Why advertisers are staring down the barrel of big GDPR fines
The Information Commissioner’s Office has signalled a crackdown on personalised advertising that lacks explicit consent, and as brands are liable for their supply chain it’s imperative marketers find ways to prove compliance.
The football season has just started and, typically, many pundits are already predicting who’s going to win the league.
I might know very little about football, but I feel I know enough regarding the media ecosystem to predict that a number of brands, agencies and ad tech vendors are going to be looking down the barrel of a large GDPR fine within the next 12 months. The following reasons are why I believe this to be the case:
1. In its ad tech report, covering the real-time bidding (RTB) processes used in programmatic advertising, the ICO couldn’t have been more clear that it is deeply dissatisfied with the level of compliance within the industry.
Crucially, it dismissed legitimate interest as a legal basis for collecting and processing personal data for the purposes of advertising based on user profiles. It also stated that profiling users would require consent, which under GDPR must be informed, explicit and freely given.
2. This was an absolute bombshell because personal data is constantly collected at huge scale and used to create user profiles, which are then used to serve targeted or personalised advertising. There are literally thousands of audience segments in use in the ad tech ecosystem and with millions of individuals in most segments.
Most internet users have no knowledge regarding the extent of collection of their personal information, and would certainly not give their informed and explicit consent to the vast majority of data collection and profiling activities. We should therefore assume that unless consent can be clearly demonstrated, any targeted or personalised advertising is illegal.
3. The ICO has given the industry six months to get its act in order; this is a tight schedule but by no means impossible. However, given that large portions of the industry have yet to even start preparations to either find ways of gaining consent or move away from personalised advertising, I feel that many are going to be caught well short of being compliant come judgement day.
Given the ICO’s recent form in dishing out fines, one would be very foolhardy to bet on the ICO allowing lapses in compliance to go unpunished.
4. There’s also been some suggestion that only ad tech vendors, and particularly those involved in data collection or management, will be on the ICO’s radar. However, the recent judgement by the Court of Justice of the European Union involving Fashion ID essentially showed that a business can be a controller of personal data even if it has no access to the relevant information.
This creates an important precedent and casts the net very wide. A brand can therefore be deemed a controller and can be fined for any non-compliant activities amongst its contracted agencies and vendors. Essentially everybody in the chain can be held liable.
5. The IAB, which had taken on the role as the shepherd to guide the industry through GDPR, was dealt a setback when the ICO severely criticised its consent mechanism, which has been widely adopted by the industry. Its silence in response to questions posed by the Irish Data Protection Commission has left the industry looking for answers elsewhere.
6. Targeted advertising has been proven to deliver much better return on investment, therefore brands and their agencies are going to be loathe to give it up. A large number of vendors – comprising DSPs, SSPs, DMPs, ad exchanges, etc – are heavily dependent on targeted programmatic advertising and will probably look to run the gauntlet in the face of an existential crisis; they are caught between the devil and the deep blue sea.
It is due to these reasons that I’m convinced that there will be significant GDPR-related fines being dished out in the future. However, there are plenty of good options available to those looking to get on the right side of the law. Basically, there are two ways of doing this: stop all personalised forms of advertising or gain valid consent for any targeted advertising.
Contextual advertising provides the means to do the former, but for those of you who see the benefits of personalised and targeted advertising, there are firms – Rezonence being one – that allow brands to build fully compliant audience segments. With just six months to act before almost all targeted or personalised advertising is illegal, it’s crucial marketers start preparing.
With demonstrable consent, brands can continue with targeted or personalised advertising campaigns, crucially not falling foul of the ICO. If you are unable to provide this, you could very well be one of the brands fulfilling my predictions.
Prash Naidu is founder and CEO of Rezonence.
