Ross Webster is a consultant at The Lucid Privacy Group and NDA’s regular columnist. Lucid provides practical privacy advice and solutions to global enterprises. Previously, Ross held European MD roles at The Weather Company and Foursquare.
Over the last few weeks, the IAB Europe (IAB EU) have been running rather dry, but wholly necessary and informative webinars explaining what the changes within the Transparency Consent Framework Version 2.2 (TCFv2.2), due in September 2023, will mean for vendors, consent management platforms (CMPs) and publishers.
Privacy has never been the sexiest subject for the media industry. Some publishers have reacted to the fast-evolving regulations from Europe with resigned indifference, or even wilful avoidance. Privacy has been seen as a cost base, rather than a value-driver.
The original TCF was first introduced by the IAB EU in 2018 as a necessary framework to manage programmatic advertising compliance under the GDPR and the ePrivacy Directive. The development of the TCF was driven by the need for the industry to comply with GDPR, and placate the regulators. Back then, ‘Privacy by Design’ was mainly science fiction within AdTech, and the TCF was viewed as adding a level of burdensome complexity into the existing systems and workflow for even for the most patient AdTech practitioner
Publishers needed to make changes to their websites and AdTech infrastructure, which required additional technical expertise and legal requirements that were previously unheard of across traditional sales floors. Many publishers felt that the TCF shackled their ability to control their own data, as well as the ability to directly engage with users on their terms.
That TCF introduced a disruptive user experience for their reader, through annoying consent pop-ups, and they were naturally worried that this added complexity would adversely affect revenues. And if users chose to withhold consent or opt out of certain data processing activities, it would limit the publisher’s ability to deliver personalized ads or target specific audience segments.
Five years hence, TCF Version 2.2 was announced to fulfill the IAB EU’s commitments made to the Belgian Data Protection Authority in the wake of its ruling against the IAB EU and the TCF program. Many of these new changes could be viewed as a further burden on publishers, and their ability to drive revenues.
Under TCF V2.2, legitimate interest as a legal basis for processing will be further restricted, and consent is now the only legal basis for ad related personalization. Publishers will need to be more transparent on who, what and where they are sharing their users data with less opaque ‘legalized’ language and the use of dark patterns within their consent mechanisms.
Publishers will now need to reveal how many vendors they are sharing data with on the first layer of the consent banner. The Belgian DPA believes that a user pressing an “Accept All” button on a CMP, allowing the sharing of data across 500+ vendors does not constitute meaningful consent. Even the most trusted website announcing such a staggering number will make any user go, “Wait, who are all these companies, and why are they collecting my data?”
Cue much hand wringing by publishers as the perceived noose of GDPR tightens around the neck of their programmatic advertising revenue. However, I believe that this gloomy sentiment is wholly misplaced.
Opportunity for publishers
TCFV2.2 offers an opportunity for publishers to establish their primacy within the RTB ecosystem and realize the opportunity that they should have seized 5 years ago.
Rather than another race to the bottom where their inventory became largely commoditized, the opportunity is significant for publishers that want to lean into these changes. Five years on from GDPR, publishers have access to greater data related expertise, with better tools to understand and manipulate data and monetisation strategies have improved in leaps and bounds.
- Better business. At the more progressive publishers, we have seen the promotion of Chief Privacy Officers and Chief Data Officers to help equip the businesses to exploit the future opportunities. (Some canny businesses have even retained the services of specialized consultancies like Lucid Privacy)
- Stronger partnerships. The need for greater transparency is going to lead to a more proactive curation of which vendors publishers work with. We are no longer in a world where more data, and more vendors is seen as good. Vendor curation will give publishers the opportunity to secure a scarcity on their inventory. Charging vendors ‘table stakes’ to play. And work with vendors that are focussed on achieving in the future business models.
500 vendor partners? 200? 100? 50? I’m not sure what the sweet spot is, but I do know that it will be easier for publishers to forge stronger commercial relationships with 50 key vendors rather than 500.
- User trust. Improved curation of vendors will drive trust with the readers. Research suggests that “users who feel in control of their personal data are X3 more likely to react positively to advertising & X2 as likely to find it relevant.” Greater transparency leads to higher conversions, greater loyalty & potential new revenues.
- Cross-industry accountability. And we are now seeing agencies and brands lean into privacy as an expectation. The buy side is increasingly focussing and auditing privacy and transparency across their suppliers. Better curation of vendors by publishers will generate a higher level of partner comfort.
The leveraging of the publisher’s unique relationships with their readers will be illustrated most clearly in the availability of 1st Party Data (1PD). 1PD is the new gold, when the cookies get depreciated, and new ID solutions prevail. Publishers have the opportunity to double down with partners that can offer them the expertise and product set to exploit this 1PD. With new technology and ID solutions, understanding consent will drive new revenue streams through complex targeting.
The IAB EU’s evolving solutions present a real opportunity for a consistent, interoperable, and now cross-jurisdictional privacy-compliance approach. Many publishers will look to move further than the regulatory minimum in a predictable way. This in turn will mean that publishers and their partners won’t succumb to constant regulatory whiplash as new laws append their strategy.