Latest updates: read more about the RTB complaints.
Premium publisher group DCN tells regulators “the sky won’t fall” if RTB data leakage is fixed by removing personal data from bid requests.
DCN is a major trade body that represents premium publishers of various sizes, which together reach the entire US population and much of Europe. Its European members include The Guardian, The Financial Times, and Axel Springer.
DCN’s letter informs regulators that real-time bidding is important, but currently disadvantages publishers in three ways. First, “real-time data leakage” allows third party intermediaries to collect data about publishers’ audiences and target those audiences cheaper elsewhere. Second, “real-time revenue leakage” sees 80%-55% of publisher revenue captured by adtech companies. Third, ad fraud diverts revenue from publishers, and may also undermine advertisers’ trust and willingness to spend on digital advertising.
An obvious remedy to the grave data protection concerns about real-time bidding, and to these three problems, is to remove the 4% of variables in the IAB and Google real-time bidding specifications, so that only non-personal data are broadcast. DCN suggests that this would not negatively affect legitimate publishers.
Removal of personal data from bid requests would negatively impact adtech companies who collect and use data across the web but, ultimately, value would likely shift towards other ways to target advertising which do not require personal data to be shared with all parties such as targeting based on context, non-personal data, localized or 1st party data and other new and old ways to predict and measure advertising relevance. It would direct new innovation in adtech which we can’t predict.
As Jason Kint, DCN’s CEO, writes, removing personal data from bid requests might disadvantage adtech companies, but the sky won’t fall for publishers.
However, DCN notes that individual publishers are unable make this change on their own, because the first mover will be disadvantaged in the market. The remedy must be applied simultaneously to all publishers.
DCN’s letter was written in response to a request for expert evidence for European data protection authorities from Ravi Naik, a partner at ITN Solicitors, who is working on the GDPR complaint about widespread data leakage in Google and the IAB’s real-time bidding systems.
The full text of DCN’s letter is copied below. You can download the PDF here.
Ravi Naik
ITN Solicitors
19 – 21 Great Tower Street
Tower Hill
London, EC3R 5AQ
June 17, 2019
Dear Ravi,
With over 20 years of experience in digital publishing, I am closely following Brave’s adtech complaint against Google and others as it relates to Article 5 of General Data Protection Regulation. I am writing to offer some thoughts about the relative importance of real-time bidding (RTB) in the digital advertising marketplace and on the underlying issues in the handling of personal data under consideration in your case.
Background on DCN
Currently, I am CEO of Digital Content Next (DCN), a trade association based in the United States. Founded in 2001 as the Online Publishers Association, DCN is the only trade organization in the U.S. dedicated to serving the unique and diverse needs of high-quality digital content companies which enjoy trusted, direct relationships with consumers and marketers. DCN’s members are some of the most trusted and well-respected media brands that, together, have an audience of 256,277,000 unique visitors or 100 percent reach of the U.S. online population[1]. In layman’s terms, every person in the U.S. who goes online will visit one of our member companies’ websites at least one time each month. DCN also has important European members, including The Guardian, The Financial Times, and Axel Springer. The UK ICO has recognised the importance of DCN by inviting it to participate in the adtech stakeholders forum in London.
Revenue Impact from Real-time Bidding
The percentage of publisher revenue from real-time bidding (RTB) has been steadily increasing as advertisers shift towards these automated, high-speed auctions of advertising (in industry parlance known as “programmatic”). From the very beginning, the pricing decisions have been based on the advertiser’s desire to microtarget an individual user through the use of a unique ID. In 2017, 19% of DCN members’ digital advertising revenue came from this type of advertising[2]. It’s important to note this revenue is shifting from other channels rather than being created anew. Ultimately, it’s likely that programmatic advertising, as defined by automated auctions, will continue to grow. How it grows and is allowed to operate is a critical concern to the entire industry.
Real-time Data Leakage
Currently, RTB bid requests allow third party intermediaries to collect personal data which may be used in separate and unrelated commercial activities at a later date. This data has significant value and, when used by these third party intermediaries for secondary purposes beyond the original purpose of servicing the ad, the principals of the initial RTB transaction, the publisher and the advertiser, do not directly benefit. As for-profit companies, often venture-backed, the third party intermediaries have considerable pressure to maximize their access to and use of this data. This incentive leads to widespread data collection across the web by literally hundreds of adtech companies often referred to as “data leakage.” The largest and most-significant of these adtech intermediaries is Google. In the roll-out of GDPR, Google clearly flexed its dominance to make certain that the GDPR had minimum impact on its data collection, data use and overall revenues causing publishers globally to express concern to Google’s CEO[3].
Real-time Revenue Leakage
In addition to the data leakage, there has been significant discussion in the industry about how much revenue is being siphoned off by the third party intermediaries. The percentage of a digital media buyer’s budget captured by adtech companies (or “Adtech Tax”) has been reported to be as high as 80% based on limited testing and as low as 55% in widely shared research. It is important to note that the 55% low point was established by the representatives of the adtech industry, a source with a thorough understanding of the marketplace and presumed to have incentive to be conservative in its analysis[4].
The arbitrage of consumers’ personal data by parties other than publishers undermines the value of publishers’ advertising inventory. DCN began to establish the relationship between data collection and market concentration to intermediaries in 2015 ultimately coining the term “duopoly” to describe Facebook and Google’s success in the practice[5].
While programmatic advertising marketplaces have created valuable market efficiencies for publishers, a significant percentage of revenues flow to the intermediary companies. Alessandro Acquisti, Professor of Information Technology and Public Policy at the Heinz College, Carnegie Mellon University (CMU), has demonstrated publishers only increase revenues by 4% when making their inventory available for behaviorally-targeted advertising campaigns in real-time bidding (RTB) marketplaces. While advertisers pay significant premium for behaviorally-targeted advertising, the vast majority of the increased revenue goes to intermediaries. In addition, when intermediaries are engaged in the serving of these ads, they are able to collect and re-purpose data for later use across the RTB ecosystem, which further undermines the value of a publisher’s inventory[6]. Professor Acquisti’s research can be found here.[7] It is important to note that this shifting of benefits also takes away from necessary investment back into high quality news and entertainment.
Removal of personal data from bid requests would negatively impact adtech companies who collect and use data across the web but, ultimately, value would likely shift towards other ways to target advertising which do not require personal data to be shared with all parties such as targeting based on context, non-personal data, localized or 1st party data and other new and old ways to predict and measure advertising relevance. It would direct new innovation in adtech which we can’t predict.
Publishers’ Prisoner Dilemma
However, it’s important to recognize, given the current state of the marketplace, there would be a first mover disadvantage to a single publisher that removes personal data from bid requests if its competitors have not done so. This prisoner’s dilemma prevents any individual publisher from benefitting from protecting its own user relationships and its users’ personal data, because an advertiser could simply purchase other advertising “inventory” from alternative publishers who had not done so. We have already seen this effect in inventory protected from use of personal data such as inventory served on Safari browsers with tracking prevention. Therefore, whatever happens must apply simultaneously to all publishers in a market.
In addition, there is evidence that ad fraud is facilitated by the inclusion of personal data in RTB bid requests. In a 2015 study of bot activity across premium publishers and a separate study by the Association of National Advertisers (ANA), there was demonstrated a correlation between third party data collection and bot activity.[8] Although the adtech industry isn’t incentivized to demonstrate this through its own disclosures and self-funded research, it is logical that the more personal data is “decoupled” from the trusted relationship between consumer and publishers then the more likely third-party actors will either use the ability to microtarget audiences as cheaply as possible or lower their standards with respect to other bad actors.
According to the ANA’s fraud report, economic losses due to bot fraud were expected to reach $6.5 billion in 2017. To put that in context, advertisers spent approximately $10 billion in digital advertising with DCN’s premium publisher members in 2017. Other estimates are as high as $42 billion.[9] If bot fraud was successfully eliminated, publishers could reasonably expect that some or most of those revenues would be spent with legitimate publishers. In addition, the presence of significant bot fraud in digital advertising undermines advertisers’ trust in the medium. With increased trust, it is reasonable to assume that advertisers would shift additional resources to digital advertising.
The Sky Won’t Fall
It is important to note that reducing the amount of personal data in RTB requests would not lead to the demise of the digital advertising marketplace. Advertisers are not likely to decrease their spending on digital advertising given the importance of digital content and experiences to most consumers. If less personal data were available for behaviorally targeted advertising, advertisers would rely on other ways to tailor advertising, which could include the type of content on the website or app or privacy-friendly methods of developing audience segments which do not rely on tracking across multiple contexts through data leakage to third parties.
Properly Enforced GDPR Will Grow Consumer Trust
In closing, it is worth pointing out that the digital ecosystem currently suffers from a severe lack of consumer trust and massive overconcentration of benefits to just a few intermediaries. With rampant ad fraud, data breaches and the free flow of personal data to third party intermediaries, which often have no direct relationship with the consumer, consumers have ample reasons to distrust digital advertising. We are concerned that this lack of trust undermines the direct relationships that publishers enjoy with consumers and look forward to industry innovation to better align with consumer expectations to unlock healthier dynamics in the digital advertising marketplace.
Sincerely,
Jason Kint
Notes
[1] comScore Media Metrix Multiplatform Custom Audience Duplication, December 2017 U.S.
[2] 2017 DCN Financial and Operational Benchmark Study (confidential to membership).
[3] Letter to Google sent by trade associations representing global publishers (April 30, 2018), https://digitalcontentnext.org/wp-content/uploads/2018/04/Publisher-Letter-to-Google-re-GDPR-Terms-042918.pdf
[4] The Programmatic Supply Chain (2014), IAB, https://www.iab.com/wp-content/uploads/2016/03/Programmatic-Value-Layers-March-2016-FINALv2.pdf, p6.
[5] Kint, Jason, Google and Facebook devour the ad and data pie. Scraps for everyone else. DCN (June 16, 2016), https://digitalcontentnext.org/blog/2016/06/16/google-and-facebook-devour-the-ad-and-data-pie-scraps-for-everyone-else/.
[6] Hagey, Keach, Behavioral Ad Targeting Not Paying Off for Publishers, Study Suggests, Wall Street Journal (March 29, 2019), https://www.wsj.com/articles/behavioral-ad-targeting-not-paying-off-for-publishers-study-suggests-11559167195.
[7] Marotta, Abhishek, and Acquisti, Online Tracking and Publishers’ Revenues:
An Empirical Analysis (May 2019), https://weis2019.econinfosec.org/wp-content/uploads/sites/6/2019/05/WEIS_2019_paper_38.pdf.
[8] DCN Bot Benchmark Report: What Makes a Publisher Premium, DCN (2014), https://digitalcontentnext.org/wp-content/uploads/2015/09/DCN-Bot-Benchmark-Report-2015-.pdf, p11.
[9] Juniper Research: Advertising Fraud Losses to Reach $42 Billion in 2019, Driven by Evolving Tactics by Fraudsters,Yahoo! Finance (May 21, 2019), https://finance.yahoo.com/news/juniper-research-advertising-fraud-losses-060000423.html.
