Personalized targeting is the core idea of programmatic media buying. It allows serving the most relevant ads at the right time. The scale of brand outreach enabled by real-time bidding is complemented by its precision. Demographics, geolocation (down to IP address and places visited), interests, recent purchases and much more — all that is open for advertisers to use for targeting each potential customer with a personalized message. However, with the new upcoming European privacy regulations (GDPR), users will limit the amount of personal data they share. Inevitably, this will change programmatic media buying for the EU and likely, the entire world. Programmatic advertisers must tune up and comply with the new reality of digital advertising. But is GDPR a threat or an opportunity?


gdpr programmatic compliance


GDPR at a glance

Let’s get the definitions right. The General Data Protection Regulation (GDPR) is a legislation initiated by the EU to protect personal data and ensure transparent handling of personally identifiable information. For the first time, the legal consequences for data processing will be aligned across all 28 EU member states. But not only — all the companies that acquire and process data of the European citizens will be obliged to comply with the legislation, regardless of their geographic location or form of ownership. Therefore, the law has a truly global effect. The breaches of GDPR may result in hefty fines of up to 4% of the company’s total revenue. Thus, marketers have to make sure that all the promotional activities comply with the regulations before the law comes into force on May 25, 2018.

The key provision of GDPR is the requirement to get from users clear, unequivocal consent for data processing. Failure to do so will be penalized. Companies will be held accountable for data breaches and sharing personal information of the users with the third parties. To sum up, brands must request users to agree to the collection of their personal information.

Programmatic without data?

According to GDPR regulations, users have to consent to data processing and brands need to clearly state what purpose the data is collected for. In this way, advertisers will have to obtain explicit consent for each data use separately: showing ads, creating a user profile, revealing data about interaction with ads, etc.

As much as many users are reluctant to pass over their data to a brand, they will be even less inclined to do that multiple times. This regulation could be circumvented thanks to the notion of “legitimate consent”, if a user is already an existing client or if data processing is conducted to the benefit of the processing company. But “legitimate consent” has rather limited application and doesn’t generally cover advertising.

Thus, the new regulations will deprive programmatic media buying of its core benefits: precise targeting in real time and reliable tracking via third-parties that gather user data. After GDPR is enforced, ad platforms and programmatic media buyers will have to comply with the new arrangement and find a way to provide value to clients on both demand and supply side.


futiure of programmatic after GDPR


Regulations bring more transparency

While GDPR introduces significant constraints to programmatic media buying, it doesn’t completely marginalize scalable digital advertising. The responsibility for obtaining consent from users and informing of the intended use of personal information will fall on advertisers and publishers, while ad tech platforms will retain their position as intermediaries, connecting market demand and supply.

Most probably, advertisers will have to shift back to targeting audience segments, because personal data will be much harder to obtain. Programmatic will continue to exist, but the rules of the market will most likely change. At the same time, even as GDPR brings more limitations to programmatic media buying, inadvertently, the regulations also address the pressing issue of transparency. Advertisers that were concerned with fraudulent traffic and viewability of ads will now have more reasons to trust publishers. All the transactions of data request and transfers will be open for audit. Therefore, premium partners will be rewarded with higher payouts and fill rates, while insufficient traffic quality will decrease. Advertisers will have more confidence in the value they get from ad campaigns.

Final thoughts. Is it time to worry about programmatic advertising?

The landscape of digital advertising is about to undergo drastic changes. Before GDPR comes into force, we can only assume how the market will react. However, key market players already announced the way they are preparing for the new legislation:

  • iAB released updated OpenRTB specifications to accommodate GDPR and ensure the possibility to confirm consent string, which is treated as a single unit of data to be transmitted during the real-time bidding process;
  • Facebook announced its role as a data controller and stated the limits of the company’s responsibilities as a data processor. More precisely, when Facebook acts as a data processor, the responsibility for ensuring compliance to GDPR is assigned to businesses;
  • TUNE already presented an action plan of preparing for GDPR regulations and advises clients to create awareness about the legislation, understand the notions of consent and legitimate interest, develop a consent management procedure; document the storage and usage of any personal data;

Other companies put a data processing agreement in place for every client, employ Data Protection Officer to manage compliance with GDPR and other European legislation on privacy and processing personal data, and ensure that publishers obtain consent from the users and properly record it.

Programmatic media buying is predicted to deal with far less amount of data and focus on premium inventory. At the same time, GDPR opens new opportunities for combating fraud, tracking impressions and holding publishers accountable for the ads viewability. The new regulations might bring long lacking transparency to the industry, finally improving the efficiency of advertising by filtering out fraudulent publishers. Instead of worrying about GDPR and its consequences, both advertisers and publishers should learn to navigate the new rules of media buying and focus on catering to the needs of their audience.