We respect your privacy. Learn more here.
As of May 25, 2018, all companies that collect, use, process, and share data about EU citizens are required to comply with the General Data-Protection Regulation (GDPR) and implement new data-protection and security measures.
The regulation does not apply to EU companies alone. Regardless of whether an organization is based in the EU, it must comply with the regulation when processing EU/EEA-citizen data, or face severe financial penalties.
For AdTech and MarTech vendors, the most important implications of the GDPR include:
A change to the definition of personal data: Identifiers such as IP addresses, device IDs, location data, and cookies are now considered personal data. This changes the way advertisers and technology vendors collect, store, and use such information.
New rules for data collection: Companies wanting to collect and process user data have to obtain consent from users and comply with some stringent rules. For the most part, consent has to be freely given, specific, informed, and unambiguous. Also, consent boxes cannot be pre-ticked and have to be given with a statement or clear, affirmative action. All companies processing the data are required to provide evidence that consent was given.
Consent is required for each data-processing activity: If companies wish to process user data for multiple purposes (e.g. behavioral targeting and personalization), they have to obtain user consent for each process.
For AdTech vendors, these new rules create a whole world of problems due to the fragmented nature of the online advertising ecosystem and the sheer number of players involved in a typical media transaction.
An illustration of how user data is shared (aka leaked) to various platforms during an online media transaction. Under the GDPR, each platform in the diagram has to obtain consent from the user to collect and process their data.
IAB—the Interactive Advertising Bureau, an organization responsible for creating and governing industry standards, research, and legal support for online advertisers—has proposed its own solution to help support the industry through the roll-out of the GDPR and solve some of the main challenges in its GDPR Transparency and Consent Framework.
In March 2018, the IAB’s framework was submitted to AdTech companies and publishers for public comment.
The framework is intended to support publishers, technology vendors, and advertisers in meeting the transparency and user-consent requirements of the GDPR.
The framework is governed by the IAB Tech Lab and is a non-commercial, open-source initiative and was developed in collaboration with a number of publishers, advertisers, and other important industry participants. First released for public review in March 2018, with the commercial version released in April, the framework is designed to standardize the process of gaining consent to collect and use personal data.
Our MarTech development teams can work with you to design, build, and maintain a custom-built consent management platform (CMP).
User consent is one of six “legal grounds” for processing personal data. The framework makes it much easier for first-party publishers (whose services entail the use of a number of third parties) to process user data and to obtain consent in compliance with the rules laid down by GDPR.
The IAB’s framework standardizes the process of getting Internet users’ consent for data processing, and relays this information further down the advertising supply chain.
The proposal also includes a Global Vendor List (GVL), which works as a registry of data controllers participating in the Framework. Think of it as a “whitelist” of vendors through which consent can be requested by first parties—publishers who directly interact with users.
Here’s a brief step-by-step overview of how it works:
The publisher selects which technology vendors from the Global Vendor List it would like to partner with.
Each time a user accesses the publisher’s website for the first time, they are asked to select the companies with whom the publisher can share their data. This information will be stored in a first-party cookie in the user’s browser.
In June 2018, the IAB Tech Lab and IAB Europe released a mobile in-app specification for mobile app providers.
Once the user has made their selection, the publisher can then share the user’s data with the selected technology vendors.
An example of how the consent-sharing process could look. The user has allowed the platforms in green to collect and use their data. The platforms in orange were on the publisher’s Global Vendor List, but the user didn’t provide consent. Those in red weren’t on the publisher’s Global Vendor List.
Assuming the user has allowed all the technology vendors to collect their data, which isn’t likely, only those on the publisher’s Global Vendor List would be able to collect the user’s data.
Looking at the example diagram above, the user hasn’t allowed DSP#1, DMP#2, and DMP#3 to collect their data, even though they are included on the publisher’s Global Vendor List.
In order for publishers to effectively communicate with whitelisted technology vendors, the IAB recommends passing the user’s consent decisions down the supply chain.
The user-consent information would consist of two binary strings (a purpose-choice string and a vendor-choice string) and then turned into a compressed value as seen in the image below.
The purpose choices represent the purpose of the data collection (e.g. behavioral advertising and retargeting) and the vendor choices represent the technology vendors the publisher has whitelisted that have received user consent and, therefore, can receive the user’s data.
Source: Digital Advertising: Transparency, Control, Consent. IAB Europe, March 2018
The compressed value would be added to each ad and bid request further down the supply chain (or daisy chain, as the IAB is calling it), allowing only the whitelisted technology vendors to receive the user’s data.
The IAB’s GDPR Transparency and Consent Framework offers an array of benefits for users and advertisers:
The IAB’s GDPR Transparency and Consent Framework is still far from perfect and requires certain adjustments to guarantee full compliance with the GDPR for AdTech companies and publishers. This is no small feat, considering the complex nature of the programmatic ecosystem. Many of the benefits of the GDPR create new challenges, not only for AdTech companies, but also for Internet users.
Some articles urge publishers against teaming up with companies behind IAB’s framework (Google and Facebook included), as it may be seen as favoring advertisers. There are a number of publications around the web pinpointing the pitfalls and inconsistencies of the IAB framework, but the main complaints include:
In April 2019, IAB Europe and the IAB Tech Lab released the second version of the framework (version 2.0) for public comment.
The update also included feedback gathered from data protection authorities, such as the UK’s Information Commissioner’s Office (ICO), which published a report in June 2019 titled Update report into adtech and real-time bidding. The report highlighted some serious concerns around areas like transparency, the collection of special category data, and legitimate interest.
On August 21, 2019, The IAB Tech Lab and IAB Europe announced the release of the Transparency and Consent Framework version 2.0 – an upgrade intended to combat some of the pitfalls of the initial release of the framework.
TCF 2.0 aims to further increase consumer transparency and choice and support industry collaboration. The framework is developed in collaboration with various publishers and regulators to support GDPR-compliant programmatic deals.
The recommendations set out in TCF 2.0 cover consumers’ right to grant or withhold consent, as well as exercise their right to object to the processing of their data. Consumers also gain more control over whether and how AdTech vendors may use certain features of data processing like precise geolocation.
The updates to TCF also allow publishers to control which data-processing purposes are used by individual AdTech vendors on their sites.
A couple more updates include:
Below are the new purposes included in TCF 2.0 as provided by IAB Europe.
Cookies, device identifiers, or other information can be stored or accessed on a user’s device for the purposes presented to them.
Ads can be shown to users based on the content they’re viewing, the app they’re using, their approximate location, or their device type.
A profile can be built about a user and their interests to show them personalised ads that are relevant to them.
Personalised ads can be shown to a user based on a profile about them and ads that are relevant to them.
A profile can be built about a user and their interests to show them personalised content that is relevant to them.
Personalised content can be shown to a user based on a profile about them.
The performance and effectiveness of ads that a user sees or interacts with can be measured.
The performance and effectiveness of content that a user sees or interacts with can be measured
Market research can be used to learn more about the audiences who visit sites/apps and view ads.
A user’s data can be used to improve existing systems and software, and to develop new products.
TCF 2.0 also includes two Special Purposes and don’t require consent from users as they fall under a different legal basis (legitimate interest) in the GDPR:
A user’s data can be used to monitor for and prevent fraudulent activity, and ensure systems and processes work properly and securely.
A user’s device can receive and send information that allows them to see and interact with ads and content.
Google announced on August 12, 2020, that it would be integrating the IAB’s TCF 2.0 with its ad products:
Google has given publishers a series of dates, before which they’ll need to adjust their consent collection to be compliant with TCFv2:
To support our partners with the transition, we will give them a 90-day grace period from August 15 to ensure their implementation is working properly and meeting our policy requirements.
Here’s an overview of the grace period:
Revisions to the framework had been undertaken in light of IAB’s ongoing legal conflict surrounding the compatibility of the TCF with the European Union’s General Data Protection Regulation (GDPR)
One significant change in the revamped framework is the exclusion of legitimate interest as a valid legal basis for processing and using personal data for advertising and content personalization.
Furthermore, the information provided to end-users has undergone several enhancements. The purposes and features now have different names and descriptions that are more user-friendly.
Instead of legal text, the descriptions are now accompanied by real examples to help illustrate their practical applications.
The updated TCF also establishes a standard format for gathering more details from vendors regarding their data processing activities.
This collected information would then be made available to end-users, with the additional information covering the following aspects:
Yet another aspect mentioned in TCF 2.2 is that consent management platforms (CMPs) must provide clear information on the total number of vendors aiming to establish a legal basis, prominently displayed on the initial layer of their user interfaces, ensuring transparency.
On top of that, publishers and CMPs must establish clear measures to enable users to easily access the CMP user interfaces and withdraw their consent.
Although the TCF was created to help companies comply with the GDPR, privacy advocates and data protection authorities in Europe have argued that it breaks many articles contained in the regulation.
Back in 2019, the Belgian Data Protection Authority (DPA) launched an investigation following 22 complaints concerning the IAB TCF and its potential violation of the GDPR.
In 2020, it was determined that the TCF violated the GDPR for facilitating unauthorized sharing of personal data among organizations and lacking adequate controls in the OpenRTB system.
The Belgian DPA released its preliminary decision in this case in November 2021, and later, on February 2, 2022, the final decision was issued.
Due to the TCF being found insufficient for preserving EU data protection law, the pop-up notifications that request people’s consent upon visiting a website are considered unlawful, meaning that all the information gathered through those pop-ups from over 1,000 companies, including Google and Amazon, must be erased.
The Belgian DPA granted approval for an action plan in January 2023, requiring IAB Europe to update its framework within a six-month period.
However, merely two months later, in March 2023, the DPA decided to suspend the original six-month deadline. As of now, the implementation timeline is being reevaluated by the authorities.
The final ruling could have far-reaching implications, potentially disrupting data collection practices and raising questions about accountability for resolving the problem.
It goes without saying that advertisers, publishers and everything in between must promptly evaluate their dependence on the framework.
Given that numerous businesses have made payments to IAB Europe for this service, it has the potential to place the trade group in an uncomfortable predicament.
Currently, there is a great deal of uncertainty surrounding the whole situation, and nobody possesses a definitive understanding of its implications.
It’s challenging to determine the exact form of the TCF’s remedy without additional specifics about the action plan. Nevertheless, the Belgian DPA has provided a set of corrective actions that IAB Europe should incorporate into their proposed measures.
These suggested actions are likely to be a crucial part of the approved remediation process.
Even the question of whether the regulators can effectively implement their own decisions remains uncertain.
However, there is one clear aspect: the major tech platforms will likely accept and adapt to whatever outcome arises, as they have already established terms of service to which users agree when using their platforms.
In a post-GDPR world, advertisers have problems providing full personalization and targeting without clear and explicit consent of the user. Audience selection will have to be based on cohorts and context, i.e. non-personal data.
There are, however, certain alternatives to the IAB’s proposed framework, which could offer better protection for publishers, restrict data leakage, and allow advertisers and AdTech companies to run personalized and targeted campaigns to users who have provided consent.
Piwik PRO Consent Manager
Piwik PRO GDPR Consent Manager allows you to collect visitor consents in line with GDPR, and efficiently manage all data-subject requests from a beautifully designed panel. Using a simple editor, you’ll be able to create and edit consent-request popups and other types of widgets helping you to collect lawful consents. They will serve as a gatekeeper between your website’s visitors and an array of tools that will later operate on agreed types of data.
Konsento
Konsento makes it easy to collect and manage user consents and keep track of your records of data-processing activities. Perfectly suited for non-profits, sports clubs, and associations.
Ensighten
Ensighten offers an easy-to-install (via a single line of code through any tag-management system) GDPR solution.
TrustArc Cookie Consent Manager
Cookie Consent Manager provides a cookie-compliance solution, including support for visual customization and branding. It enables implementation through a single script and integration with tag-management systems.
Publishers, agencies, and AdTech vendors who don’t consider IAB’s consent framework compelling enough can still resort to building their own user-consent tool. Teaming up with an experienced software-development company that specializes in building custom software solutions can make compliance with the GDPR and other privacy laws much easier.
Specifically, a bespoke consent tool can help your company avoid the costly fines associated with non-compliance with the GDPR. Designing and developing new software allows you to focus on specific features and technologies your company needs: acquiring user consent, managing user rights, or minimizing data leaks.
Our MarTech development teams can work with you to design, build, and maintain a custom-built consent management platform (CMP).
