Three publishers, three different approaches to consent under GDPR

Obtaining consumers' consent to be tracked under GDPR has delivered two new pieces of jargon for marketers and publishers: CMP, which stands for "consent management platform," and regtech, short for "regulation technology." Outfits such as Evidon are providing publications with CMP tools to get and organize the permissions required by GDPR. A CMP is considered regtech. But the regtech and CMPs that publishers have broken out since the EU's General Data Protection Regulation took effect last Friday vary widely. Some publishers provide an easy way to opt out of being tracked. Others ... don't. And one offers an ad-free, no-tracking version of its subscription (for a higher price). Most CMP's attempt to make managing consent fairly straightforward, with most offering an option to simply toggle which companies can and cannot use their data. ESPN has an easy-to-use consent tool for European visitors. Wired, on the other hand, provides an experience that's more on par with trying to cancel a gym membership. What is and isn't in violation remains unclear. Here, we look at several publishers who are all handling consent under GDPR differently. Wired Wired.com shows European visitors a button to "accept" its consent policy. Finding the actual page to opt out is very hard to do. Here's a hint: Accept the cookie policy first, then look for the button. Even those that find it must scroll through some 4,440 words to find the necessary information on declining: As discussed above in Section V(B) and XI, you may opt-out of having personal identifiable information, such as your name, email address, postal address or phone number shared with third parties for their marketing purposes. If you wish to exercise this right, please contact our Privacy Policy Coordinator and state which of these items you wish to opt-out of sharing with third parties. It then provides an email address where people can send their requests. The experience was similar at other publications owned by Wired parent Conde Nast. Conde Nast did not respond to a request for comment. In fairness, nothing in GDPR says a publisher's solution must be elegant, and the regulation only took effect last week. "The law didn't say publishers must carve their approach in marble," Jay Seirmarco, senior VP of operations and legal affairs at Pixalate, says. "The first phase was compliance, so they may be offering a compliant solution and taking a wait-and-see approach to see how everything shakes out." A better experience and a paid experience Oath-owned Yahoo, meanwhile, does offer an elegant solution. EU citizens who visit the website are promptly greeted with an option to manage cookies and tracking preferences. They are then shown a page where they can toggle their approval on and off for each company that might handle their data. The Washington Post takes a completely different approach, offering three options to its readers, one of which includes a "premium EU supscription" that includes no tracking, no ads and unlimited articles for $90 a year. The other two (free and a $60 basic version) states the person consents "to the use of cookies and tracking by us and third parties to provide you with personalized ads." Asking consumers to pay their way out of tracking seems to be permitted under GDPR, which carries fines of roughly $25 million or 4 percent of global revenue, whichever is larger. The Article 29 Data Protection Working Party, which is largely responsible for interpreting the rules of GDPR, intially said charging extra money for an ad-free, no-tracking experience was not allowed. But it changed its stance in April, according to Jessica Lee, an attorney at Loeb & Loeb, which specializes in advanced media and technology. "The Article 29 Working Party, in its final guidelines on consent, deleted text that was in the draft guidance that required a company to offer cost-free services that do not depend on the use of personal information," Lee says. "In light of this change, it's probably fair to conclude that a company is not prohibited from charging a reasonable fee for an 'ad free' or 'tracking free' experience." Lee adds that whether the charge is "substantial" enough so that the choice between the free and paid version is no longer "freely" given will depend on the service and the cost. "I suspect that we may get some additional clarity on where this line is drawn either from additional guidance from the individual supervisory authorities or through the first round of enforcement actions," she says. Chris Olson, CEO of Media Trust, a company that provides real-time security and first-party data protection, says "there are a million different shades of grey" in how some publishers are handling their consent. Some are "shutting everything off on a site while other pubs are doing nothing and waiting," Olson says. "All of these publishers, ad exchanges, the DSPs, the buy side—they all need to now know who they are doing business with," he adds. "That is the sea change that is coming."

Three publishers, three different approaches to consent under GDPR

Featured Stories