What happens if they toss cookies?
There is an ad-tech fight playing out in Europe that could upend the entire real-time bidding system that most publishers use to fill their online ad inventory.
It all centers on cookie matching—the syncing by ad exchanges of data about consumers online. On one side, privacy advocates and Google rivals argue this fundamental practice runs afoul of the EU’s General Data Protection Regulation. On the other, Google and its partners say that they are authorized directly by internet users to conduct cookie matching.
The EU is investigating whether Google is in compliance with its rules, which mandate that companies have direct consent from the end user to collect their data. At the same time, other companies like Apple and Firefox are limiting cookies’ power to track online behavior.
This much is clear: Without cookie matching, the way digital ads are bought and sold would be radically changed.
“Cookie matching is definitely essential for real-time bidding to make sense,” said Christoph Tavan, chief technology officer at Content Pass, a Berlin–based company that helps digital publishers develop new paths to making money as the web becomes tougher terrain.
Concerns about cookie matching reached a fever pitch this month after a report claimed to uncover clandestine data-sharing through Google’s ad exchange, which runs on millions of websites to help publishers sell ads. The report was based on a study by Brave, a web browser that competes with Google Chrome.
Some of the allegations in the study sounded damning, describing forms of cookie matching that create “secret” web pages where different parties bidding on Google ads could exchange data about users. “The new evidence reveals a surreptitious mechanism that raises additional data protection concerns,” Brave wrote in a blog post outlining the study.
Google responded that “the cookie matching process described is an industry standard practice that is not unique to Google. We have always been transparent about how our real time bidding process works and per GDPR requirements, we do not serve personalized ads or send bid requests to bidders without user consent.”
Many ad tech veterans agree that the study described commonplace cookie matching. Tavan describes the “hidden” web pages as pop-up internet domains, built by Google, that live under the main pages of publishers' sites. The page is a security layer to transfer data and vet ads before loading them on a publisher’s website.
A cookie can contain information about a person’s web habits, the articles they read, clothes they buy, health issues they browse and more. Cookie matching identifies when a cookie in one database is the same user as a cookie in another database, so that the consumer can be served an ad.
“If two companies want to talk about a user, they somehow have to establish a match,” Tavan said. “There are hundreds of players in digital advertising, and they all know the same users by different identifiers.”
While this might be common practice for how ads are served online, European regulators are still deciding whether players like Google and other ad exchanges have the direct permission of consumers to apply their data in this way. And even if Europe goes easy on cookie matching, there are other threats to the ecosystem coming from rival web browsers like Apple’s Safari, which is making it even more difficult for advertisers to tap into cookies to target ads. Facebook has also created a new mechanism for consumers to muddy their internet tracks with a way to erase ad data that brands use to target the social network.
The bottom line: Advertisers need new ways to serve effective ads when cookies are in short supply, and publishers need to help that happen. That’s why contextual advertising—served by automated systems based mostly on content displayed—is becoming increasingly important.
Publishers like The Washington Post are coming up with ways to analyze how a user acts on its web pages—the articles they read and other on-site behavior—to deliver ads, rather than relying on personal data.
“We’re going outside the creepiness of advertising and trying to bridge user experience and ad performance,” said Jarrod Dicker, VP of commercial technology and development at The Washington Post.
In a recent study, Google defended cookies for ad tracking, saying that contextual ads do not make as much money for publishers. Publishers’ potential revenue drops 52 percent when cookies are removed from the equation, Google claims. “Relevant advertising plays a major role in funding the open internet,” said Chetna Bindra, senior product manager of user trust and privacy at Google.
To ease privacy concerns, Google has promoted a kind of middle ground, looking for ways to give users more say and information about what sites can track their activity, while still enabling personalized advertising.