“Data-Driven Thinking” is written by members of the media community and contains fresh ideas on the digital revolution in media.
Today’s column is written by Allison Schiff, senior editor at AdExchanger. It’s part of a series of perspectives from AdExchanger’s editorial team.
In early February, the other shoe dropped on the Transparency and Consent Framework (TCF).
Belgium’s data protection authority diagnosed the IAB Europe’s TCF as illegal in its current form under the General Data Protection Regulation. The decision came more than three years after a group of privacy advocates, including Johnny Ryan, formerly of Brave and now of the Irish Council for Civil Liberties, initiated a complaint regarding the legality of the TCF.
The DPA hit IAB Europe with a 250,000 euro fine. It also gave the trade org two months to develop a plan for making the TCF compliant under GDPR – by this point, it’s got just over one month left on the clock – followed by another six months to put that plan into action.
IAB Europe, naturally, is appealing the ruling. In the meantime, though, a strange dynamic has emerged.
Unsurprisingly, TCF detractors are in high spirits. The drum they’ve been banging has finally been acknowledged by a regulatory body.
But proponents of the TCF – or at least those on the opposite side of the fence from Ryan and his crowd – seem curiously comforted by the DPA’s decision.
As the kids say: Weird flex, but OK. (Although, do kids say this anymore?)
Known unknowns
Why are many in the ad industry holding out hope for the TCF?
Well, remember when Facebook’s stock went up in 2019 after the Federal Trade Commission approved a $5 billion fine for data-sharing and privacy violations related to the Cambridge Analytica scandal?
That’s because investors were relieved. Rather than a Sword of Damocles hanging over Facebook’s head, the FTC gave investors a measure of certainty that the episode was over. (At the time, $5 billion was less than a quarter of Facebook’s annual profit.)
By the same token, but on a much, much smaller scale, in August 2018, location data ad tech startup Teemo was called out by the CNIL, France’s data protection authority, for gathering and processing data without informed consent. The CNIL threatened Teemo with a fine if it didn’t change its practices.
Teemo worked directly with the CNIL to fix the problem and received the all-clear two months later. Teemo was then able to publicly state that its approach to consent was essentially blessed by the CNIL. (Teemo was acquired by data platform Near in 2020.)
What does all that have to do with the TCF’s current predicament?
When a regulator takes action, it helps clarify the law and gives market participants a chance to change their behavior and get a potential seal of approval.
If they considered the TCF unfixable, the Belgians wouldn’t dangle a six-month window and offer the chance to make changes, Wayne Matus, co-founder and general counsel for compliance startup SafeGuard Privacy, recently observed to AdExchanger.
In other words, why put the thing on life support if there’s no chance at survival?
Tweaking the TCF
According to Matus, auditing the TCF – one of the compliance requirements called for by the Belgian DPA – is possible … it’s just not “practical.” Now it’s IAB Europe’s job to collaborate with people in the DPA’s office to make it both possible and practical.
Because the TCF isn’t immutable. There have been multiple iterations of the TCF since it first launched in April 2018. The second version, released in 2020, included additional support for legitimate interest as a legal basis in addition to explicit consent, and it also includes more detailed data processing purposes.
Joshua Koran, EVP of data and policy at Criteo, was one of the original architects of the first version of the TCF, and he told me he disagrees with a few of the changes made in TCF 2.0, including how businesses manage personal data.
TCF 2.0, for example, increases the number of B2B processing choices that are presented to consumers, he said, and allows publishers to override a user’s default choices.
Ideally, Koran said, TCF 3.0 would include simpler, more understandable choices for consumers; separate signals for consumer choices and for businesses; improved transparency and auditability of ad transactions across the supply chain; and the ability to audit and enforce terms on the use of digital identifiers. It would also help, he said, to clarify whether advertising identifiers remain random IDs or can be linked to a real-world individual.
Although the process will no doubt be uncomfortable, “this decision will open the door to simplifying how we as an industry communicate how responsible addressability can continue to support the media owner properties consumers enjoy,” Koran said.
Moment of truth
And who could disagree with that? Everyone wants to support media owners.
But just because the Belgian DPA is giving IAB Europe an opportunity to try and fix the TCF doesn’t mean the TCF is fixable.
Redesigning the TCF to be compliant with GDPR is “futile,” Ruben Schreurs, Ebiquity’s group chief product officer, recently argued in a column for AdExchanger. “The underlying processes for which it seeks to gather consent will never be compliant unless the system itself is radically redesigned.”
Ryan and his crew (and I’m paraphrasing here) believe the TCF is lipstick on a pig – but the pig doesn’t have to be made into rashers.
Real-time bidding reimagined doesn’t require personal data to function, and there is some anecdotal evidence that publishers can survive without it. The Dutch publisher NPO saw ad revenue increase by 149% in 2020 after switching to contextual ads.
“Remove all the personal data – that’s the obvious solution,” Ryan told me a few weeks after the Belgian decision. “We know that that can work, and we know it’s actually pretty effective.”
But, still, the ad industry has invested a lot of time and money into developing the TCF. It’s widely used – hundreds of companies rely on the framework – and the fact remains that the Belgians didn’t completely blow it up, which they could have done.
So, is the TCF toast or can it be saved?
Maybe that’s not even the right question. Maybe the question is, does it deserve to be saved and is this an opportunity to start thinking differently?
