Advertisers Seek Balance of Revenue Needs Against Growing Privacy Obligations

NEW YORK CITY -- Advertisers must “remain vigilant” and take a privacy-first approach with the increase in global privacy regulations and enforcement heating up, Interactive Advertising Bureau Tech Lab CEO Anthony Katsur said at IAB’s Signal Shift event Thursday. To help, the IAB Tech Lab plans to launch a privacy lab this summer and is exploring privacy-compliant technologies that can help reduce advertisers’ revenue shortfalls from “signal loss,” which refers to reduced access to consumer data stemming from tech changes like privacy controls in web browsers.

Meanwhile, the UK Information Commissioner’s Office is exploring how to balance consumer privacy against websites' desire to make money, said Florence Greatix, ICO principal policy advisor for online tracking technology. ICO recognizes how the simple kind of privacy controls it likes to see on websites can make monetization difficult for businesses, she said.

The ad industry is facing privacy “burnout” as regulations “come on hard and fast” around the world, said Katsur. The CEO rejected the perception of some that the rules aren’t backed up by meaningful enforcement. He pointed to the California Privacy Protection Agency’s action this month against Honda as significant (see 2503120037). And that’s just the “tip of the iceberg,” said Katsur, predicting enforcement against advertisers or major media companies globally.

Privacy regulators are "staffing up" and "laser focused" on creating rules and enforcing those that exist, Katsur said. “To become lax about privacy is to do so at your own risk … Regulators are just getting warmed up.”

IAB’s in-development privacy lab is considering how AI and machine learning can refine first-party consumer data into even more useful information, said Katsur. This can help companies segment audiences, identify new audiences and exercise data minimization, the concept of limiting collection upfront that is becoming a key component of privacy laws.

In addition, the lab will explore privacy-enhancing technologies (PETs) such as secure multiparty computation, differential privacy and homomorphic encryption.

Additionally, IAB Thursday launched Trusted Server, an open-source and server-side ad management framework that responds to signal loss from increasing browser restrictions, said Katsur. Trusted Server avoids the browser restrictions by shifting ad functions to publisher-operated infrastructure, which, IAB says, preserves first-party signal, enhances privacy compliance and mitigates publisher data leakage.

For too long, browsers have dictated ad rules and controlled the “last mile” to reach consumers, resulting in revenue loss for advertisers, Katsur told the audience. "It's time you took back that right."

ICO Prioritizes ‘Meaningful Choice’

While reviewing the UK’s top 200 websites last year, ICO saw a big improvement in the number of those offering buttons for users to reject all cookies, said Greatix. “But what we do recognize is that when people click reject, that doesn’t give any way to deliver advertising to those users.”

“So what we’re looking at doing this year is understanding how the users that have clicked reject can still be monetized to support the industry … in a way that is not risky to users and not intrusive to them.”

This year ICO is following up its 200-website review with an audit of the UK’s top 1,000 websites, said Greatix. While accounting for monetization needs, the office’s bar will remain high for companies providing “meaningful choice and control” to consumers, she said.

Additionally, ICO plans to release a variety of papers in the months ahead, said Greatix. These include a final guidance on anonymization coming next week and a draft about the Internet of Things later this spring, she said. Later this year, ICO plans to release guidance for the public about understanding choices. Updated encryption and cloud computing guidance are also coming soon.

Additionally, an upcoming update to 2019 guidance on cookies, which ICO now refers to as storage and access technologies, will cover social media pixels, email hashing and URL tracking, said Greatix. Also, the paper will expand on what “strictly necessary” means under UK law and include a chapter on online advertising.

Meanwhile, ICO is examining the potential of PETs, which might be helpful for developing a privacy-by-design approach but shouldn’t be seen as a “silver bullet,” said Greatix. Kotsur noted that IAB would happily share its privacy lab’s research on PETs with ICO and other government regulators.