The New Reality of Behavioral Advertising in the EU

Meta recently conceded that in-app behavioral advertising in the EU can no longer be opt-in by default, marking the end of an era. The regulators won, at least for now. Every few decades, major shifts happen that change how an industry fundamentally operates and who the new winners and losers are. We are in the midst of one such shift in the digital advertising industry. This has been driven by three critical changes in the ecosystem, all privacy-related: Apple announced the in 2021 App Tracking Transparency framework Google is in 2024 deprecating third-party cookies A slew of privacy legislation is either already in place (like the , ) or is about to be in place (like the ) California Privacy Rights Act EU General Data Protection Regulation EU Digital Services Act While the effects of these changes have been felt by the advertising industry globally, the for a few years now. . In the past three weeks, there have been significant announcements from , , and about upcoming changes to their products in the EU. It’s probably fair to say these changes mark the end of an era for behavioral advertising in the EU, and the platforms have made peace with that. EU, in particular, has been at war with behavioral advertising And winning Meta Snap TikTok In this piece, we’ll dive into: How the advertising ecosystem runs (or used to run) Privacy interventions and impact on behavioral advertising EU’s war on behavioral advertising and why platforms are conceding Possible future paths How the advertising ecosystem runs (or used to run) Let’s start with some simple concepts. An ad shown to you can be contextual or behavioral (sometimes both). A is something that is shown alongside organic results (non-ads) in the context of whatever you are doing. For example, if you are on a food delivery app like DoorDash and you see an ad for a restaurant alongside organic results, that is a contextual ad. In that case, your identity doesn’t really matter. DoorDash knows your location and what you’re looking for and therefore shows you a relevant ad. Knowing your identity and interests does help improve the relevance of these ads, but it’s secondary to the context itself. contextual ad A is something that’s shown to you because of your past behavior. For example, you might have visited an office chair brand’s page on Instagram, and therefore you get served ads for another office chair brand; that’s exactly what happened to me with the ad on the right. This can either be based on direct behavior (like the office chair example) or inferred behavior — people like you who looked for chairs also looked for monitors. One step further, people who looked at chairs are also likely to work from home more and therefore be open to lunch service. All of those are potential ads that can be shown to you. behavioral ad A subset of products, most often search products, are perfect for contextual ads — Google Maps, Google Search, DoorDash, Yelp, Thumbtack, TripAdvisor, and Zocdoc, to name a few. The user has high intent to do something specific. However, most high-intent products are low-medium frequency. You are not looking for plumbers every day on Thumbtack, and you are not looking to order food delivery every hour of the day on DoorDash; therefore, the amount of contextual ad inventory is lower — highly effective but lower in volume. On the other hand, social media platforms where users spend hours doomscrolling have a large volume of non-contextual inventory. Random ads are annoying and ineffective, and therefore the most effective way to monetize this inventory is through behavioral ads. Unsurprisingly, . Before ~2018 (when EU’s GDPR kicked in), there was essentially a about you, collected through a long list of highly effective AdTech mechanisms. Some notable examples: behavioral ads require a lot of data, specifically data about you free flow of data Every iOS or Android phone had a unique “ ” assigned to it (and by association, to you). This ID was accessible to all apps on your device, i.e. your Uber app and your Google Maps app both knew you are mobile advertising ID 123 and could easily cross-identify you across apps. mobile advertising ID Most browsers (except Safari and Firefox) support “ ”, which are essentially a piece of data that one site could place on your browser and another site could access. There would be a “cookie ID” associated with you, and you could be easily cross-identified across websites. third party cookies Note that . You could go deep inside your settings and reset these IDs, but most people never do that. This resulted in a couple of second-order effects. these identifiers, for all practical purposes, were permanent First, companies that are “ ” started purchasing data from several different data providers and ; for example, app 1 could tell the broker that you bought an expensive piece of furniture, website 2 could tell them you have an account with a high-end bank, and the data broker could put that together and categorize you as “high propensity of spend” person; note that when I say “you,” that refers to your identifiers (mobile advertising ID or third party cookie ID) data brokers building “profiles” about you As more and more data became available, the profiles had more fidelity to them, and identification became more sophisticated; for example, if app 1 had your mobile advertising ID and website 2 had your Chrome third-party cookie ID, a data broker or an ad platform could compare your IP addresses and know it is the same person. Take this one step further. A data broker could also use a third data source and find an email associated with your IDs. One more step further, they could buy your address from a utility or telecom company and find your address. This might sound far-fetched, but it’s not — are a very commonly used data product in the AdTech stack today, and telecom companies are . If you need a more entertaining take, check out . device graphs notorious for selling your data John Oliver’s episode on data brokers Second, ; through a combination of technical mechanisms, an advertiser could say you first saw an ad on Facebook, then an ad on Google Search, then a display ad on NYTimes, and eventually bought an item from their website, so each of those three advertising platforms get shared credit. Attribution/measurement of advertising campaigns became more and more precise While this sounds privacy invasive (and it is), this resulted in a highly efficient advertising ecosystem. Advertisers knew exactly which users they were targeting, and since they had all these extra behavioral signals to know how likely a user was to engage, they were willing to pay higher cost per impression (CPM) for ad inventory, thereby generating more revenue for a media publisher. Precise attribution/measurement turbocharged this further. However, you can see how this was . This rightfully raised concerns about data consolidation in the hands of both data brokers and large technology companies, and an intervention was inevitable. It was less a matter of if and more a matter of when. becoming the wild west — highly effective advertising no doubt, but also an uncontrolled orgy of data acquired with non-existent or questionable user consent Privacy interventions and impact on behavioral advertising Let’s dive into each of the three privacy interventions that arose in an attempt to tame the Wild West. First, Apple introduced the . It sounds jargon-y, but the change is relatively simple. Prior to ATT, every app by default had access to your advertising ID, i.e. it was opt-in by default. This meant you could easily be tracked across apps and therefore shown effective behavioral ads. For example, you installed the Strava app to track your runs, you are now on Facebook, and you are shown an ad for Strava Premium. After ATT, the access to this , i.e. an app had to show you a pretty aggressive prompt to get access to your identifier, and you explicitly needed to say yes. The average opt-in rate ended up close to (with a lot of caveats).' App Tracking Transparency (ATT) framework identifier became opt-out by default ~34% We won’t go into much detail here, but this prompt was launched by Apple in the guise of embracing privacy — a smart chess move. The consensus opinion today is that this was an opportunistic move from Apple, which no doubt improves privacy but also heavily hurts Apple’s competitors as they . The impact was that user identity was available much less often. prop up their own ads business Note here that for behavioral advertising to happen in the Strava-Facebook example, there is not one but two apps that need to have received opt-in from you, i.e. the addressable market does not drop to 34%, it drops to 34% * 34% = ~12%. Therefore, . cross-app behavioral advertising on iOS is no longer effective at scale Second, Google announced that it will . The consensus opinion is that the change helps Google achieve a dual purpose: appease regulators who are breathing down their neck for , while taking control back from what’s now a . Google’s post third-party cookies will still allow cross-site retargeting, but in a more private way where all information is stored on-device within the browser, i.e. there are no more cross-site “cookie IDs” assigned to you. While the new mechanism preserves some of the status quo, . deprecate third-party cookies in 2024 potential anti-trust behavior in AdTech fairly bloated advertising tech stack new mechanisms cross-site behavioral advertising is going to have much less fidelity and, therefore, effectiveness Which brings us to the third intervention — . The most aggressive of these is the EU’s GDPR, which went into effect in 2018. The California Consumer Privacy Act (CCPA) went into effect in 2020. While the progression has been gradual, the reason these laws matter for advertising companies today more than ever is because the laws take aim at the (i.e. you do a bunch of different things inside the Facebook app and Facebook gets to use that data to show you behavioral ads within the app). privacy regulations only remaining and mission-critical advertising mechanism — behavioral advertising within companies’ own apps EU’s war on behavioral advertising and why platforms are conceding A primary feature that makes the California laws (arguably the strictest privacy law in the US) less aggressive than the EU’s GDPR is that it . For example, the 2020 California Consumer Privacy Act (CCPA) requires companies that are considered “data sellers” under the law to provide explicit opt-outs on web pages, but the . does not require explicit opt-ins and only requires platforms to provide opt-outs default is still opt-in EU’s GDPR takes this up another notch and requires for behavioral advertising. This consent needs to be . For example, Meta cannot gate content behind a behavioral advertising consent prompt. explicit opt-in/consent freely given, specific, informed, and unambiguous So, the simplistic inference from this is that Meta needs to get explicit consent for all behavioral understanding, including the last remaining mechanism — showing ads within their own platform. If Meta is forced to do this, the opt-in will likely be small (the Apple opt-in rates were ~34%), and this majorly shrinks Meta’s addressable advertising market in the EU. To not meet that fate, Meta made a creative legal argument: GDPR requires any company to have one of ** **if the company needs to process personal data. Paraphrasing, these are — consent, a necessity to fulfill a contract, a necessity for legal compliance, a necessity to protect the vital interests of the user, a necessity to perform a public interest task, and a necessity for legitimate interests pursued by the company. six legal bases Of these six, Meta held the stance that they were processing personal data using “ legitimate interests” (the last of the six) as the legal basis and therefore did not need to show an explicit opt-in prompt. Last month, the Norwegian Data Protection Authority that . Paraphrasing the : provided their enforcement decision Meta’s use of “legitimate interests” as the legal basis is not valid enforcement decision Based on several past court rulings, Meta must prove that legitimate interest “cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental rights and freedoms of data subjects.” Based on another past court ruling, despite the fact that Meta provides a free service, the user of that network cannot reasonably expect that the operator of the social network will process that user’s personal data, without his or her consent, for the purposes of personalized advertising. Four days after the Norwegian Data Protection Authority’s ruling, Meta that they would be changing their legal basis from “legitimate interests” to “consent.” In practice, what this means is that . While Apple’s changes significantly cut down the ability to advertise cross-app, Meta was holding on to hope that it would be able to preserve all in-app behavioral advertising (including in the EU), and the writing is now on the wall. shortly after with their own announcements that non-personalized versions of their products will soon be available to users. A total of are likely to follow suit. announced Meta is conceding that behavioral advertising within their own app in the EU can no longer be opt-in by default and followed suit Snap TikTok 19 platforms that are in scope Possible future paths It is still to be seen what percent of users opt into behavioral advertising. If the Apple opt-in rates are any indication, it may get to the ~34% rate seen there, but it may also go higher if platforms are allowed to be creative about opt-in language and user interfaces. It is hard to say what exactly the long-term effects of ending the opt-in-by-default regime for behavioral advertising in the EU will be, but here are some educated guesses: — Meta has made towards letting users provide inputs to the feed algorithm. I would expect the creation of more explicit preferences/interests that users explicitly select. While it has worked to a smaller extent for some products like , it is likely that the quality of content provided by just preferences will be nowhere close to the relevance of a system that is constantly ingesting data and inferring interests. Explicit preferences instead of inferred interests some progress Reddit : TikTok has announced that they will create a that is based on what’s popular in your region. Most social feed-based platforms will also (re)introduce simplistic ranking options like chronological. I am not bullish that any of these will create an engaging user experience. Non-personalized feeds non-personalized feed : My (potentially contentious) take is that opted-out users will see a significantly degraded experience and eventually decide to provide platforms consent to personalize. The platforms will likely use this mechanism to receive content for all personalization (including behavioral advertising) — It’s unclear if there are any regulatory constraints that force them not to bundle consent for user experience personalization and behavioral advertising. I don’t expect the consent rate to go anywhere close to the status quo, but I think it will be a meaningful bump to what’s seen with Apple’s opt-in rates. Degraded user experience, leading to more opt-in : Twitter launched Twitter Verified a few months back, and Meta is with a similar concept. I am not bullish that a majority (or even a minority) of users will be willing to pay for social media products after years of being conditioned to get these products for free. Experiments with subscriptions experimenting If platforms are not able to effectively monetize the EU market, it is likely that they will start de-prioritizing investments for the EU market, which is a real risk of an aggressive regulatory regime. I don’t expect them to stop supporting EU markets, but every new feature built is an investment, and companies will start heavily questioning if they are willing to do any extra work for this market. For example, if there’s additional work to make a feature comply with GDPR, that might not be worth it anymore. We have seen other equivalent situations of this — several apps have a much better experience on iOS than Android because iOS apps monetize better. De-prioritization of EU markets: Conclusion The advertising market exploded over the last several decades due to the availability of essentially infinite user data, which brought both large efficiencies in advertising and major privacy risks. Regulation was necessary. Great regulation is about finding the balance between promoting innovation/letting new businesses emerge that move society forward and having guardrails so people are protected. Did the EU go too far? I personally think they did, and if that is true, the effects will start showing in a 5–10 year horizon, and course correction will follow. Until then, this is the new reality of behavioral advertising in the EU. The regulators and legislators came all guns blazing, and they won. 🚀 If you liked this piece, consider subscribing to Every week, I publish one in the form of a 10-minute read. Best, Viggy. . my weekly newsletter deep-dive analysis on a current tech topic/product strategy Also published . here