Home Privacy What Does Google’s GDPR Fine Mean For The IAB’s Consent Framework? (Probably Nothing Good)

What Does Google’s GDPR Fine Mean For The IAB’s Consent Framework? (Probably Nothing Good)

SHARE:

Google got dinged by France’s data protection watchdog on Monday for failing to properly collect user consent under the General Data Protection Regulation. It was only a scratch but the ruling could signal a rough road ahead for the industry’s consent framework.

The 50 million euro fine levied by the CNIL (the Commission nationale de l’informatique et des libertés) , around $57 million, is the largest GDPR-related penalty issued to date, but the amount is so slight that it won’t even register on the bottom line of a company that generates multiple billions in advertising revenue every single quarter.

“I think Google might be emboldened by both the magnitude of the fine and the focus on consent collection design specifics rather than their business as a whole,” said Andrew Frank, VP of research and a distinguished analyst at Gartner.

Google can probably improve its consent collection process “without making fundamental revisions,” he said. And as a consumer-facing utility provider, Google is better positioned to obtain consent on a purpose-by-purpose basis than many ad tech companies without direct consumer relationships.

But if Google is getting called out for porting and sharing consent for its own services, where does that leave IAB Europe’s GDPR Transparency and Consent Framework? The IAB proposal is widely seen as the industry’s best bet to enable publishers to effectively share user consent with their key ad tech vendors.

Is that framework in peril?

Maybe. The CNIL has already questioned its viability through a November 2018 enforcement action against Vectaury, a French ad tech company that was called out for using a defective consent management platform to collect permission from its publisher and SSP partners.

The IAB’s consent framework “has always been challenged” by the GDPR’s requirement that consent be “granular,” Frank said, meaning that separate advance consent must be obtained for each data processing purpose.

That said, the jury’s still out on whether the framework will be an acceptable solution from the regulatory perspective.

“It doesn’t seem completely clear whether separate companies can share a common purpose for data processing – that is, to offer targeted advertising – for the purposes of obtaining consent,” Frank said. “There are many parties working on resolving this point.”

But what does seem clear is that it’s time to strap in as regulators crack their knuckles and start to put their new legislative tools to the test.

Subscribe

AdExchanger Daily

Get our editors’ roundup delivered to your inbox every weekday.

“We’re in for a very long series of actions and reactions before we settle on some new equilibrium,” Frank said.

And the wind isn’t blowing in Big Tech’s favor. None Of Your Business, the privacy advocacy group whose complaint triggered the CNIL’s case against Google, also has related and  pending complaints filed in multiple European jurisdictions against Facebook’s family of apps along with a bunch of other large tech companies.

And that “bodes ill for any free online platform that makes its money through targeting advertising,” said Andrew Burt, chief privacy officer and legal engineer at Immuta, a data management platform that helps companies gather compliant data. “This might be good news for consumers, but it’s not good news for Silicon Valley.”

Must Read

With GAM Going Direct To Buyers, SPO Is The New Normal

GAM’s dinner with ad agencies sparked speculation that Google is preparing to spin off its bundled SSP and ad server as a remedy to its ad tech monopoly. But Google says it’s just part of the trend of SSPs going direct to buyers.

Google’s Proposed Fix To Its Ad Tech Monopoly Is At Odds With The DOJ’s Remedies

Late Friday evening, Google filed its proposed remedies to its ad tech monopoly to District Court Judge Leonie Brinkema, and unsurprisingly, they’re rather mild – and very different from what the Department of Justice is looking for.

Lance Armstrong

Exclusive: Lance Armstrong’s VC Firm Invests In AI-Powered Health Care Ad Tech Startup BranchLab

BranchLab, an AI startup for healthcare marketers, just added a new high-profile backer: Lance Armstrong’s Next Ventures, which invests in health and wellness startups.

Privacy! Commerce! Connected TV! Read all about it. Subscribe to AdExchanger Newsletters
Comic: Gamechanger (Google lost the DOJ's search antitrust case)

Judge Mehta’s Remedies For Google’s Search Monopoly Won’t Cure What Ails Publishers

Remedies in the federal search antitrust case against Google landed with a thud earlier this week. Most publishers and ad industry pundits were sorely disappointed.

Conversion APIs Are Becoming Table Stakes – But Not All Brands Have Bought In

CAPI integrations have moved from a nice-to-have to a necessity for anyone operating within walled garden environments. Now they’re laying the groundwork for an outcomes-driven ad ecosystem.

Peppa Pig

The Media And Retail Deals Behind The Peppa Pig Franchise Expansion

Peppa Pig is everywhere. Whether or not you have children, you likely know the little girl pig from the kid’s cartoon show. But the Peppa media franchise is just getting started.