AdTech Faces Privacy Issues

The online advertising world is undergoing some changes, both business and regulatory, driven by increased attention to privacy matters.

On the regulatory front, Google Analytics has been held by two different data regulators in the EU to violate the EU's privacy laws. So has the primary opt-in advertising framework published by ad industry trade group IAB. Finally, transferring data out of the EU is in legal limbo: negotiations between the US and the EU to approve a mechanism to allow US companies to move "personal" data out of the EU are moving extremely slowly. These all add up to numerous headaches for international business efforts to promote and market goods and services to EU users via common business solutions.  

On the business front, Google has been trying for more than a year to launch a replacement for third-party tracking cookies, something that Apple and other providers did years ago. Google’s cookies are so ubiquitous, however, and Google’s ad model is so high-profile, that they have not yet landed on a replacement technology that works for advertisers and for privacy advocates alike. 

All of this is driven by the increased desire to allow consumers some measure of control over their “personal” data. Regulators around the world are concerned about the monetization of consumer data and what they see as a lack of choice and information confronting consumers. Thus, the EU and several US states (and other countries around the world) have changed their privacy laws – which is driving both increased regulatory attention and business efforts to adapt. The differences between the laws of the US and the EU have EU regulators cracking down on transfers of data to the US, including via cloud storage or access.  

Why It Matters

Companies that rely on analytics, tracking cookies, and opt-in marketing campaigns online need to be aware of the business and regulatory changes that are affecting this area. If you have collected data in the past, you may be constrained against using it in new ways going forward; and for new campaigns, you may have to work with different providers or build a different workflow that accounts for new forms of notice, opt-in, or tracking. Finally, if your company uses solutions in the EU that involve cloud storage or other potential transmissions across borders, you may need to find vendors who can localize data collection so that EU data do not leave the Union.