ICO adtech reform: a cause of frustration as much as optimism
Following a long investigation, this month the Information Commissioner’s Office outlined further details of how it will tackle the problem of real-time bidding and GDPR compliance. Here, two experts share their views on the progress.
Brave recently put out a note, penned by Dr Johnny Ryan, stating its disappointment about the lack of action by the ICO with regards to taking enforcement action against adtech players breaching GDPR. Brave is so upset that it is even considering taking legal action against the ICO.
That’s perhaps going a bit too far, but I can certainly relate the to the frustration. A lot of companies, including ours, have invested heavily in changing systems in order to be GDPR compliant. If companies that haven’t changed are allowed to continue to operate without penalty, then the status quo will persist and it will mean that our investment will be wasted.
I’ve spoken to marketers who have candidly admitted that they will not change their behaviour as there is too much value in being able to gather and use data in a non-compliant manner. They would only do so if they felt that there was a real danger that they would face a hefty penalty; speeding motorists are unlikely to slow down if it was common knowledge that none of the speed cameras worked.
At the IAB’s Digital Trust Forum, I was encouraged to hear Ali Shah, head of technology policy at the ICO, talk about time running out for bad players; however, I would’ve preferred it to have run out on the 1st of Jan as was originally stated by the ICO.
This month saw two highly anticipated announcements on consecutive days, and while the blog posts from Google and the ICO are unrelated, I can’t help but feel the sequencing of each is not coincidental.
Google’s planned changes to Chrome – which will phase out support for third party cookies within the next two year – effectively allows the tech giant to own the agenda for adtech’s future. We will see everyone – including regulators – wait for Google to make its move before reacting. A real marketing coup for Google who have owned the adtech headlines for a week by announcing little more than we expected.
The advertising industry once again feels the pervasiveness and influence of Google, something which may reignite those antitrust concerns. Yet on the flip-side, many of Google’s proposed actions are cautiously welcomed. For example, the shift from user-level data to aggregate data is a good thing that will focus our attention on delivering better outcomes rather than the process of data collection.
Similarly, aggregating statistics is synonymous with grouping users into cohorts or clusters – something that feels less intrusive and a direction we should see more technologies move in.
Simon McDougall’s ICO blog post was equally anticipated, coming two months after the adtech fact finding forum in mid November.
Overall, I expected a more direct response from the ICO, particularly in relation to data security and governance in open market programmatic – an area that appeared to be firmly in the regulator’s sights at the end of 2019.
McDougall’s latest statement makes it clear that many brands are still claiming ‘Legitimate Interest’ as a basis for their advertising activities, and that this won’t wash in the future. Advertisers must not forget that – through their brand websites – they are also publishers and are responsible for data compliance on these platforms too.
The ICO’s main criticism of the advertising industry is that there has been lots of talk and insufficient action. I can appreciate the frustration the ICO must feel when change isn’t happening as quickly as they might like. And while I expected McDougall to go further, working alongside trade bodies and initiatives like TCF is the best way to effect change across the whole industry.
Calling out individual companies who are good corporate citizens and supporting industry-wide initiatives such as the IAB’s TCF will not move mountains, as slow as it may seem.
As I said, it’s possibly no coincidence these two announcements happened on consecutive days. If browsers continue their assault on tracking and data sharing it could be that the version of programmatic advertising we end up with in two years is genuinely designed with privacy in mind.
Perhaps the ideal scenario is that this new world is so user friendly that the need for CMPs, the TCF and ICO intervention starts to diminish.