Six critical points on adtech metrics and publisher compliance strategies

Some food for thought re adtech & metrics, whether you are publisher, CMP or vendor – six points based on recent discussions with a range of clients (and based on the things they need assistance with):

1. Are you sure you are involved in the processing of personal data? The notion of “personal data” has been tackled by the EU Court of Justice regularly of late, and while many have been quick to say lots of identifiers and signals are personal data, that *isn’t* what these judgments actually say when you look at the facts.

2. If we are talking about personal data, do you know what your data protection role is? There is even more case law on this topic, but it’s not always as straightforward as some might think. Facts matter a lot – and you need to carefully think about how factual circumstances influence what your role might be. Just because you benefit financially from a situation doesn’t mean you should be seen as (joint or sole) controller [after all, most processors are for-profit companies and they benefit financially from the processing they carry out].

3. The ePrivacy rules still matter – but not for every technology, including not all adtech & metrics solutions. Some are actually designed not to use storage of information on a device, and work well in that context. I have already written extensively about that (see e.g. https://lnkd.in/eDV4NSRX, https://lnkd.in/ediZ4Cxq or https://lnkd.in/e67zSX3a ). Check whether the contemplated solution is covered or not, as this has an impact on your justification for the solution.

4. DarkPatterns are vilified, but not all “dark patterns” are unlawful. I always use the example of the supermarket, where more expensive products are at eye level. Favouring one option over another is just inherent to marketing – offline and online – and it doesn’t necessarily rob the user of his/her autonomy and agency. Consider documenting why your solution is designed in a particular way – and show (e.g. through the results of A/B testing) why there is still actual choice.

5. Evolutions to the TCF that may have been inspired by regulatory positions (or overreach) are intended to encourage even greater transparency, from the publication of the number of vendors (which sometimes leads to the weighing of options) to the declaring of Special Purpose 3 (which might require a Legitimate Interest Assessment in your case). It is worthwhile documenting every decision you take.

6. Make sure you have the right team, internally or externally, to help you in that process. For instance, we notice that many of our clients seek our help on these issues (whether through brainstorming exercises, workshops or written advice) because they don’t find enough practical guidance elsewhere that takes into account both legal and technical considerations (and I like to think that our in-depth adtech and metrics + TCF expertise helps a lot there).

Need a hand with any of that? Reach out!

data protection Privacy OnlineAdvertising