Ravi Naik

ITN Solicitors

19 – 21 Great Tower Street

Tower Hill

London, EC3R 5AQ

June 17, 2019

Dear Ravi,

With over 20 years of experience in digital publishing, I am closely following Brave’s adtech complaint against Google and others as it relates to Article 5 of General Data Protection Regulation. I am writing to offer some thoughts about the relative importance of real-time bidding (RTB) in the digital advertising marketplace and on the underlying issues in the handling of personal data under consideration in your case.

Background on DCN

Currently, I am CEO of Digital Content Next (DCN), a trade association based in the United States. Founded in 2001 as the Online Publishers Association, DCN is the only trade organization in the U.S. dedicated to serving the unique and diverse needs of high-quality digital content companies which enjoy trusted, direct relationships with consumers and marketers. DCN’s members are some of the most trusted and well-respected media brands that, together, have an audience of 256,277,000 unique visitors or 100 percent reach of the U.S. online population[1]. In layman’s terms, every person in the U.S. who goes online will visit one of our member companies’ websites at least one time each month. DCN also has important European members, including The Guardian, The Financial Times, and Axel Springer. The UK ICO has recognised the importance of DCN by inviting it to participate in the adtech stakeholders forum in London.

Revenue Impact from Real-time Bidding

The percentage of publisher revenue from real-time bidding (RTB) has been steadily increasing as advertisers shift towards these automated, high-speed auctions of advertising (in industry parlance known as “programmatic”). From the very beginning, the pricing decisions have been based on the advertiser’s desire to microtarget an individual user through the use of a unique ID. In 2017, 19% of DCN members’ digital advertising revenue came from this type of advertising[2]. It’s important to note this revenue is shifting from other channels rather than being created anew. Ultimately, it’s likely that programmatic advertising, as defined by automated auctions, will continue to grow. How it grows and is allowed to operate is a critical concern to the entire industry.

Real-time Data Leakage

Currently, RTB bid requests allow third party intermediaries to collect personal data which may be used in separate and unrelated commercial activities at a later date. This data has significant value and, when used by these third party intermediaries for secondary purposes beyond the original purpose of servicing the ad, the principals of the initial RTB transaction, the publisher and the advertiser, do not directly benefit. As for-profit companies, often venture-backed, the third party intermediaries have considerable pressure to maximize their access to and use of this data. This incentive leads to widespread data collection across the web by literally hundreds of adtech companies often referred to as “data leakage.” The largest and most-significant of these adtech intermediaries is Google. In the roll-out of GDPR, Google clearly flexed its dominance to make certain that the GDPR had minimum impact on its data collection, data use and overall revenues causing publishers globally to express concern to Google’s CEO[3].

Real-time Revenue Leakage

In addition to the data leakage, there has been significant discussion in the industry about how much revenue is being siphoned off by the third party intermediaries. The percentage of a digital media buyer’s budget captured by adtech companies (or “Adtech Tax”) has been reported to be as high as 80% based on limited testing and as low as 55% in widely shared research. It is important to note that the 55% low point was established by the representatives of the adtech industry, a source with a thorough understanding of the marketplace and presumed to have incentive to be conservative in its analysis[4].

The arbitrage of consumers’ personal data by parties other than publishers undermines the value of publishers’ advertising inventory. DCN began to establish the relationship between data collection and market concentration to intermediaries in 2015 ultimately coining the term “duopoly” to describe Facebook and Google’s success in the practice[5].

While programmatic advertising marketplaces have created valuable market efficiencies for publishers, a significant percentage of revenues flow to the intermediary companies. Alessandro Acquisti, Professor of Information Technology and Public Policy at the Heinz College, Carnegie Mellon University (CMU), has demonstrated publishers only increase revenues by 4% when making their inventory available for behaviorally-targeted advertising campaigns in real-time bidding (RTB) marketplaces. While advertisers pay significant premium for behaviorally-targeted advertising, the vast majority of the increased revenue goes to intermediaries. In addition, when intermediaries are engaged in the serving of these ads, they are able to collect and re-purpose data for later use across the RTB ecosystem, which further undermines the value of a publisher’s inventory[6]. Professor Acquisti’s research can be found here.[7] It is important to note that this shifting of benefits also takes away from necessary investment back into high quality news and entertainment.

Removal of personal data from bid requests would negatively impact adtech companies who collect and use data across the web but, ultimately, value would likely shift towards other ways to target advertising which do not require personal data to be shared with all parties such as targeting based on context, non-personal data, localized or 1st party data and other new and old ways to predict and measure advertising relevance. It would direct new innovation in adtech which we can’t predict.

Publishers’ Prisoner Dilemma

However, it’s important to recognize, given the current state of the marketplace, there would be a first mover disadvantage to a single publisher that removes personal data from bid requests if its competitors have not done so. This prisoner’s dilemma prevents any individual publisher from benefitting from protecting its own user relationships and its users’ personal data, because an advertiser could simply purchase other advertising “inventory” from alternative publishers who had not done so. We have already seen this effect in inventory protected from use of personal data such as inventory served on Safari browsers with tracking prevention. Therefore, whatever happens must apply simultaneously to all publishers in a market.

In addition, there is evidence that ad fraud is facilitated by the inclusion of personal data in RTB bid requests. In a 2015 study of bot activity across premium publishers and a separate study by the Association of National Advertisers (ANA), there was demonstrated a correlation between third party data collection and bot activity.[8] Although the adtech industry isn’t incentivized to demonstrate this through its own disclosures and self-funded research, it is logical that the more personal data is “decoupled” from the trusted relationship between consumer and publishers then the more likely third-party actors will either use the ability to microtarget audiences as cheaply as possible or lower their standards with respect to other bad actors.

According to the ANA’s fraud report, economic losses due to bot fraud were expected to reach $6.5 billion in 2017. To put that in context, advertisers spent approximately $10 billion in digital advertising with DCN’s premium publisher members in 2017. Other estimates are as high as $42 billion.[9] If bot fraud was successfully eliminated, publishers could reasonably expect that some or most of those revenues would be spent with legitimate publishers. In addition, the presence of significant bot fraud in digital advertising undermines advertisers’ trust in the medium. With increased trust, it is reasonable to assume that advertisers would shift additional resources to digital advertising.

The Sky Won’t Fall

It is important to note that reducing the amount of personal data in RTB requests would not lead to the demise of the digital advertising marketplace. Advertisers are not likely to decrease their spending on digital advertising given the importance of digital content and experiences to most consumers. If less personal data were available for behaviorally targeted advertising, advertisers would rely on other ways to tailor advertising, which could include the type of content on the website or app or privacy-friendly methods of developing audience segments which do not rely on tracking across multiple contexts through data leakage to third parties.

Properly Enforced GDPR Will Grow Consumer Trust

In closing, it is worth pointing out that the digital ecosystem currently suffers from a severe lack of consumer trust and massive overconcentration of benefits to just a few intermediaries. With rampant ad fraud, data breaches and the free flow of personal data to third party intermediaries, which often have no direct relationship with the consumer, consumers have ample reasons to distrust digital advertising. We are concerned that this lack of trust undermines the direct relationships that publishers enjoy with consumers and look forward to industry innovation to better align with consumer expectations to unlock healthier dynamics in the digital advertising marketplace.

Sincerely,

Jason Kint