FTC report eases into cross device tracking, hints at more aggressive future
Here's a question: Why would MediaPost be writing about an EU privacy law that was passed a long time ago and doesn't go into effect for a long time? Sure, the rules were poorly written, will harm marketing efficiency, and may be catastrophic for some publishers. But why is it suddenly relevant now? Probably because last month the FTC waded into those same waters with its report, Cross Device Tracking - An FTC Staff Report. That's what I want to talk about today. But first...
The EU regulations begin with the premise that the collection and use of data containing personally identifiable information should be protected by an affirmative express consent, AKA opt-in, standard. They also affirm that people should have easy access to full transparency around how their data may be used.
That sounds simple and common sense, and it is. It's the next part that makes the regulations revolutionary, and possibly devastating to the "free with advertising" internet we've come to expect. They define personally identifiable information with the assumption that, because data aggregators exist, any information related to a person or their behavior that is collected could be indexed against any other information to eventually reach person-level tracking and execution.
This means the EU is classifying all data as personally identifiable information. Pseudonymous user IDs, device IDs, cookies, app libraries, browsing history, IP addresses, etc. are now considered personally identifiable information whose collection or use is subject to affirmative express consent.
The Good News
The report the FTC released in January is different from the EU's regulations not just in the scope of what it addresses, but also in the level of collaboration with the publishing, platform, and MarTech industries. This is a good thing for not just marketers and those who sell to them, but for anybody who uses technology or consumes free media.
The report's authors even acknowledge the legitimate good cross device tracking does. This includes not just facilitating free media through efficient advertising, but enabling features as fundamental as the coordination of a service across multiple devices.
While transparency is the topic of the most explicit guidance, the report also touches on consumer choice. The FTC encourages companies to "provide choice mechanisms that give consumers control over their data." As a contrast to the EU regulations, the FTC report indicates that the general expectation is currently that users have a way to opt out, rather than requiring companies to earn an opt in. They qualify this by saying that the collection and use of "sensitive data" be subject to "affirmative express consent."
Sensitive data is loosely alluded to as "including health, financial, and children's information." An interesting note here is that the report does not outline the extent to which, or the means by which, a service should be expected to know whether data is associated with a minor.
So far, good news right? So far, yes. That said, the nuance around minors does give a subtle glimpse at what doors the FTC is leaving open for future deliberations. That is demonstrated more clearly in the following anecdote, which is used in the report to illustrate the need for transparency.
"A teen who does not want her parents to know she is gay may be surprised to learn that her browsing behavior on her mobile device informs ads that appear on the household computer."
This example illustrates a legitimate concern, and doesn't represent any sinister attempt by the authors of this report to back-door into deeper industry regulation. That doesn't mean there aren't serious implications from their surely careful selection of an anecdote. So let's dig in deeper.
Before you read on though, I want you to pause for a moment and try to imaging a MarTech landscape where that scenario is entirely preventable. Done? Did you imagine it? Does it look anything like today? Probably not. Does it look anything like the marketing future you've been imaging? Probably not.
Ok, so let's dig in. While the subject of the story is a minor, we've already established the limitations to how certain any platform or publisher can be about the age of a user. A persistent login can help with that, but only to the extent that the law recognizes a user's affirmation of her age at account creation. Any tracking outside a persistent login likely wouldn't be able to comply with any degree of reliability.
More importantly though, the behavior tracked here falls much more in line with general lifestyle-oriented psychographic information than what the report lists when it more comprehensively covers the topic of sensitive data later in the report. Despite that, the story is listed alongside an example citing a medical condition. The statement after the examples also seems to lump the two together when it says, "when sensitive information is involved, there is a heightened need for transparency, choice, and security."
A final detail from the report is that the FTC seems to be explicitly differentiating between logged in and not logged in tracking, with surrounding language that implies tracking on a user facing property not gated by a login is inherently not transparent.
First, I'm not an expert here. I'm just a marketer who has a good technical knowledge of this subject, has had to spend plenty of time reading FTC guidance and rulings on other topics, and was willing to spend more time than the average person digging into all this. But for what it's worth, this takeaway is what I'm using to make strategic decisions myself.
In the short term (next 2 years if I had to put a pin in it), FTC regulations and guidance will focus on, and may even be limited to
- Creating an environment where consumers have greater access to a clear and detailed understanding about what information is being collected and used for any given company or service
- Creating an environment where consumers have ready access to simple mechanisms to opt out of both data collection and application that apply to the broadest spectrum of platforms and services practical to that situation
Beyond that window, I expect to see regulations and guidance get closer to the EU standards than most predictions I've seen to date. The doors the report leave open, as well as the report's citations, are themselves enough for me to be confident in that statement.
In addition to those reasons though, I also don't think most people making predictions here are taking into account the quantitative and qualitative increase in data that can be collected in AR and VR platforms, and the public response to those new capabilities. This will influence an already predisposed FTC to move closer to pan-data, opt-in based regulations.
The shift toward EU-style regulation will make many of the probabilistic and deterministic targeting tools marketers are now using unattainable for most publishers and platforms. Some of the biggest players (think Google and Facebook) may have a strong enough value proposition for their users that they can incentivize the level of opt-in needed to continue delivering efficient targeting tools for marketers. This will reduce the supply of placements for which probabilistic and deterministic targeting is available, and drive up prices.
The supply of placements for which contextual targeting only is available will go up, but only because so little of that is currently in the marketplace. I can't predict how the overall supply or cost of placements will change, but these changes would create a future very different from the one a lot of marketers have in mind.