How the ICO’s recent guidance on the use of cookies impacts programmatic advertising

A big area of discussion pre- May 25th 2018 was how the General Data Protection Regulation should be interpreted by the advertising industry.

Since then, we have seen various interpretations from stakeholders in the ecosystem, particularly on the legal grounds in which they can collect and process user data. I’m sure we’re all now very familiar with consent forms and their inclusion (or lack of) on websites across the web.

The various, and sometimes loose, interpretations of the law are now set to be streamlined and this will have a profound impact on how programmatic advertisers can identify users and crucially, measure the impact of their advertising.

What has changed?

  • The ICO has recently released guidance on the use of cookies and similar technologies, which can be found here –
  • They give specific detail on how consent should be obtained for (what they deem to be) non-essential processes such as analytics and advertising:
    • “Consent does not necessarily have to be explicit consent. However, consent must be given by a clear positive action. You need to be confident that your users fully understand that their actions will result in specific cookies being set, and have taken a clear and deliberate action to give consent. This must be more than simply continuing to use the website. To ensure that consent is freely given, users should have the means to enable or disable non-essential cookies, and you should make this easy to do.”
  • The ICO have started to issue fines for data breaches related to GDPR with both British Airways and Marriot being issued fines of £184m and £99m respectively. This is a very visible threat to businesses that are not compliant with the law.

What does this mean for programmatic advertising?

  • Legitimate interest can no longer be used as a means for processing cookie-based data for advertising and analytics purposes. Advertising and analytics have been defined as non-essential processes, so consent is the only legal basis for processing it for these purposes.
  • There will likely be a gradual decline in the amount of consumers that can be targeted or measured for advertising and analytics purposes as the industry pivots from legitimate interest as a means for processing data to consent based means.
  • Longer term, we expect the ICO will start to issue fines for poor practice and shake up the way consent is gained and managed in the ecosystem.

What impact does a lower consent rate mean for programmatic?

  • It will be increasingly difficult to measure the impact of marketing through ad-servers, brand safety, web analytics and attribution providers. Probabilistic identification and data sampling may be used as an alternative.
  • Consent driven first party data will become even more valuable due to an overall reduction in third party data.
  • Consent-driven, quality third party data may come at a premium due to the reduction in availability so third-party data providers may start to seek additional data sources where a more transparent value exchange is offered to users.
  • A lack of available user data may increase the investment into premium publishers and the use of contextual targeting will also increase, so long as it doesn’t involve category sensitive data.
  • We will see a reduction in the amount of ad technologies and IDs being used in the ecosystem, potentially making some companies entirely redundant. Solutions for unified identification are already in development and we expect to scale given the importance of an ID for targeting and measurement.

What needs to happen?

  • The value exchange between consumers and stakeholders in internet advertising needs to be promoted more effectively. Workaround solutions to track users without their consent are no longer sustainable.
  • Publishers, advertisers and technology companies that are trusted by users are best placed to request and capture this consent.
  • We expect the industry to lobby back about some of this ICO categorisation.

In summary this update is a step to a consent-driven advertising industry. Legitimate interest as a means to process data for advertising or analytics is no longer accepted and this will have an impact on the scale of advertising and measurement available to advertisers and publishers.