Legitimate Interest vs. Publisher Consent: Two Routes to GDPR Compliance
Publishers’ initial response to the EU General Data Protection Regulation (GDPR) was extreme, with some removing programmatic ads from their European audience and others blocking all traffic from Europe to remove the risk of non-compliance.
But for sites with meaningful EU traffic, halting programmatic advertising or cutting off access for European users simply isn’t an option. Instead, publishers need to determine which of the regulation’s six lawful bases for data processing applies to them, and take steps to ensure they are compliant. For most publishers, the two lawful bases that can be applied are legitimate interest, which doesn’t need input from the user, or consent, which requires users to positively opt-in to data processing via a consent management platform (CMP).
Legitimate Interest: A Gray Area
Legitimate interest remains the dominant position among publishers, with an Adzerk report indicating that so far, only a quarter of the top 10,000 US domains selling programmatic ads use a CMP. Sovrn data substantiates this figure, with just 27% of the EU requests we receive currently containing a recognizable consent string.
Legitimate interest may be used when businesses identify a compelling justification for using personal information -- including commercial interests -- which cannot be achieved without processing data and will have minimal impact on privacy. Some publishers feel there is an argument for legitimate interest because they need revenue to create and distribute free content for their audiences and they can only make that revenue through advertising, which requires the processing of personal data.
On the other hand, it could be argued that publishers can explore other revenue streams or show non-personalized advertising. Until the regulators provide clearer guidance, it is difficult for publishers to be sure if they can rely on legitimate interest or not. I always advise publishers to have a qualified legal counsel review their specific situation before relying on legitimate interest.
Publisher Consent: A Definite Choice
There's very little reason for publishers not to take the consent path. With almost 40 free IAB registered CMPs in the market, the costs associated with consent are minimal. What’s more, the chances of obtaining consent are far greater than expected a few months ago. Consent rates vary depending on messaging and format but Sovrn sees average rates of 86% across its CMP, while Quantcast reports a 90% opt-in rate with its own platform.
After a slow start, which had publishers worried buyers were ignoring consent signals, DSPs are starting to value inventory with consent higher than that of inventory without consent. Sovrn sees impressions that contain an IAB consent string generating twice as much revenue as impressions that don’t, and this premium continues to grow. Other SSPs are noting similar trends, with Smart Ad Server reporting a 95% premium on consent versus non-consent.
With these increased yields, implementing a CMP is a win-win for publishers, and adoption rates are beginning to accelerate now that consent is impacting buyer decision-making. But many publishers still see gaining consent as a complex process. When obtaining it through a CMP, industry focus is often on the visible UI – with concerns around wording, composition, and position on the page – but the real difficulty is taking the results of the user’s decision and applying those consent signals throughout the ad tech ecosystem.
Initially, this situation created a barrier to publisher consent and CMP adoption, but the IAB Transparency and Consent Framework solved the issue by providing a means to take the user’s choices and disperse them out to the ad tech ecosystem in a consistent and real-time manner. The beauty of the IAB framework is it provide a common language, so all DSPs and buyers can understand the consent given by a user and act based on that consent string. Sadly, some are yet to join the framework’s compliant vendor list, which is increasing complexity across the industry. It remains to be seen how the situation evolves over the coming months.
Combining Consent with Legitimate Interest
Even if publishers are comfortable with legitimate interest as their basis for processing, they can also use a CMP to provide their readers with choice and maximize the value of ad requests from consenting readers. If the user gives consent, the publisher benefits from high-paying advertising. If the user says no, publishers can serve non-personalized ads. In a situation where the user doesn’t make a choice, publishers still have the option of taking the legitimate interest approach.
While there may be a case for publishers using legitimate interest as the lawful basis for data processing, there’s no reason not to couple that decision with an effective CMP. CMPs are simple and cheap to implement, achieve high consent rates, and enable greater yields. And where the consumer doesn’t make a choice, publishers retain the option to fall back on legitimate interest if they have taken the steps to ensure it is appropriate for them. Publishers with meaningful EU traffic should therefore implement a CMP that complies with the IAB framework.
Related story: GDPR and Third-Party Services: What Publishers Need to Know
Matt runs Sovrn's data business as well as its demand relationships. Prior to Sovrn, Matt was the CEO of a small software business called PPCPath that helped small businesses manage their paid search campaigns. PPCPath evolved from Trada, the first crowdsource paid search marketplace, where Matt was VP Finance. Matt's passion for data and analysis comes from his days at ServiceMagic (now HomeAdvisor) where he ran financial planning and analysis.