A stateless Internet requires a programmatic solution to identity management and tracking. Identity is important to the consumer experience, providing access to customized content and targeted advertising. Abusing an individual’s personal data by ignoring their right to anonymity and denying them control over what about themselves, and their behavior, is shared with whom, has led to consumer and regulator push back. The pendulum is about to swing in the opposite direction with all personal data ring-fenced. At the extreme, that either means no customization, a torrent of irrelevant information, and an inferior consumer experience, or walled garden operators becoming even more anti-competitive.
We suggest the problem lies not in whether personal information should be shared, but rather in the user’s lack of ownership and control. In fact, we think a better alternative allows consumers to share more information, albeit with different degrees of anonymity, with complete ownership, control, and compensation.
Killing off third-party cookies and ring-fencing data simply empowers the already dominant wall gardens, at a greater cost to the consumer. Poor substitutes replace third-party cookies with inferior data and a sub-optimal consumer experience. In the name of privacy, walled garden operators are implementing stricter controls over how user data is shared. While that fixes a symptom (improper sharing of personal data), it concentrates advertising revenues, leads to an inequitable outcome for consumers and publishers and does not solve the underlying problem; making it easy for individuals to manage and monetize their personal data.
- Google’s strategy
- Apple’s strategy
- Facebooks strategy
- IAB Tech’s recommendations
- Probabilistic attribution
- Privacy advertising technology proposals
Google’s strategy
Google has been working on a solution that allows publishers to offer targeted advertising without sharing personal data - project Privacy Sandbox. In 2021, the UK’s Competitions and Markets Authority (CMA) announced an investigation into whether Google’s proposal would give them a greater monopoly of the online advertising market. On June 24th 2021, Google pushed out the 3rd party cookie ban until 2023 citing challenges around implementing alternative technologies.
In February 2022, Google announced an agreement with the CMA with commitments to ensure the privacy sandbox would be fair to their competitors. Google would incorporate insight from the CMA and ICO (Information Commissioner’s Office), and third-party cookies would not be deprecated prior soliciting the CMAs review on whether any competition law concerns remain.
In July 2022, google pushed out the beginning of any third-party cookie phase-out until 2H-2024. Google has reconfirmed their commitment to providing users with “substantial” transparency and control in relation to their data. In October 2022, Google released a new My Ad Centre that provides users with more control over the ads they see, a more accessible option to turn off all personalisation, and the means to express which topics they no longer wish to engage with at all. And Google has confirmed they no longer use sensitive information like health, race, religion or sexual preferences to drive ads. Google has introduced new tools to help them placate privacy advocates and regulators while continuing to Monetise personal data for the benefit of advertisers, publishers and shareholders. Those tools include Trust Tokens, Topics, Fledge, a new attribution reporting API, several cross-site data sharing tools, and new fingerprint prevention mechanisms. With extensive contributions from well-known Internet community groups (W3C), and feedback from customers and privacy advocates, Google appears to be on track towards a cookie-less world that does not decimate their personal data centric business model.
However, Google’s privacy sandbox strategy needs to balance their own commercial imperatives with regulator concerns around competition, user privacy concerns and the commercial needs of advertisers and publishers. Spinning each plate on its own, in a complex competitive market, is challenge enough. Their end solution will most likely result in a suboptimal outcome for one or more stakeholders. How can you promise the same commercial experience to your advertisers, shareholders, and users when the underlying rules of the game have changed? A move away from 3rd party cookies towards a cohort-based attribution model necessarily results in less resolution. While Google’s suggestions are perhaps less extreme than Apple’s, the result will likely mean lower returns for advertisers. Also, the consumer continues to provide the raw material without compensation, and publishers will continue to rely excessively on Google given their unusual positioning on both the demand and supply side of the ad-tech supply chain.
In January 2023, the US justice department and eight states filed a lawsuit alleging “anticompetitive, exclusionary, and unlawful means to eliminate or severely diminish any threat to its dominance over digital advertising technologies.” A break up of Google’s ad tech platform is now a possibility, although that is not the most likely outcome.
Apple’s strategy
Apple positions itself as a privacy centric company. In 2019, the company was the first to remove all 3rd party cookies with their Intelligent Tracking Prevention policy (ITP). By 2019, Apple had reduced client-side tracking in browsers to only 7 days, or 24 hours, depending on the type of cookie. Apple’s privacy strategy can get a little complicated with policies that apply to apps, policies for browsers and policies that straddle the two. Apple has Apple specific technologies (ATT) and technologies they are trying to get through independent standard groups (like W3C), for broader adoption (PCM). Ultimately the company needs to balance user/customer privacy against developer and advertiser returns, much like the other platforms. However, Apple differentiates themselves by flying a privacy first banner and marketing themselves, aggressively one might argue, as the only bastion for consumer privacy. As you might already have figured out, providing privacy protection, and managing complex developer and advertiser requirements results in a complex ecosystem of needs and wants. Restricting all customer data does not necessarily result in a better customer experience while significantly lowering returns for app developers and advertisers, which ultimately impacts Apple’s overall valuation. Adopting cohort strategies, differential privacy and various other privacy preserving strategies certainly help protect privacy and provide some useful information to developers and advertisers but these strategies will be adopted by all the platforms, not just Apple.
Prior to advent of Apple’s App Tracking Transparency (ATT) network, released in 2021 with IOS 14.5, Apple provided application developers with Identifiers for Advertising (IDFAs). IDFAs were like device specific cookies that helped advertisers track particular actions; for instance, when a user clicked on an ad in a browser or if they installed an app, or interacted with an ad within an app. The IDFA was particularly useful because it worked in non-browser apps, which didn’t support traditional 3rd party cookies. App developers would use IDFAs to harvest data across apps and build valuable profiles they could sell to 3rd party data providers. With the introduction of ATT, application developers need to specifically request permission from users before they can track the user’s activity across other companies’ apps and domains. With 20-40% of users opting-in (there is a wide range of estimates), the impact to the platforms (Facebook, Twitter, TikTok etc) has been meaningful. Advertisers, especially mobile game developers, monitor their return on advertising spend (ROAS) very closely. As the quality of the data deteriorates, so too does the ROAS. Facebook was particularly impacted given most of their advertisers are small and medium sized businesses (SMBs). Advertising demand from SMBs is particularly elastic; small changes in ROAS lead to material changes in overall Facebook advertising revenues. ATT also blew up most attribution models. With limited IDFA tracking, the only other option for attribution is Apple’s SKAdnetwork (SKAD) which allows ad networks to attribute installs directly from the App Store without having to rely on the IDFA, cutting out third party attribution vendors. It is also worth pointing out that by restricting the information in SKAD, advertisers have been using Apple’s own advertising network (ASA). ASA provides advertisers with more granular attribution metrics, helping advertisers better monitor ROAS. ISI Evercore estimates Apple’s own advertising revenues (via ASA) will likely increase from around $2bn in 2021 to $20bn in 2024. It should already be clear that Apple, with its desire to grow advertising revenues and need to sustain application developers, the biggest source of their advertising revenues, while also protecting user privacy, needs to satisfy a complex set of stakeholder requirements, not without conflicts of interest.
Facebooks strategy
The vast amount of Facebook’s advertising revenue comes from small and medium sized businesses (SMBs), businesses that rely heavily on near real-time ROAS and accurate attribution. For an SMB, advertising revenue spend is going to be highly dependent on revenues resulting from that spend. In other words, what they spend on advertising today, is going to depend very much on the revenues they received yesterday, itself a function of the advertising revenues from the day before. The cadence may be a little longer, or even a little shorter, but the point remains; SMBs require near immediate returns on advertising spend. Facebook relied heavily on 3rd party cookies for both targeting and attribution. As Apple and Mozilla banned 3rd party cookies, Facebook redesigned the way they deployed first party cookies. Apple then banned all cookies. At the same time, Apple’s ATT effectively killed Facebook’s ability to collect customer data from within IOS apps. IOS users who opt out of ATT are effectively disconnected from Facebooks attribution process (IDFAs are replaced with zeros). That dramatically lowers ROAS which has led to lower Facebook advertising revenues. The full impact from Apple’s ATT, and their recent changes to ITP, are more nuanced but the headline is not; Apple has severely impacted the way advertising networks and self-attributing networks, including Facebook, track advertising performance and target audiences. In the case of Facebook, that has a pronounced impact on SMBs, who rely heavily on their advertising services. Even with counter measures (extending their Conversion API to all advertisers), Apple still restricts Facebooks ability to Monetise Apple related traffic. And when you consider how Apple benefits from their policies (higher Apple advertising revenues) at Facebook’s cost (Lotame estimates $12.8bn in 2022), it is difficult to frame all of Apple’s privacy policies as purely user centric.
IAB Tech’s recommendations
“…the vitality of the entire digital media economy as it operates today is at stake. And yet, in conversation with 30 senior-level, data decision-makers across brands, agencies, and publishers, few seemed truly prepared for ongoing data privacy legislation changes and the effect that these impending laws, and platform and browser changes, will have on their business.” State of data report, IAB, 2022
The Interactive Advertising Bureau (IAB) is the digital advertising industry’s leading trade association. They have been ringing the bell for a while. As we mention a little later, the IAB themselves were recently sued by the Belgian data protection authority (DPA) who found that IAB Europe’s transparency and consent framework (TCF) does not comply with GDPR. One suspects they are perhaps more finely attuned to the risks ahead than most. But their recent State of Data report goes beyond the escalating compliance risk from an increasingly complex regulatory landscape. Businesses appear to be struggling to communicate with consumers regarding how their data it being used to fuel monetization, a necessary component for many commercial enterprises. Yes, the platforms are clamping down on cookies and personal identifiers. Yes, that is a problem for audience targeting and attribution. But more than that, companies cannot seem to get consumers to understand that “free” service are, in fact, not free. Advertising pays for the service. Personal data makes advertising more effective.
More effective advertising means more money, and more money means a better service. More money sometimes just means more money for shareholders, but that is another story. IAB suggests it is not good enough to get consumer to opt-in to cookies. Consumers need to select the types of data they are willing to share for business purposes, including advertising. OwnYou could not agree more. Consumers need to understand the value of their data. They need to understand that engaging services cost money to manage, and high-quality content costs money to curate and produce. Generating money from zero-party driven advertising is an important step towards putting consumers, and their personal data, at the centre of the advertising technology stack rather than as a resource that feeds digital advertising service providers. This change of perspective helps all parties; users understand, and benefit, from their role in the ecosystem – as data providers, advertisers benefit from higher quality data and direct route to consumers, and content producers get paid for creating high quality content and curating audiences. OwnYou wants to facilitate this change in perspective, and, over time, help rebuild trust in digital advertising.
Probabilistic attribution
Probabilistic attribution is a quantitative attempt to link user engagement with advertisers, and their products, with specific ad interactions, without a deterministic ID. In other words, in the absence of an ID that links a user to a specific ad, and subsequent purchasing behaviour, probabilistic attribution uses device parameters to suggest that a user that saw an ad, and then materialised in the app, did so because they saw the ad. This type of probabilistic advertising is also called fingerprinting although that does not reflect a more recent trend towards using behavioural signals. Apple doesn’t like fingerprinting and is working very hard to make sure device related details are hidden from all parties. Google is following. In any case, placing fingerprinting into the probabilistic bucket is misleading. Fingerprinting endeavours to identify users by stitching together proxy identifiers that, when taken together, provide a unique “fingerprint”; mobile device ID, device manufacturer, the number of apps installed on the device etc. Behavioural signal based probabilistic attribution assumes that users that behave in a certain way, on-site or within the app, likely share the same provenance. And because one user can be deterministically linked to some advertising channel deterministically, it can be assumed that similarly behaving users came from the same channel.
With Apples ATT and Google’s deprecation of GAID, probabilistic attribution is rapidly becoming the norm. Suffice to say it is fraught with problems . Assuming both Apple and Google break fingerprinting, probabilistic advertising will rely solely on in-app (on-site) signals to attribute users to source channels. This is problematic for several reason, as outlined by Eric Seufert in a Mobile Dev Memo post. Not least of which is that most advertisers run campaigns across many different channels and while over a long period of time ROAS will differ across channels, differences in group-based calculations, which probabilistic advertising relies on, will likely be imperceptible over shorter time periods, making very difficult for advertisers to tweak channel spend.
Privacy advertising technology proposals
Whether it be Google’s FLEDGE or Apple’s SKAN, protecting individual privacy with cohorts and differential privacy is rapidly becoming a consensus privacy preserving strategy. It is worth touching one more of Eric’s articles to understand what this means for ROAS. Ultimately, course targeting based on cohorts of similar consumers results in an average value from a fat tail distribution; a few consumers are worth a lot to the advertisers and the rest very little. The higher value target consumers skew the mean value higher. But the average value is therefore less instructive as a signal in the bidding process, given it is skewed by a few high value consumers. When the cohort is purchased, many impressions are wasted. In other words, cohort-based advertising necessarily results in lower ROASs.
