockefeller big. Carnegie big. But how have they been behaving? Rather than make any assumptions, I went to Twitter knowing many of my followers work in the press, inside the beltway, or across our industry and are very close to the behavior of the tech giants.  

    The results were surprising to me. Not because Facebook came out on top. But that one out of three voters chose Google over Facebook. (Apple and Amazon didn’t even come close.) 

    I thought it was worth examining the parallel paths of these two “winners,” to consider some facts that may not be on everyone’s radar.  

    Facebook and Cambridge Analytica

    Everyone has had their punch lines about the ineffective ten hours of United States Congressional hearings with Mark Zuckerberg in Washington last month. We can add this week’s meeting in Brussels to the joke. But not everyone has been paying attention to the work being done by the UK Digital, Culture and Sports Committee, which has been digging into the case for nearly 18 months and asking really smart questions. Here are a few facts established as of today. I’ll let you read through them and determine who is behaving badly: 

    • Last month, Facebook disclosed that up to 87 million Facebook users’ data was harvested in 2014 by GSR and then sold to infamous Cambridge Analytica (now being dissolved). These disclosures were made after joint reporting by The Guardian and The New York Times, and after legal threats by Facebook were reported by The Guardian. Facebook later admitted these warnings were not their wisest move and offered an apology.  
    • Facebook has refused to clarify exactly when Mark Zuckerberg or Sheryl Sandberg first became aware of GSR or Cambridge Analytica. Though The Guardian first reported on both companies in a report on December 11, 2015 and a Guardian reporter started asking questions in December 2014. 
    • GSR was launched and run by two “equal partners,“Joseph Chancellor and Dr. Aleksandr Kogan. 
    • It was recently disclosed that Facebook signed a confidentiality agreement with Kogan. This confidentiality agreement was signed by Kogan and an undisclosed Facebook executive on June 24, 2016. (Interestingly, this was the date results of the vote on the Brexit referendum were announced.)  
    • Lesser known fact: In November 2015, Facebook hired Chancellor and he signed a confidentiality agreement as an employee of Facebook. Yes, Facebook hired someone who participated equally in what Facebook characterized to The New York Times as a scam and a fraud. 
    • This leaves us with a minimum of 27 months (December 2015 through March 2018) and a maximum of 39 months (December 2014) in which Facebook was aware of the records being harvested and sold to Cambridge Analytica. Yet, they’re still not sufficiently answering questions about the matter.  
    What is next here:  

    The emerging pattern appears to be a massive cover-up. So far, despite a threat of future arrest, Mark Zuckerberg has refused to give testimony in the UK where the toughest questions will be asked. The Federal Trade Commission is investigating the issue raised by Senator Kamala Harris’s questions about who made the decision and why Facebook didn’t inform its users back in 2015 when they knew the “fraud and scam.” Being big and behaving badly.  

    Google and GDPR

    For a while now, DCN has been analyzing, advocating, and lobbying on GDPR, which will come in to enforcement this Friday, May 25th in the European Union. The law, which applies to data collection of EU residents, was approved in April 2016 so it’s anything but new at this point. However, despite DCN and publishers inquiring for many, many months, we only found out what Google was up to in the 23rd month of the two-year grace period. And then only after the Wall Street Journal scooped Google on their plans. (Un)fortunately, this news happened in the same week the Facebook and Cambridge Analytica news was breaking so its plan didn’t get the attention it deserved. And to be clear: Google’s plans are fairly offensive. 

    Google’s Privileged Position

    Let’s take a step back and look at how Google operates as a privileged platform in the advertising marketplace where they can set the rules of the game while also playing and winning the game. What gives Google the most leverage is its market power and unprecedented amount of data collection in this market (all estimates courtesy of Arete Research).  

    • Google DBM (their advertising bidding solution on the demand side) has $1.7B net revenue vs Google’s nearest peer (The Trade Desk) at $308 million. MediaMath is in third place at around $220 million. 
    • Google DoubleClick AdX (their exchange sitting in the middle) has $1.9B revenue vs nearest peer at $155 million. 
    • Google DFP (their solution on the supply side) has $700 million net revenue vs nearest peer with significantly less. 
    • Google’s measurement/attribution solution has $600 million net revenue vs nearest peer at under $100 million. 

    In other words, Google is 5-10x its nearest competitor in every stage of the digital advertising supply chain — where Google both creates the market and makes the market. So, the question becomes what is Google’s responsibility in rolling out the GDPR, the most significant data protection law in history? We know our members depend on Google for nearly every component of their advertising revenues (which drive on average 80% of our members’ overall revenues.) It’s a simple fact that nearly every one of DCN’s members use Google DFP as their ad server.   

    The Monopolist Move

    So DCN was rightly concerned by Google’s vague policy updates where they attempted to retain all of the rights to the data harvested by each and every one of Google’s ad services without details in how they would use this data. And that they did this while the risk was being assigned to the publishers was, as I previously said, fairly offensive. They might as well don a top hat and cane.  It’s the move of a monopolist.  

    Taking on Google regarding their policies in protecting one of their most treasured assets, their data collection, isn’t for the faint of heart. So, we worked with three other major global trade bodies representing more than 4,000 publishers and sent a letter of concern to Google CEO, Sundar Pichai. In the month since we’ve sent this letter, Google has continued to set up private meetings with publishers. However, we’ve consistently been told Google is unwilling to commit to the necessary terms for publishers and when they even begin to approach something workable, they will not put anything in writing.  

    Hence the open public letter by DCN with our seven key questions. 

    We’ve found it unfortunate that Google has refused to answer our questions and has since moved on to public relations tactics including organizing a “collaboration meeting” on May 24th — the last day before GDPR enforcement begins. We took the counsel of the other associations, their members and the legal and legislative experts across our DCN membership and declined Google’s invitation for a private, off-the-record event. 

    What is next here:  

    At this point, it’s unequivocal that Google has strategically waited until the final months with the goal of protecting its own interests. This serves to push the market towards systems orchestrated by Google and the trade bodies that represent it and protect its interests above the interests of the public and the publishers. Again, given the dominance of Google throughout the digital advertising supply chain, publishers don’t have a reasonable choice to not sign Google’s terms and essentially shut down advertising revenue on May 25.  

    The key question will be whether Google and its trade bodies roll the EU regulators. It’s worth noting Facebook’s troubles and a high-profile 60 Minutes report on Google last Sunday won’t help their cause.  Being big and behaving badly. 

    When I do the math on these companies’ actions, they both add up to being big and behaving badly. And that’s a big problem. Being big is not inherently bad. Power can — and should — be used for good. But with great power comes great responsibility. And these are not the actions of responsible companies.  

    Perspectives

    How consent fragmentation could alienate users and undermine the GDPR

    After a two-year grace period to allow time for preparation, GDPR finally goes into effect this week. For most enterprises, mapping and remediation of private data storage has been the focus. But now it is time to focus on sustainable operational compliance starting on May 26th and continuing for years into the future.

    If you monetize with programmatic ads, we’ll assume that your legal team has made the (very typical) decision that “consent” is the best legal basis for processing data under GDPR. Regardless of which basis you choose, data subjects must be given a clear and understandable explanation of what data you will use, how you’ll protect it, who you will share it with, and how long you’ll keep it. When the user gives his (now “informed”) consent, a transparent, trusting, ongoing relationship is formed – exactly what the authors of the GDPR intended.

    Because it can be revoked at any time, and processing must stop when it is, consent must now be easily checkable by both internal company activities, and also by third parties (called “Data Processors” in GDPR lingo) that utilize the data (for example, ad networks). Clearly, “consent” has become a very important new corporate asset.

    The Programmatic Problem

    The AdTech industry has realized that under GDPR, lack of consent could quickly lead to the end of programmatic ads. Last November, the IAB trade group proposed the Transparency Consent Framework (TCF), an open source consent solution that it believes will allow the ads to keep flowing. Many observers, (including DCN) have criticized it for technical and functional shortcomings.

    The purpose of this post is not to dissect the flaws of the IAB TCF. My goal is to make clear that even if it worked properly, the IAB’s solution could never be considered a complete consent solution for a publisher. Its only purpose is allowing programmatic ads to continue to flow.

    As this point, you may think “So, what? It will keep my ads running. Why not use a free solution to manage the programmatic ad part of the GDPR consent puzzle?” I submit that consent needs to be handled centrally as a key corporate asset, just like accounting, HR, strategic, and other corporate data.

    Consent Deconstructed

    Here is a real-world example illustrating what will happen when consent is not handled centrally. A mid-sized publisher runs ads (of course) but also offers newsletters, email-based promotions with sign-ups, and an affinity / personalization program with a persistent login.

    If the publisher chooses the IAB TCF solution to run ads, they still have no solution for storing or managing user consent to their internal GDPR uses. (This could include email newsletters and affinity programs, but potentially many more. Today’s digital marketing creates a lot of data ingress points).

    The publisher chooses a “GDPR compliant” third party email provider that gathers consent and stores it internally (not accessible to publisher). For their affinity system, the publisher creates a basic consent flag system on their internal servers. In theory, the publisher is now covered for GPDR consent.

    A Poor Patchwork

    In actual practice, this “patchwork” solution is very unpleasant for users. They will be interrupted and asked for their consent for ads the first time they come to the site post-GDPR. They will again be interrupted and asked for consent (by a different vendor and with a different UX) when they join the email list. Then, they will again be interrupted and asked for their consent with a different UX when they join the affinity program.

    Because of the disjointed consent strategy (known as “Consent Fragmentation,” the user has been interrupted 3 times for consent, shown 3 different notices, and given their consent using 3 different user interfaces. At a certain point, users will become frustrated with the continual interruptive requests for consent, something the GDPR authors envisioned and referred to as “Consent Fatigue”

    It gets worse. Under this patchwork, when a user decides to revoke or modify their consent, their path to success is extremely arduous (the opposite of GDPR’s “easy as giving consent” wording in Article 7).

    Since the IAB TCF does not provide any user interactivity, the publisher must use an IAB approved Consent Management Platform (CMP) to provide users with required rights management capability. To modify their ad consent, users must use the CMP dashboard that the publisher has chosen.

    To revoke email permissions, the user would have to visit the “unsubscribe” page of the email vendor. Finally, for the loyalty program, they would need to use a “revoke my consent” function from the publisher’s in-house consent manager.

    Centralized Consent

    Consent fragmentation is the result of using different “Band-Aid” systems to hold user consent, and there is no positive aspect to it. This situation came about because the publisher did not understand the true importance of consent. No publisher would ever hold separate general accounting ledgers in multiple unconnected silos. It would be a certain recipe for disaster.

    This disconnected experience is bad enough for a single site. Now imagine how users will feel if most sites ask their consent three or four times. This is the nightmare scenario that risks the failure of GDPR because users will simply stop giving consent.

    I think you can see where this is going. Post GDPR, user consent is a vital corporate data asset, a key gating item for all user interactions. As such, consent must be gathered wherever needed. However, it must stored in a central repository, where is easily accessible to all internal activities, and to a curated group of external partners (email services, analytics, ad partners and downstream ad partners.)

    With a single consent repository, users are presented with the experience they expect: one single sign-on dashboard. It will provide them with an accurate and easy to understand notice of the uses of their private data, easy access to exercise their rights, the ability to selectively opt-in or out of each of the services used by the publisher, and a secure point of access for SAR and breach notification. The solution must be an easy to use, single sign-on privacy management is evidence of “Privacy by Design,” as envisioned by the authors of GDPR.

    Roy Smith is founder and CEO of PrivacyCheq, a leading provider of SaaS privacy compliance services to enterprises and small business worldwide.

    ©2024 Digital Content Next. All Rights Reserved.