Santiago Andrés Azcoitia’s Post

The European Data Protection Board (EDPB) yesterday adopted an opinion on the valid use of the “Pay or Okay” model by, what it calls, “large online platforms.” The EDPB determines in its opinion that large online platforms, “in most cases,” will not comply with the GDPR in utilizing a Pay or Okay model. Meta implemented Pay or Okay in October of last year after the EDPB determined that consent was the only legal basis for processing user data for advertising targeting. As a result, Meta offered users in the EEA, Switzerland, and EU a choice: either subscribe to Instagram and Facebook and see no ads, or consent to having their data processed for behavioral advertising. While a number of legacy media operations across the EU utilize Pay or Okay, the EDPB's opinion insists that "large online platforms" -- a term that it defines rather amorphously -- are most likely violating the GDPR when they implement it, related to the ability for consumer consent to be "freely given." The EDPB asserts that large online platforms must offer a third option to facilitate genuine consumer choice: a Free Alternative without Behavioural Advertising. In a piece that I published to Mobile Dev Memo today, I walk through the logic of the EDPB's opinion and present what I believe are Meta's options for compliance in light of it. (free / no paywall)

The privacy organisation NOYB (None Of Your Business) has filed a GDPR complaint against Microsoft's advertising broker subsidiary, Xandr. NOYB said that Xandr is collecting extraordinary amounts of data to profile users to operate its services, but data on its own website shows that it complied with none of the 1,294 access requests and 660 deletion requests made under GDPR. Many people are not going to have heard of Microsoft's Xandr or what it does. NOYB has a nice explainer in its announcement: "If companies want to use targeted advertising to promote their products or services online, they have to go through so-called Real Time Bidding (RTB) platforms. One such platform is run by Microsoft subsidiary Xandr, which allows advertisers to buy ad space on websites or in mobile apps in a fully automated way. When a user visits a website, an algorithmic auction takes place in order to decide which company can display an advertisement. Because a users’ interests and characteristics ultimately determine an advertiser’s willingness to place an ad, Xandr collects and shares a massive amount of personal data in order to profile the users and to allow for targeting. Much of that data is bought by external parties like emetriq, a subsidiary of [Deutsche Telekom]." #databreach #GDPRbreach https://lnkd.in/d8cUR6S6

The UK's Competition and Markets Authority (CMA) has voiced concerns about Google's new Topics API, which aims to reshape ad targeting without third-party cookies. This system, operating on Chrome, Edge, and soon Android, localizes the sorting of user interests into topics, potentially enhancing privacy. However, the complexity of the system and Google's history of privacy issues have left some skeptical. Furthermore, ad industry rivals fear this new setup might limit access to data crucial for effective advertising, suggesting a potential competitive disadvantage. The CMA is also worried that the Topics consent interface doesn't fully inform users about the use of their data. This ongoing shift in digital advertising standards is crucial for anyone in the field to understand, as it could redefine how ads are targeted across major platforms. The ad tech space is really intriguing to me. First of all, on the cookie issue, it is clear that there's really little incentive to change anything, except perhaps from politicians who see a big opportunity for regulatory capture around privacy and big tech. This is concerning for sure, but none has any clue about anything. Just look at GDPR to see the level of incompetence. Watch out for AI regulations. There are huge questions for big tech and consequences to monopolistic approaches to search, particularly Google and AI, and how AI could potentially change its business. The thing is, ad tech has been led by tech companies and computer science rather than agencies, with a big gap in creative talent. In other words, the industry grew overemphasizing technologies like programmatic with little discussion on how they affect and transform traditional advertising practices and creativity. Most creatives are ignorant or hate anything related to ad tech. Perhaps in the end creativity will prevail. ▶ Read more here: https://lnkd.in/dpdKN5QB #google #advertising #martech #cookieless 

📣 Important Information! Need to read! Extracts from the "Summary of Results and Implications": ▶ While activists and users have raised concerns about privacy becoming a luxury for the affluent, little is known about these pay-or-tracking walls, which prevents a meaningful discussion about their appropriateness. ▶ Notably, we observed that publishers do not base the pay option’s prices on the revenue that would otherwise be generated by the tracking option. Instead, publishers seem to follow a different pricing motivation that exceeds the revenue produced via tracking. ▶ (…) our studies suggest that users do not have a high willingness to pay to protect their privacy, and the share of paying users is still small. ▶ (…) publishers can choose from a wide range of implementations based on the four dimensions: tracking, advertising, content, and price. Experimenting with other implementations might help to improve the pay option’s offering and increase the share of paying users. ▶ Thus, pay-or-tracking walls may change the paradigm by asking users to not only “pay with data” or “pay for content,” but also “pay for no tracking,” stressing that there is “no free lunch.” (see as well: #ZD 2023, 713 https://lnkd.in/e8DeQ7nX). ▶ (…) users should carefully examine the pay option’s tracking policy and be aware that even the pay option discloses user data through its payment process. ▶ (…) regulators should establish standardized guidelines to specify the design of pay-or-tracking walls, which will help safeguard users’ privacy and enhance comparability. ▶ However, offering separate features is feasible, so a forced combination of “no tracking” (i.e., pay option) with another feature (e.g., “no advertising”) is not required. I consider -especially the last point- is similar to the so-called "third alternative" put forward by the EDPB in Opinion 08/2024 (No. 75: https://lnkd.in/eREZgvVS) #payorconsent #GDPR #privacy #tracking #consent #behavioraltargeting, #privacyworks

Cookie phase-out delay: Much-needed breather for publishers to get their houses in order? The delay, say experts, will allow publishers to firm up on the technologies they are going to be using as the system moves further towards first-party data and consumer privacy protocols. Lakshmana Gnanapragasam, Dhaval Gupta, #LathishNair, Ishan Chaki comment. 🖋 Shantanu David Join e4m's Whatsapp Channel - https://lnkd.in/dHupynWW #e4m #cookies #publishers #privacy #advertising

⚠️ Heads up, EU marketers! Google is now requiring marketers to send verifiable consent signal(s) as they upgrade their enforcement of its EU User Consent Policy (EU UCP). If you don't comply, Google has warned that campaign performance might be negatively impacted. Here's What You Need to Do If you use Google's APIs/SDKs to share audience data with Google, you must upgrade to the latest versions of the Google Ads API and Display & Video 360 API. Seems simple enough. What is EU UCP? The EU User Consent Policy (EU UCP) introduced by Google is designed to align with European privacy regulations, specifically the ePrivacy Directive (ePD) and the General Data Protection Regulation (GDPR). This requires marketers using Google for advertising to obtain and respect end-users' consent. Google notes that "This year marks an inflection point for marketing with Chrome’s planned third-party cookie deprecation in the second half of 2024, as well as regulatory changes in the landscape.” So get ready for more immediate updates like this in the near future. https://lnkd.in/e6Kub9rn

Schrems vs Meta: Round 3️⃣ The EU Court of Justice has ruled (earlier today) that Meta cannot use all personal data collected for targeted advertising without clear limits on data type and retention. Even if someone publicly discloses sensitive information, it does not grant platforms like Facebook the right to process unrelated sensitive data from other sources. This decision further impact the Adtech industry. #Schrems #Meta #Adtech #GDPR #DataPrivacy #CJEU #TargetedAds #DigitalMarketing https://lnkd.in/dWdzywMU

As data privacy laws come into effect worldwide, the recent actions by the European Union against Meta's "pay or consent" model show the significance of comprehensive user consent in digital advertising. 🌍🛡️ The European Commission claims that Meta's approach—forcing users to choose between targeted ads or paying for ad-free services—violates the Digital Markets Act (DMA). They stress that businesses must offer true choices regarding data use and protecting user rights. 🔐 It's important to stay ahead of transparent and ethical data practices. 📜 The Colorado Privacy Act, effective this month, includes ideas and language from the DMA. 19 other states have adopted similar privacy protections. Decisions like this in Europe give us a window into how American requirements could change in the near future. 🌟 We're helping clients get up-to-date and ahead of the curve as data collection best practices become law. 📈 It's important as data-savvy marketers that we also win trust with stellar privacy practices. Are you compliant with the CPA and other privacy laws that are coming into effect? Not sure? Let us know in the comments. ⬇️💬 #DataPrivacy #DigitalMarketing #UserConsent #DMArules #Meta #TrustInTech https://lnkd.in/gD_cWFh3

Google touts killing cookies as a #privacy win. But consider the double-edged sword: does this not only cement their surveillance dominance under guise of progress? Trading cookies for "Privacy Sandbox" tracking just shifts the bias. Chrome still profiles you - without consent or alternatives. But now Google hoards the data. Did you really expect anything different? This move wrecks independent #advertising models reliant on cookies, and forces marketers onto Google's stack to expands their walled garden. Concentrating tracking powers in one giant company hardly seems like a victory for consumer rights. At best, this is the illusion of privacy advancements. At worst, it weaponizes privacy as justification to further #Google's reach. Folks, true progress requires equitable rules and #innovation - not unilateral control masquerading as social good. What's your take? Does Google's cookie crackdown protect users? Or protect Google?

Pay-or-consent models must comply with the principles and requirements of the #GDPR, including obtaining valid consent, ensuring transparency and fairness, and protecting the rights of data subjects. Failure to do so can result in significant fines and reputational damage for organizations. It's advisable for organizations implementing such models to conduct thorough legal assessments and consult with legal experts specializing in data protection and privacy law.