EU data protection laws may severely disrupt online advertising

The European Union's new data protection laws may seriously damage the online advertising industry, especially advertising companies and publishers who rely on digital advertising revenue to stay in business. The IAB Europe has identified the two areas of major disruption to the industry as; the notion of "personal data" has been widened and companies will need consent from European users before then can serve them targeted ads; and the EU also plans to raise the digital age of consent from 13 to 16, which will cause huge problems for companies that rely on their strong teenage user base, such as Facebook and Snapchat. 

"The amputation of a significant revenue stream." Sean Gallup/Getty Images

The European Union announced late Tuesday that it had settled on tough new data-protection laws.

The new, unified rules across Europe are designed to give European consumers more control on how their data is used (you can read a summary of the key points here) — but they could have a severely damaging impact on the online advertising industry. Businesses can be fined up to 4% of global turnover for failing to comply.

The full text of the EU's data-protection reform is not yet out. But a press release from the European Commission (plus more detailed information on the background to the decision on the EC website) signals some significant changes that could hamper online advertising companies and the publishers that rely on digital advertising revenue to stay in business.

The European branch of the Internet Advertising Bureau's (IAB Europe) interpretation of what has been released of the new rules so far identifies two key concerns: that the idea of "personal data" has now been widened, and that internet companies worldwide will now need to gain consent from European users before they use their data to serve targeted advertising to them. Furthermore, the raising of the digital age of consent to 16 from 13 could be hugely disruptive to companies that have strong teen user bases.

Townsend Feehan, the CEO of IAB Europe, the trade body that represents the European internet advertising industry, told Business Insider: "It's the amputation of a significant revenue stream just at the moment publishers are having such a challenge in switching to digital."

A broad definition of 'personal data'

One of IAB Europe's key concerns is that "everything" will now be considered personal data, according to Feehan. She added that the new rules include language suggesting that "some identifiers that could not possibly be used to trace back to an individual person" will be included under the "personal data" bucket.

"There appears to be a broader definition and bigger scope for personal data, and a narrower legal basis for the processing of that data," Feehan said.

Townsend Feehan, the CEO of IAB Europe. LinkedIn

Feehan says a lot of consumer data that falls under these new laws are "low risk or no risk" — for instance, the type of contextual data that might tell an advertiser you are in the market to buy a car, but not that you're female and live in London and are a certain age. That could serve as the "amputation" of the revenue streams for many publishers, which rely on such data to sell their advertising at a premium to marketers and might find it hard to comply with the new rules.

She added: "It's an own goal [from the EU], [the impact] will be insidious and happen slowly over time. It will be an inexorable impairment on online media in Europe ... it's not good for media pluracy and democracy."

A memo released by the European Commission on Wednesday states: "Personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address. The EU's Charter of Fundamental Rights says that everyone has the right to personal data protection in all aspects of life: at home, at work, whilst shopping, when receiving medical treatment, at a police station or on the Internet."

The need for consent

IAB Europe is also concerned that the EU will require that internet advertising companies gain consent from users before they use their data to target them with ads. Essentially, that means users would have to opt-in to receiving this kind of behavioral advertising.

There are two clear issues: Research shows it's far harder to gain explicit consent from consumers than it is to gain "implicit consent" — merely stating you will use some data for advertising purposes in terms and conditions, or via pop-up-style messages that inform consumers that cookies are running.

The other issue is that while it is (relatively) easy for big consumer-facing platforms like Google and Facebook to ask consumers to click a box confirming that their data can be used in such a way, it's a lot harder for the huge array of ad tech vendors who serve hundreds of millions of dollars in ads each year but don't have consumer-facing platforms. Which consumer is likely to have visited the websites of AppNexus, Rubicon Project, Criteo, or Media Math, for example?

It's not terribly practical. Feehan worries that some of the smaller ad tech players could go out of business.

Ian Maude, head of internet at Enders Analysis, says there might be a workaround: Companies like Google and Facebook that partner with these ad tech vendors could also ask users to click whether they opt in to their data being used by third-parties for advertising. But that would clearly put more power in the hands of the internet giants at the expense of smaller companies.

There's a further issue, too: It appears companies must gain explicit consent for each way in which they use consumers' data.

Ian Saunders, an adviser to technology businesses, told Business Insider: "Buying a product [from a brand] does not mean you have the right to serve advertising henceforth to that individual."

The raise of the digital age of consent from 13 to 16 years old

Snapchat has a big teen user base. Youtube/Snapchat

A formal vote is taking place among the European Parliament's civil liberties committee on this particular aspect of the regulation on Thursday. There will be a full parliament vote next year, and the BBC reports that it is unlikely to go through on a European-wide level and instead will be up for member states to set their own limits.

The proposal would essentially prevent internet companies like Facebook and Snapchat from offering their services to younger people under a certain age limit — which could be raised to 16 years old from 13.

Dylan Collins, CEO of the kid-friendly marketing platform SuperAwesome, told Business Insider the decision had the potential to "massively disrupt" the online advertising market. Whatever age restriction is chosen will not only prevent children under that age from accessing certain internet platforms, but it will also restrict all behavioral and programmatic advertising aimed at them. This has already happened in the US under the Children's Online Privacy Protection Act, which restricts profile-based advertising to under-13s.

He estimates the total amount of ad dollars spent on advertising online to the global teen market is $30 billion.

"The under-13 space has aggregate spend of ~$7 billion, but the 13-t0-20-year-old market almost doubles this number," he added. "Many major tech and media companies have already started to target the under 13 space — e.g., YouTube Kids and Amazon — but extending the same requirements to the teen space and shifting the entire sector to a contextual-only basis would be hugely disruptive for companies [with large teen userbases] like Facebook, Snapchat, YouTube, Viacom, and many others," he added.

Balance is needed

As said previously, the full text of the new rules has yet to be released, and it will take a while for the full effects to be realized. The new rules won't come into effect until 2018. In the meantime, there will continue to be discussions among policymakers, lobbyists, and the tech industry about the best ways to interpret and implement the new laws over the next couple of years.

What is clear is that the EU is trying to solve an issue. The EU's public consultation on its data-protection reform showed that many consumers were concerned about how their information is used and did not full they had full control over their data online.

Maude said: "This should ring alarm bells for the internet advertising industry in the same way we have seen the rise of ad blocking. That's happened for a reason, it's not just about ads themselves, but more broadly about how data is used for tracking, for example. Regulators like to regulate, so it was always going to be likely that we would see more regulation in this area."

There are benefits too, according to Maude, including that there will now (broadly speaking) be one set of regulations to abide by across Europe, rather than many different laws for different countries.

Maude added: "One clear set of rules and regulations where consumers feel confident that they have control over their information and how it is being used and accessed and not being mis-used is ultimately a good thing."

But ultimately, the reaction from the advertising industry is one of disappointment.

Ian Twinn, director of public affairs at the UK-based advertising trade body ISBA, said: "The EU fix on the four-year run in trying to find a common agreement on data protection is a mixed bag. Of course advertisers, and businesses more generally, will be pleased that there is an end to the indecision. We particularly welcome the need to deal with only one data regulator."

But he says the compromise is less clear: "The fine detail may be better than the press release but at first sight both citizens and businesses will be disadvantaged. The European Parliament has failed to understand the impact of its hard-line political stance. This is the EU at its worst. The end result is a new regulation that is based on five-year-old thinking, sourced from old technology and old expectations."