Yesterday I attended the Westminster Media Forum policy conference: Regulation of advertising tech in the UK. This may make most readers want to take a nap, but the topics being discussed have the potential to impact every one of us that uses the internet. This is because it threatens to undermine the trade off that underpins how we use the internet - namely, we will give up our data, and in return we will get free stuff (think Facebook, Google etc.). This free stuff is in return funded by providers on the internet using our data to sell (targeted) ad space to generate revenue and profits. And adtech (and its revolutionary offspring "real time bidding") is what enables this to happen. Adtech analyses and manages information (including - critically - personal data) for online advertising campaigns and “real time bidding” uses adtech to enable the buying and selling of advertising inventory in real time, i.e. in the time it takes a webpage to load in a website user’s browser. So, what's the problem?
The problem is that this ecosystem is so unbelievably complicated that no one really knows where the data is going and how it is being collected and that's a big issue for data protection regulators. Under the EU's shiny new data protection law (the "GDPR") if personal data is used - and an IP address can be personal data - you need to have a valid lawful ground to use it. This often requires consent (especially if that personal data is sensitive, e.g. health data) and at the moment the UK regulator (the "ICO") does not think this is happening [see blog below]. In particular, the ICO is concerned by a lack of transparency (who knows this is happening and how?), the lack of valid consent or legitimate interests to use the data and the inadequate security measures taken by third parties throughout the adtech ecosystem. And so the ICO is saying that if this does not change, then it may be necessary for it to take formal regulatory action. This means potential fines (think of BA's fine of £183m last year) but, more significantly, the need to overhaul current practices to ensure compliance (in particular, how "cookies" are used to collect data from website visitors). And this is the critical point, if real time bidding and adtech has to change how it operates then how will this impact the $200bn industry? And does that mean no more free stuff?
The most effective way for organisations to avoid the need for further regulatory scrutiny or action is to engage with the industry reform and transformation, and to encourage their supply chain to do the same. Those who have ignored the window of opportunity to engage and transform must now prepare for the ICO to utilise its wider powers.