Ad Tech vs Privacy

There are big changes coming about in ad tech, with Apples new update, the App Tracking Transparency framework and Google’s initiative to expand Privacy Sandbox to android. Why are the tech giants rolling out such changes? Changes that impact the entire ad tech ecosystem?

To understand this, we first must understand ad tech, its nuances and its complex relationship with privacy

The relationship between ad tech and privacy

Advertisement technology or ad tech broadly refers to the tools, processes and software used by various parties to buy, sell and manage digital ads.

This complex ecosystem consisting of publishers, advertisers and other parties often finds itself in defiance of various privacy requirements. Several processes involved in the ad tech ecosystem involve collecting individual data, without their consent and in some cases, without their knowledge. Data is collected from individuals in multiple ways, the most problematic being third party cookies, those cookies hosted by a different domain, or third party, for analytics and marketing purposes. Third-party cookies, unlike first party cookies (those hosted by the website/domain currently being visited) interacts with the user's web browser on any site visited and hence is able to track their activity across different domains. This tracking provides the advertisers with insights into the users likes, dislikes, preferences, behaviour etc. The insights are then used to display targeted and personalised ads to users.

Another notable way in which user data is collected, is from Session Replay Scripts. This is a type of analytics script that collects data about the user’s activity or interaction on a website or webpage. The type of data collected includes mouse movements, clicks, scrolling, mouse position etc. It can also include content typed into fields and forms. The information collected can then be compared with or superimposed over images of the website to create a reproduction of the user’s activity and behaviour on the website. This information provides businesses with insights into multiple areas, such as user intentions, user behaviour, what works on the website, which parts are overlooked, which parts are popular etc. Businesses can then make decisions about their website, layout, products, etc based on this real time, accurate information. However, with these scripts, privacy risks run high. Many users are not aware of such mechanisms and consider it disrespectful of their privacy. Further, with session replay scripts, there is a possibility of inadvertently collecting sensitive information about the user.

Privacy regulations like the GDPR lay strict emphasis on user consent and company transparency. Users visiting websites should be made aware of the cookies, that their information is being collected and information regarding the purpose of collecting data (mandated by CCPA). Further, depending on the state, provisions should be made post collection for users to correct, delete, request a copy of the data collected and more.

Further, data collected by and for ad tech purposes are rich and valuable sources of information pertaining to individuals and can in some cases can be made re-identifiable or traced back to the user. This leaves plenty of room for privacy risks such as data breaches, hacking, leaks, and the use of sensitive data for unintended purposes. Hence privacy regulations spell out multiple requirements with regard to the proper and safe storage of data. Companies are also obligated, by law, to comply with retention policies to ensure the timely destruction of data collected. Advertising technology also faces hurdles from individuals, as we see increasing awareness surrounding privacy and security. Users are expressing concern and distrust in companies on learning about the collection and processing of their personal data.

The constant trade-off between the needs of ad tech and consumer privacy has led to the changes we are seeing from companies like Apple and Google, in addition to other privacy compliant solutions from Verizon Media and Nielsen. Efforts are being directed towards enabling the success of ad tech by phasing out third parties and mitigating risks to ensure the ecosystem maintains privacy compliance.

Looking ahead

There are numerous solutions emerging in the endeavour of making the ad tech ecosystem more privacy compliant, the most common being to phase out third party cookies to cease tracking user behaviour across domains and collecting comprehensive data that can be traced back to individuals.

A notable solution being explored in the efforts to reduce individual tracking is Contextual Advertising. This type of ad tech uses Machine Learning to gain insights from the context of the ad, like the content of the web page or domain to deliver the ad to the user. For example, a user watching a video about travel might get to see an ad for a travel organisation. This type of advertising delivers the right ad to the right user without tracking their behaviour or using personal information for targeted ads.

Privacy can also be increased by the proper management, monitoring and handling of data collected to ensure both efficiency and security. Data should be stored and maintained in such a way that remains compliant with the various privacy regulations, be it subject access requests, retention policies and overall safeguarding of data against breaches and hacks. This can be achieved by implementing a comprehensive data map to track and manage data across different systems and to utilise workflows that enable both effectivity and compliance.

When it comes to session replay scripts, first party companies hold the responsibility of ensuring transparency and privacy compliant processes. It is that imperative sensitive data is not collected, that the scripts are not used to track user behaviour across domains, and utilising scripts should not be for advertising purposes. The Guide to Session Replay Scripts provided by the Future of Privacy Forum details how the privacy professionals of companies should go about utilising session replay scripts to ensure best results while being mindful of and compliant with the privacy requirements.

Finally, companies must be clear and transparent with their efforts. The ad tech processes can potentially be hard to grasp and being transparent with users about their data and how it is used can remove apprehension about privacy and build trust that will last over the long run.