Why regulators are still at odds with ad tech data privacy requirements.

Take one example: the Federal Trade Commission in the US recently charged ad technology vendor Kochavan with selling location data that could track the movements of domestic violence centers, reproductive health clinics and other sensitive sites.

Goals don’t always turn into reality. If they did, Kochava would have settled with the FTC. Instead, the ad tech firm’s CEO, Charles Manning, refused to settle on the terms, which he said were “ambiguous.”

A sense of deja vu is palpable to anyone who follows these things closely.

At the start of the year, it looked like the future of the Transparency Convention Framework (TCF) – led by IAB Europe, an industry-wide attempt to standardize compliance with the general data protection regulation – was dire. Data protection regulators said it is illegal in its current form. Prophecies of his imminent demise quickly followed. Several months later and those claims are getting bigger and bigger. Because a few weeks ago (early September) it became clear that the fate of TCF will be decided by the EU’s highest court.

Or rather, the European High Court will rule on whether the data was collected illegally by TCF and if IAB Europe is financially liable for any GDPR claims against the ad tech ecosystem. It is important that the Court of Appeal will not advise on the future of TCF until these questions are answered. That decision won’t be made for at least a year.

So much for enforcement.

The problem with attempts to bring the ad data industry complex system online is how poorly written the rules are. There is enough clarity in these regulations to give companies wiggle room to argue that no violations of the GDPR or California’s consumer privacy laws have been committed. And that’s what happened.

Companies (in general) follow the law, but not always its spirit. Call it an inconvenient truth. When a regulatory change is announced, businesses are left to interpret the new legal requirements and adapt their business models as they see fit. The result is messy, confusing and can lead to many attempts to break or break the rules.

Of course data privacy regulators wanted to put a marker.

That’s not the case for Kochava’s CEO. Manning understands that reform is painful but necessary when it comes to data privacy. It’s the way the FTC has gone about pursuing those reforms that has tainted the ad tech executive.

“We’re looking for an exception and the FTC is not ready to grant it,” Manning said.

For Kochava, the devil is in the details: The FTC wanted Kochava to block confidential location data, but it didn’t specify what that meant, Manning said. If there were that difference in places, Manning said, he could have (if not) incorporated it into a product called PrivacyBlock that he and his team built to do just that. Instead, that clarity never came, Manning continued.

“they [the FTC] He said, ‘No, that’s not how it works,’ and they said they’re going to designate ‘sensitive health areas,'” Manning continued. “It leaves us with the question of how we’re going to find that diversity in a data marketplace that may be sensitive to one but not sensitive to another.”

Good luck trying to predict how this will shake out.

Neither the FTC nor Kochava appear ready to retract their widely reported positions on the matter. So there is a chance that this will reach a court decision. And even then it could go either way. Yes, there is a condition. In fact, the FTC has criticized the use of sensitive information in ways that people could not clearly know or expect. Again, Kochava was not found to have used data in this way in a ‘sensitive health area,’ Manning said. And even if it were, it wouldn’t be illegal.

Currently, there are no federal laws governing the data brokerage industry — a point that was highlighted last month when the FTC issued opening remarks in the process to draft regulations after Kochava filed suit.

Or to put it another way, it came before the enforcement rule from the FTC. No surprise there. In a post-Dobbs world, the regulator is acting with greater urgency.

If this is a flashpoint for data privacy, history really parallels the uncertainty over TCF in Europe. But unlike the tet-a-tet between Kochava and the FTC, the timing of TCF’s accounting was unexpected. If anything, it was surprising regulators didn’t act on it sooner. Remember, TCF relies heavily on good actors and the industry’s willingness to comply. Cheater: Not everyone. Data brokers are still trading personal data, and the online advertising industry is rife with potential attacks.

IAB Europe CEO Tousend Feehan said: “TCF is not a panacea, a GDPR-compliant solution. There are still many things that need to be done to comply with the law.” [regulators] We want the TCF standard to take a more compliant role, which we will no doubt do sooner or later. That said, the onus is on the data processing companies to prepare the data for advertising.

A change of this type will subject IAB Europe to significant new costs as it will require the development and ongoing operation of a technical accountability infrastructure. How the OpenRTB ecosystem works today – an idea not lost on IAB Europe, that would be a tall order if not impossible.

Wherever these lines in the sand are ultimately drawn can have far-reaching implications. They can strengthen or significantly hinder the authority of privacy watchdogs to control the site.

https://digiday.com/?p=469239