A decision by the DPA’s Litigation Chamber on the merits of the complaints against the IAB Europe (IAB) was released on 2 February 2022, prompting widespread commentary and response from an expectant audience. Almost a sigh of relief – the perspective of not just the Belgian DPA but most EU regulators on TCF is in the open, and the industry can now respond.

It is welcome and whilst the path ahead is tricky, there is now a path.

Is this decision good for consumers? Yes of course, consumers should absolutely be in control of how their personal data is used.

Is this decision good for MediaMath and the wider industry? Our view is again yes, but there is much work to be done.

The IAB EU are now tasked with presenting their plan for implementing the decision’s corrective measures, but in fact this decision is a call to action for the industry to ensure transparency and choice are offered and actioned in a meaningful, effective way. MediaMath were instrumental in spearheading the initial development of the TCF, and its evolution to v2. Perfect is hard, perhaps impossible, but the evolution continues, and this decision highlights the requirements of the next iteration of TCF.

MediaMath is committed to supporting industry collaboration, which is now needed across the whole supply chain from publishers, SSP, DSPs and advertisers to reach the goal and lawful requirements of enhancing transparency to individuals (both as a data ethics principle and as required by GDPR) through meaningful and easy to understand disclosures to users, and by ensuring respect for those user preferences is honoured and clearly actioned along the entire user journey.

MediaMath’s view is that TCF has not been invalidated by this decision. A clear pathway to compliance has been set and the IAB have commented publicly that they “look forward to working with the APD on an action plan”. We welcome this, and we hope that successful implementation of corrective measures provides a bright line for the industry’s continued compliance with GDPR.

The industry needs to work together across the full supply chain to avoid unintended consequences from this decision. There is much to pore over in the decision, and we expect considerable focus to be placed on the lawful basis for processing personal data for the purposes of advertising. The decision casts doubt on the lawfulness of any consent given by consumers, and prohibits reliance on legitimate interest. This requires careful consideration, to avoid any unintended consequences. Publications rely on advertising, and indeed consumers expect (or have grown accustomed to) advertising in media whether that be print or digital. To crystalise the issue, prohibiting legitimate interest has a direct impact on the ability to deliver even a basic ad, resulting in white space on the consumer’s screen. A way through is needed – for consumers, publishers, and advertisers.

MediaMath champions radical transparency. We believe that consumers should understand how their data is being used, and how it is being protected. This is fundamental to our modernized ecosystem. We are putting consumer choice in the hands of the consumer, with the launch of our access request portal.

MediaMath is committed to ensuring Privacy by Design principles informed by data ethics, is implemented in our own services, and by championing the same data ethics approach across all our partners in the supply chain, with ensuring the consumer is always at the heart of privacy by design, at each stage of the consumer journey. The corrective measures set out in the DPA’s decision are a blueprint for all industry partners to measure themselves against, and we have a compelling story in that respect.

MediaMath has assembled a strong privacy team to demonstrate and implement global privacy compliance. Headed up by our Chief Privacy Officer, Fiona Campbell-Webster, in the USA, as well our official Data Protection Officer, James Kerr in Europe and the U.K, each with clearly delineated responsibilities and who work together with Ferdinand David, VP, Product, Policy & Compliance, to continuously assess and refine our capability to technically comply with the legal and privacy requirements of GDPR and all other applicable laws. We have a clear goal to support positive business outcomes for our clients by building and scaling privacy-first trusted programmatic journeys through transparency and choice for the consumer.

The coming weeks and months will be an exciting time for our industry.

The California Consumer Privacy Act came into effect on New Year’s Day. As a recent Campaign US article details, it is already “both under question and under renovation.”

Under the law, California residents are required to know “what personal data of theirs is being collected and to whom it is sold or disclosed.” Residents can also access their personal data, stop its sale, request its deletion and avoid discrimination if they assert their right to privacy.

Daniel Sepulveda, our SVP of Policy & Advocacy, shared his thoughts on what’s next now that the CCPA is in effect in several media publications this week. Read excerpts below:

The impact of regulations and the consumer POV in 2020

“The majority of companies in the advertising industry want to do the right thing,” Sepulveda told AdExchanger. “Our industry is in the process of winning back trust. In the future, we’ll see more scrutiny of companies and, inevitably, more accusations of companies using backdoor workarounds in an attempt to not comply with the law.

Consumers will tend to consent less and opt out more, particularly in the beginning, because they may believe there is no downside to doing so. If publishers wish to continue processing consumers’ personal data in order to monetize their content – and if advertisers wish to continue delivering targeted advertisements to individuals or measuring the effectiveness of contextual ads – then both parties will need to adapt their messaging to consumers to demonstrate the value consumers receive from the processing of their personal data.”

What a CCPA compliance solution requires

“What we’re trying to do as an industry is say what are the analytics and measurement type services that we can still provide,” Sepulveda told AdAge. “This is what everybody is trying to figure out­, how to come into compliance with the California law.”

“The tech for enabling the exercise of consumer rights under CCPA exists, it just needs to be modified for that purpose,” he shared with Campaign US. “We, as people and an industry, must solve for the law’s purpose – to increase consumer control and understanding of the use of their data. This is particularly important for those of us in the digital advertising industry because our ecosystem is complex, interconnected, and somewhat opaque.

We believe that a compliance solution requires four key elements:

1) Surfacing to consumers the fact that the company they are directly interacting with and third party companies are engaged in the collection and sale of their personal information when that is happening,

2) Ensuring that consumers have the option to bar any or all of them from “selling” (as CCPA defines it) that information,

3) Signaling those choices to the rest of the ecosystem, and

4) Creating legally binding obligations on all participants to respect those choices.”