What is the current legal situation?
Before the introduction of the General Data Protection Regulation (GDPR) in 2018, data protection in electronic communications was still governed by the outdated “ePrivacy Directive” (Directive 2009/136/EC). Alongside the rollout of the GDPR, this ePrivacy Regulation was also supposed to be revised and implemented, since the GDPR itself does not clearly regulate the issue of cookies. However, the version of the ePrivacy Regulation planned for the GDPR’s start date on May 25, 2018, received substantial criticism from various parts of the ad tech industry. As a result, its implementation was postponed. As of now, it is not expected to come into force until 2021/22.
In addition, the European Court of Justice (ECJ) has weighed in on the topic of cookies in what’s known as the “Facebook Like Button” ruling. What does the ruling essentially say, and what do website operators and marketers need to pay attention to when implementing plugins that support third-party cookies, such as the Facebook Like Button?
- Website operators are just as responsible for data protection violations as Facebook itself.
- The automatic transmission of third-party cookies — and thus user data — via the Facebook Like Button violates European data protection law.
- Trade associations can issue formal cease-and-desist warnings to websites that include the Facebook Like Button without providing users with a clear and explicit way to give consent — and those warnings can come with legal costs.
Cookies used for tracking purposes must be explicitly consented to by users. Merely informing users is not enough.
What does the new ePrivacy Regulation mean in practice??
The ePrivacy Regulation states that there can no longer be any “silent consent.” This is described in Article 9 of this regulation. There must be a conspicuous notice that data is being collected. The user must expressly agree to this before any data transfer may take place. According to the interpretation of the court ruling, this is the correct procedure.
What can we expect in the near future?
1. Major browsers are blocking third-party cookies
Public demand and awareness for privacy and data protection have risen significantly in recent years. As a result, browsers like Mozilla Firefox and Safari have already completely blocked the use of third-party cookies. Now, the giant Google Chrome has also announced that by 2022 it will stop supporting third-party cookies altogether. For the ad tech industry, this would mean a complete reset. Alwin Viereck, Head of Programmatic Advertising and Ad Management at United Internet Media (UIM), summed it up quite accurately:
"Without cookies, there’s no identity; without identity, there’s no data for targeting; without targeting, there’s no demand — and that directly impacts revenue."
Newspaper publishers, already under financial pressure, now face another serious problem. Their business model is fairly simple: a) selling copies and b) advertising revenue. Since print revenue is statistically declining, and publishers are shifting to digital, the extinction of third-party cookies means even more lost income — unless a viable alternative is found.
2. New: Google’s cookieless tracking
A possible solution is on the horizon. In August 2019, Google announced that it is working on a so-called “Privacy Sandbox API.” This interface is expected to replace traditional tracking cookies in the digital advertising market by 2022. The key concept here is cookieless tracking.
The term “Privacy Sandbox” can be taken literally: within Google Chrome, user data will be stored internally in the browser — isolated from the rest of the internet — so that third parties no longer have access. This is the sandbox metaphor: the edge of the sandbox protects its contents from the rest of the playground. Tech companies would be able to access this data through an interface, allowing personalization and measurement without exposing sensitive personal data unrelated to advertising purposes.
However, the Privacy Sandbox will not allow the targeting of individual users. Instead, users with similar browsing behavior will be grouped into cohorts, which will only be accessible once they reach a certain size. The benefit is that no conclusions about individual users can be drawn — unlike with fingerprinting. According to Google, this is intended to strengthen privacy. In theory, third-party cookies could become obsolete.
That said, the first tests weren’t expected to begin until late 2020. These tests aim to measure click-based conversions in Chrome without third-party cookies, using data processed through the Privacy Sandbox.
3. A possible alternative: “Project Rearc”
Another idea was presented by the Interactive Advertising Bureau (IAB) at its annual meeting on February 10, 2020, in Palm Springs: “Project Rearc.” With a minimalist approach to GDPR compliance, the goal is to develop a browser-independent identifier based on encrypted email addresses or phone numbers. These would gather user information without being traceable back to individual users. This is intended to be a new solution for the post–third-party-cookie era. How this would actually be implemented — and whether such a model that works with highly sensitive data can truly be considered privacy-compliant — remains to be seen.
Another alternative is being developed by fusedeck. According to their concept, the user’s IP is anonymized without prior opt-in consent. The collected data is not used for the provider’s own purposes, but only passed on to the relevant client. Cookies are only set once the user explicitly opts in — and even then, they are encrypted as salt hashes for added security.
Outlook
One thing is certain: the online advertising industry is about to undergo massive changes. The only question that remains is what the consequences will be.
- Will Google, as the pioneer and market leader, succeed with its Privacy Sandbox?
- Or will entirely different approaches be necessary to meet the growing public sensitivity to privacy and data protection?
We’ll likely find out within the next two years.
Need for new communication strategies and approaches
Nonetheless, companies and agencies must already begin preparing for the need to develop and implement new advertising strategies. How will the usage, acceptance, and relevance of content and services on their websites and online shops be measured in a reliable and meaningful way? How will they even identify and target their users in the future?
If you follow the above developments through to their logical conclusions, they point to a fairly radical transformation of the ad tech industry. Finding answers to these questions is now the task at hand. Companies and agencies must step out of the previously quite comfortable “cookie zone” and start developing new solutions and offerings. But then again — it would be boring if there were no new challenges.
