Germany is leading the attack in the EU’s deepening privacy war against Google.
Late last Tuesday, a legal ruling levied by Hamburg data protection commissioner Johannes Caspar required that Google obtain Germans’ expressed permission in order to access their data, or face $1.27 million in fines.
“Our requirements aim at a fair balance between the concerns of the company and its users,” Caspar said in a statement. “The issue is up to Google now. The company must treat the data of its millions of users in a way that respects their privacy adequately while they use the various services of the company.”
This ruling furthers a trajectory that could harm the overseas advertising business of Google and all ad tech companies. Other points of concern for the international ad tech industry include a 2013 mandate, also spearheaded by Casper, preventing Google from collecting personal data from unencrypted German Wi-Fi networks on the grounds that data was collected without consent and could be used to construct advertising profiles.
And, most notably, Google came under scrutiny during the EU’s “Right to be Forgotten” ruling in May.
Others have felt the reverberations. Rumor has it that German software corporation SAP stalled its acquisition hunt to bolster its presence in ad tech because of the Right to be Forgotten ruling.
But businesses aren’t yet shying away from Germany, which is considered to be one of Europe’s most robust markets for ad tech. Those that are tempted enough to take the plunge, however, are taking a cautious yet calculated approach to their strategy there.
Adsquare, an in-mobile targeting platform, has had its eye on the German marketplace since it launched in 2012. CEO Sebastian Doerfel told AdExchanger that privacy has been at the core of his company’s development in the region.
“We were consulting lawyers from the beginning, because this is a very sensitive topic, dealing with location and user data in retargeting,” Doerfel said, “It was always our goal to build a solution that could work in Germany, which is one of the strictest countries when it comes to privacy.”
Pre-emptively Addressing Privacy
Colin O’Malley, principal of consulting firm O’Malley Privacy, whose clients include Tapad, indicated Right to be Forgotten is meant to keep some of the tech power players in check.
“The broader implications of this ruling for ad tech vendors surrounds the emerging role of Google, and of course Apple and Facebook, as the dominant parties that have a privileged relationship with the consumer, and the release of their own commercially controlled ID systems,” O’Malley said.
In 2009, the EU passed the Cookie Directive, part of the overall Privacy Directive in Europe, which required companies to get consent to place cookies. The directive however only required companies to obtained implied consent and privacy experts predict that legislation will be modified to include explicit consent, which comes much closer to opt-in.
“There’s a lot of convergence right now around the third-party ecosystems’ inability to rely on a traditional cookie infrastructure as we transition to mobile, and with Facebook, Google and Apple releasing their own proprietary ID systems which are also cookie replacements,” O’Malley said. “But the ability of these first parties to combine all of the information they’re collecting about users across dozens of touch points is totally unique in its power.”
The Hamburg ruling, O’Malley said, could potentially have a limiting impact on how first parties are collecting data from across their products and combining it behind their ID systems. “To the extent that that’s true,” he added, “it might have some impact in limiting the power of those commercial IDs, which I think is incredibly important from the third-party perspective.”
Investing In The German Marketplace
Although the strictness of privacy regulations vary from country to country, those in the Netherlands and Germany are particularly severe, Doerfel said. Adherence to regulations in Germany is particularly crucial due to the country’s hard-edged definition of PII.
“How PII is considered is very different from country to country,” Doerfel explained. “An IP address is not considered to be PII in the US. There are certain circumstances where you are allowed to save data and retarget, but in Germany IP is PII.”
“In Germany, you’re able to have the location of the user, but no PII,” he continued. “In other words, you can’t pinpoint one person, only a group of people. If it’s possible for you to find out something about a single person in your user base based on the information you gather, that is considered PII.”
Tech Giant’s Burden
Though the recent privacy rulings seem endemic to Germany, the issue extends beyond the region.
“The Right to be Forgotten is just the beginning,” Payfone CEO and co-founder Rodger Desai told AdExchanger. “Google is going to have to invest in ways for people to understand what they’ve opted into and allow them to opt out.”
“Behind the scenes, all of Google’s services are interconnected. Users think they’re just using YouTube, or Gmail, but meanwhile there’s a rich and centralized profile behind the curtain,” Desai said. “Google will be forced to give control over that to people because the public opinion can go against them.”
The larger threat, according to Desai, is that Google will face increasing restrictions in much the same way that previous monopolistic corporations have been regulated. But Desai suggested Germany’s recent ruling wouldn’t affect smaller players in the ad tech space. In other words, Google may take the hit for its competitors.
“I think other ad tech companies will view Google as taking the brunt of the fight,” said Desai. “Everyone else will wait and watch how that plays out.”
In the end, Germany is simply too big a market to ignore. “It’s where you can make the most money,” Desai explained. “I don’t think this mandate will slow anyone else down.”
O’Malley agreed that the Hamburg ruling will not deter other ad tech players from investing in the German marketplace. “This ruling applies specifically to companies that have a large number of parallel relationships with the consumer, and whether or not they’ll be able to blend that data into unified profiles.”
“But the recent ruling does give evidence to the fact that European regulators are refusing to be intimidated by large US tech companies,” O’Malley said. “And it’s becoming pretty clear that to succeed in Europe, you’re going to have to meet Europeans on their own terms. It remains to be seen what these challenges in Europe do to the power of Google’s ID system, and of course, the other folks in the tech space.”
Google declined to comment on the recent ruling out of Hamburg, but in a statement provided to TechCrunch, a Google spokesperson said, “We’ve engaged fully with the Hamburg Data Protection Authority throughout this process to explain our privacy policy and how it allows us to create simpler, more effective services. We’re now studying their order to determine next steps.”
For the time being, it looks like Google sits alone in the hot seat.
