Obtaining consumers' consent to be tracked under GDPR has delivered two new pieces of jargon for marketers and publishers: CMP, which stands for "consent management platform," and regtech, short for "regulation technology."
Outfits such as Evidon are providing publications with CMP tools to get and organize the permissions required by GDPR. A CMP is considered regtech.
But the regtech and CMPs that publishers have broken out since the EU's General Data Protection Regulation took effect last Friday vary widely. Some publishers provide an easy way to opt out of being tracked. Others ... don't. And one offers an ad-free, no-tracking version of its subscription (for a higher price).
Most CMP's attempt to make managing consent fairly straightforward, with most offering an option to simply toggle which companies can and cannot use their data. ESPN has an easy-to-use consent tool for European visitors. Wired, on the other hand, provides an experience that's more on par with trying to cancel a gym membership.
What is and isn't in violation remains unclear. Here, we look at several publishers who are all handling consent under GDPR differently.
It then provides an email address where people can send their requests. The experience was similar at other publications owned by Wired parent Conde Nast.
Conde Nast did not respond to a request for comment.
In fairness, nothing in GDPR says a publisher's solution must be elegant, and the regulation only took effect last week.
"The law didn't say publishers must carve their approach in marble," Jay Seirmarco, senior VP of operations and legal affairs at Pixalate, says. "The first phase was compliance, so they may be offering a compliant solution and taking a wait-and-see approach to see how everything shakes out."
A better experience and a paid experience
Oath-owned Yahoo, meanwhile, does offer an elegant solution. EU citizens who visit the website are promptly greeted with an option to manage cookies and tracking preferences. They are then shown a page where they can toggle their approval on and off for each company that might handle their data.
Asking consumers to pay their way out of tracking seems to be permitted under GDPR, which carries fines of roughly $25 million or 4 percent of global revenue, whichever is larger. The Article 29 Data Protection Working Party, which is largely responsible for interpreting the rules of GDPR, intially said charging extra money for an ad-free, no-tracking experience was not allowed. But it changed its stance in April, according to Jessica Lee, an attorney at Loeb & Loeb, which specializes in advanced media and technology.
"The Article 29 Working Party, in its final guidelines on consent, deleted text that was in the draft guidance that required a company to offer cost-free services that do not depend on the use of personal information," Lee says. "In light of this change, it's probably fair to conclude that a company is not prohibited from charging a reasonable fee for an 'ad free' or 'tracking free' experience."
Lee adds that whether the charge is "substantial" enough so that the choice between the free and paid version is no longer "freely" given will depend on the service and the cost. "I suspect that we may get some additional clarity on where this line is drawn either from additional guidance from the individual supervisory authorities or through the first round of enforcement actions," she says.
Chris Olson, CEO of Media Trust, a company that provides real-time security and first-party data protection, says "there are a million different shades of grey" in how some publishers are handling their consent.
Some are "shutting everything off on a site while other pubs are doing nothing and waiting," Olson says.
"All of these publishers, ad exchanges, the DSPs, the buy side—they all need to now know who they are doing business with," he adds. "That is the sea change that is coming."