Colin O'Malley, principal of consulting firm O'Malley Privacy, whose clients include Tapad, indicated Right to be Forgotten is meant to keep some of the tech power players in check.
“The broader implications of this ruling for ad tech vendors surrounds the emerging role of Google, and of course Apple and Facebook, as the dominant parties that have a privileged relationship with the consumer, and the release of their own commercially controlled ID systems,” O’Malley said.
In 2009, the EU passed the Cookie Directive, part of the overall Privacy Directive in Europe, which required companies to get consent to place cookies. The directive however only required companies to obtained implied consent and privacy experts predict that legislation will be modified to include explicit consent, which comes much closer to opt-in.
“There’s a lot of convergence right now around the third-party ecosystems’ inability to rely on a traditional cookie infrastructure as we transition to mobile, and with Facebook, Google and Apple releasing their own proprietary ID systems which are also cookie replacements,” O'Malley said. “But the ability of these first parties to combine all of the information they’re collecting about users across dozens of touch points is totally unique in its power.”
The Hamburg ruling, O’Malley said, could potentially have a limiting impact on how first parties are collecting data from across their products and combining it behind their ID systems. “To the extent that that’s true,” he added, “it might have some impact in limiting the power of those commercial IDs, which I think is incredibly important from the third-party perspective.”
Investing In The German Marketplace
Although the strictness of privacy regulations vary from country to country, those in the Netherlands and Germany are particularly severe, Doerfel said. Adherence to regulations in Germany is particularly crucial due to the country’s hard-edged definition of PII.
“How PII is considered is very different from country to country,” Doerfel explained. “An IP address is not considered to be PII in the US. There are certain circumstances where you are allowed to save data and retarget, but in Germany IP is PII.”
“In Germany, you’re able to have the location of the user, but no PII,” he continued. “In other words, you can’t pinpoint one person, only a group of people. If it’s possible for you to find out something about a single person in your user base based on the information you gather, that is considered PII.”
Tech Giant's Burden
Though the recent privacy rulings seem endemic to Germany, the issue extends beyond the region.
“The Right to be Forgotten is just the beginning,” Payfone CEO and co-founder Rodger Desai told AdExchanger. “Google is going to have to invest in ways for people to understand what they’ve opted into and allow them to opt out.”
“Behind the scenes, all of Google’s services are interconnected. Users think they’re just using YouTube, or Gmail, but meanwhile there’s a rich and centralized profile behind the curtain,” Desai said. “Google will be forced to give control over that to people because the public opinion can go against them.”
The larger threat, according to Desai, is that Google will face increasing restrictions in much the same way that previous monopolistic corporations have been regulated. But Desai suggested Germany’s recent ruling wouldn’t affect smaller players in the ad tech space. In other words, Google may take the hit for its competitors.
“I think other ad tech companies will view Google as taking the brunt of the fight,” said Desai. “Everyone else will wait and watch how that plays out.”
In the end, Germany is simply too big a market to ignore. “It’s where you can make the most money,” Desai explained. “I don’t think this mandate will slow anyone else down.”
O’Malley agreed that the Hamburg ruling will not deter other ad tech players from investing in the German marketplace. “This ruling applies specifically to companies that have a large number of parallel relationships with the consumer, and whether or not they’ll be able to blend that data into unified profiles."
"But the recent ruling does give evidence to the fact that European regulators are refusing to be intimidated by large US tech companies,” O’Malley said. “And it’s becoming pretty clear that to succeed in Europe, you’re going to have to meet Europeans on their own terms. It remains to be seen what these challenges in Europe do to the power of Google’s ID system, and of course, the other folks in the tech space.”
For the time being, it looks like Google sits alone in the hot seat.