“PLEASE don’t leave us.” From the dozens of e-mails in people’s inboxes, begging them to give their consent to be sent further messages, you could deduce that the senders of newsletters and the like are hardest hit by the European Union’s tough new privacy law, the General Data Protection Regulation (GDPR), which goes into effect on May 25th. But the main loser may well be an industry that few have ever heard of but most have dealings with every day: advertising technology, or ad tech. In fact, the GDPR would probably not exist at all were it not for this collection of companies, which have an insatiable hunger for personal data.

Ad tech emerged because advertising is the internet’s default business model. Since targeted ads tend to be more efficient and targeting requires personal data (sites previously visited, searches in online stores and the like), these data became the fuel of a new industry to automate online advertising. It is so complex that even experts often resort to what is known as “LUMAscape”, a collection of maps of the business packed with logos put together by Luma Partners, a bank. It lists hundreds of firms in 18 different subcategories.

One cause for this fragmentation is the generosity of over-optimistic venture capitalists, who have backed even the most unlikely ad-tech ideas. Another is the nature of the beast: many cogs have to mesh to match people and ads in real-time. The fact that personal data are widely shared with lots of companies creates even more business complexity—but also makes the system a favourite target of privacy advocates.

Yet the “ad-tech bubble” has been deflating for some time, says Brian Wieser of Pivotal, a research firm. The industry thought that consumers would welcome “relevant” ads, but as these got more intrusive and creepy, people reacted by installing ad-blockers. Both Facebook and Google, ad-tech ecosystems unto themselves, have grabbed ever more ad dollars, leaving slim pickings for rivals. As a result, the industry was already consolidating.

The GDPR will speed up the process by, in effect, assigning a value to personal data. Under a realistic reading of the GDPR, most ad-tech firms will need consent from individuals to process their data. This will be hard, since most have no direct relationship with consumers. And even if they do, people are unlikely to approve being tracked across the web; only 3% would opt in, according to Johnny Ryan of PageFair, an ad-tech firm critical of the industry.

Reactions to GDPR have varied. Some ad-tech companies have pulled out of Europe. Others think they can get away with claiming “legitimate interest”, which is another legal basis for processing personal data allowed by the GDPR—an optimistic interpretation, and one that is likely to become obsolete with the ePrivacy directive, another privacy law the EU is working on. For its part, the European arm of the Interactive Advertising Bureau, a lobbying group, has released technical standards to ensure that an individual’s consent or the lack thereof is communicated across the advertising supply chain.

Another tack is to try and use the GDPR to improve companies’ position in the market. Google has told all the websites and apps that use its ad-tech tools that they must get people’s consent. It also says that if they use its consent tool, they must limit their use of other ad-tech vendors. That has publishers up in arms. They worry it will make Google an even more dominant force in the online advertising market. Instead, they harbour hopes that the GDPR will end up helping them. The rise of ad tech meant that advertisers no longer targeted websites and apps, but people. If the law makes individual targeting more difficult, publishers will regain some control of customer relationships, says Jason Kint of Digital Content Next, a publisher group.

Early signs suggest that the ad-tech industry may indeed be turning away from individually targeting people, and not only in Europe. Google, for instance, has said it will offer ads that are less targeted at particular individuals. A group of media companies has launched TrustX, a non-profit ad exchange which does not allow people’s data to be shared by lots of other firms. If the GDPR strengthens this trend, consumers will breathe easier online—and not just because their inboxes will be emptier.

Source: economist
Who will be the main loser from Europe’s new data-privacy law?