How will GDPR impact the digital advertising ecosystem?

Julia Shullman, VP Chief Privacy Counsel, AppNexus 

On 25 May, the GDPR will come into effect, and the changes in European regulation will have a significant impact on the online advertising ecosystem. To ensure that the internet remains open and vibrant, digital publishers, advertisers and their partners must adapt their business models to comply with GDPR. AppNexus is working closely with its clients, including publishers, agencies, advertisers, industry trade bodies such as IAB Europe, and others across the digital advertising ecosystem to find a common, industry-wide solution.

How does the GDPR affect digital advertising?

An important social contract exists between advertisers, publishers, and consumers. Advertisers reach consumers with relevant and engaging advertising, which in turn helps independent publishers monetise their creativity and content, which, in turn, allows those same publishers to offer that content free of charge to billions of consumers.

Most consumers aren’t aware of what goes on behind the scenes to power this virtuous cycle. Targeted, relevant advertising is enabled through the collection and use of personal data. For third-party advertising companies this personal data is typically pseudonymous through the use of cookie IDs and mobile advertising IDs. It’s imperative that personal data collection and use is done in both a safe and transparent way, that puts the user firmly in control of their data. That’s what the EU is seeking to address with GDPR.

Collaboration is key

Participants from across the digital advertising ecosystem have been working together for more than a year to develop the IAB Transparency and Consent Framework. The framework is an industry-wide solution designed to meet the transparency and user-choice requirements of GDPR for the ecosystem that powers the open internet.

The framework’s technical specifications and pipes enable publishers working in different countries and regulatory regimes to meet local transparency or consent requirements. It provides a standard infrastructure to pass information between publishers and their technology partners without imposing a single policy interpretation.

Maintaining a free and open internet

The framework is essential to preserving the social contract that publishers have with advertisers and end-users. If that social contract breaks down, publishers will need to look for new ways to monetise, which could include gating their content and charging a premium for it. Such a breakdown would ultimately benefit no one – except perhaps for walled gardens such as Facebook and Google, which can more easily fold providing transparency and notice to their users and the consent-gathering process into their users’ login process and other direct experiences. Even if walled gardens don’t have direct relationships with users, because of their controlling position in the market, they can very easily dictate policy and technical controls to the market. More importantly, this breakdown cuts off anyone who can’t pay for quality content: news, commentary, music, film, and information. AppNexus’s mission is to create a better internet, and that begins with powering privacy-safe advertising to fund quality content for consumers to enjoy.

For more information, please click here.

Video transcript:

Hello, and welcome to Business Reporter's GDPR Campaign. I'm Alastair Greener. Today, I'm talking to Julia Shullman from AppNexus. Good morning.

Good morning.

Give me an idea of the digital advertising ecosystem post GDPR where everyone sees themselves as winners and it all works well for them.

Yeah. I think you have to think about who actually makes up that ecosystem first. So there are a number of parties that actually participate in the ecosystem that consumers don't actually know about. So we have publishers, newspapers that you might show up online, see their content.

We then have various parties throughout that ecosystem. So we have ad servers that they use to actually show advertisements to consumers. We have what are called sell-side platforms that help them sell their inventory. We have demand-side platforms that help advertisers buy that inventory. Advertisers use their own ad servers. And then of course, there are advertisers, so agencies and marketers.

Today, when a publisher is actually selling inventory on its page, that is how they fund their business. And I think a lot of consumers don't know that. So with GDPR coming and with GDPR requiring that consumers have way more notice and control and potentially consent to the use of their data, this entire ecosystem gets blown up to a certain extent.

And how can that have an impact on whether we have a less open, less vibrant internet post GDPR?

The goals of GDPR are fantastic. We're completely aligned with them. They are meant to provide control back to the consumer. The consumer is supposed to actually have control over who's collecting their data, how it's being used, whether they can understand who those parties are.

Today, when a publisher is selling inventory on its website, it's typically using dozens of vendors to help themselves do that. And then those vendors are working with the vendors of advertisers. So in a GDPR world, there is likely going to be a contraction of the number of vendors that a publisher and an advertiser are actually allowed to be using.

And unfortunately, that creates a perverse incentive. Because a lot of the large platforms out there like Google and Facebook can actually provide services to publishers and advertisers without having to work with other independent providers in the ecosystem such as ourselves that don't actually sell content that competes with the publisher's content or that don't actually have their own data like an advertiser's might have on a user.

So while I think consumers are supposed to be winning in a post-GDPR world-- and regulators truly believe that by regulating our entire ecosystem and the use of data within Europe, they're providing more incentives to providers to actually help consumers-- unfortunately, in the short-term, this is actually going to benefit the large platforms that have those direct relationships to consumers and can provide notice transparency and obtain consent much easier than independent third parties that publishers and advertisers use.

Are you therefore suggesting there should be a greater sector-wide collaboration? And if so, what's standing in the way of that?

There should absolutely be a greater sector-wide collaboration. And there's been a number of factors standing in the way of that. Unfortunately, one of the largest factors is that the large platforms don't have an incentive to come to the table and to work with the ecosystem to provide a standard that could allow publishers and advertisers to continue to decide which independent parties they want to work with. And it's easier for them to not have to do that.

So we are very much trying to work with them and hoping that they ultimately come to the table and either work with industry or at least allow their ecosystems to interoperate with the rest of the industry. Another challenge that we've seen-- and this is just unfortunately par for the course in our industry-- is that, across Europe, various publishers have different thoughts on best practises. And they can't necessarily align themselves. And marketers and advertisers have the same challenges.

And so when that happens, everyone is fragmented. And it makes it a very, very easy situation for the platforms to come in who already control the marketplace and dominate the marketplace and just dictate policy and dictate exactly what the technical infrastructure looks like.

And what about IAB, Europe's Transparency and Consent Framework. Where does that fit into this?

There is a great framework that we've worked on for months now. So at AppNexus and with other independent players in the ecosystem, we came together over a year ago, took a step back, looked at the ecosystem and said, OK. If we're going to continue to provide the services to our clients so that the online advertising ecosystem can continue to thrive and publishers can continue to provide good content to users and advertisers can continue to reach the audiences that they want to reach, we all need to work together. And we need to create that.

And it exists. It's been launched. There are a number of parties already using this today. But as we discussed, those challenges still exist. And so I think we really are going out and talking to our clients and talking to the ecosystem and explaining to them that, if they don't step up and they don't get behind an industry framework, the natural consequence of that is going to be that half of or maybe a majority of the independent ecosystem ceases to exist.

And their only option to monetize their sites or reach the audiences they want to reach is actually the large platforms that this regulation was intended to ultimately clean up and force to have better practises around the use of data.

Tell us more about the genesis and the mission of IAB, Europe's Transparency and Consent Framework?

It's to level the playing field. It's truly to provide control back to publishers and provide control back to advertisers so that they can choose the vendors that they want to work with and they can continue to monetize and provide free content in a standardised way.

And what about the global vendor list. Why is that so pivotal for the framework to really work in the way it should?

It's pivotal in a number of ways. A good example is, as consumer shows up on a website today, they're shown a cookie banner. And typically they ignore them or they hit OK. They just want to get to their content. But if a consumer actually wants to know what's happening behind the scenes-- so for example, who all those various vendors are that I mentioned, like ad servers and SSPs and DSPs-- there's no good way for them to do that.

The global vendor list makes this a reality. The global vendor list standardises this across the board so that, if you're a consumer and you really want to understand exactly who's getting your data, exactly what they're doing with it, and potentially opt out or not give consent that, it's completely easy. One list to go to.

We always knew that GDPR was going to be very, very complex. So let's see if we can refine that to maybe three key takeaways for our audience so that key players in the digital marketing industry can really get to grips of what they need to be doing to successfully align themselves to a post-GDPR world.

I'm going to look at it from a publisher perspective, an advertiser perspective, and a vendor perspective. So if you look at it from a publisher perspective, they want to continue to monetize their sites and provide free content to their users. They need to look at their demand sources. They need to look at the marketers who are buying their inventory and all of the vendors that they're using and then sign up to use a consent-management platform and control those vendors through that.

Advertisers, on the other side, need to look at the supply sources they're buying from. And they need to understand the vendors that those supply sources are using. And they need to call those supply sources and tell them the vendors they're using and who those supply sources should allow. The other thing that they really need to make sure they know is, are they going to keep getting access to the reporting data that they need after the fact?

So marketers are only going to spend on sites, they're only going to buy audiences if they can measure that. So they want to know, was their ad delivered? How many eyeballs saw it? Where were those eyeballs located? If they don't get that data, there is no way that they will continue to buy that inventory. And unfortunately, there are a number of very big parties out there today who are about to cut off access to all of that reporting data.

The last bucket is vendors. So we are a vendor. You need to go out, if you're not already doing that, and talk to your supply sources, talk to your demand sources, make sure you're on the global vendor list, and make sure whatever you're doing is aligned with industry.

Well, we know that we're in very uncertain times at the moment and a lot of nervousness around GDPR. And it's been interesting to get more clarity of how the digital marketing industry can actually make sure it aligns in a way that benefits it and benefits the wider industry as well. So it's been fascinating finding out more. Julia Shullman from AppNexus, thank you very much indeed.

Thank you.