blog: Don Marti


Dialog with Jo Ellen Green Kaiser on user data management platforms

27 August 2018

updated 27 Aug 2018: copy edits for clarity, add introduction.

EDITOR'S INTRODUCTION -- What follows is an edited Q-and-A exchange between Jo Ellen Green Kaiser, board chair of the Information Trust Exchange Governing Association, and Don Marti. The exchange is focused on explaining why a voluntary user data privacy policy adopted by quality publishers is a valuable companion to upcoming changes in web-browser software. The browers changes will tend to reduce the ability of publishers to manage advertising across hundreds of independent ad networks which don't coordinate privacy policies.

Jo Ellen: In your blog piece you point out that the news system has to work with user privacy principles. Most of the conversation is about putting into place a set of systems based on opt-in tracking but it is not clear how the principles will impact the opt-in tracking and consent management. I'd like to hear more about that.

Don: The incentive from the browser side is clear for independent browser businesses that don't have a surveillance marketing business attached. What is it that a big incumbent browser will have trouble doing but that users clearly want?

Extensive user research indicates that users prefer a browser that will protect them from having their activity in one context follow them over to another context, and they also want a clear and non-confusing user experience. So this sets up an opportunity for browsers. They can compete over who can best manage user data in order to meet people's norms and preferences on how that data is used.

Browser management decisions being made day to day are based on how to acquire users, and keep users once they are already running a browser. So what are the side effects of this new browser competitive area? Why are publishers going to need to be concerned about it, and where can they get some sustainable advantage from it? And the answer is that when user data gets managed in accordance with users' norms and preferences, then sites that are trusted by users to use their data have an advantage over untrusted sites. And the biggest place this will show up immediately is in ad fraud, because the way that fraud bots work is they leak user data from high-value sites to fraud sites. They do exactly what the mainstream browsers do today in facilitating tracking the user from high value sites to low value sites.

Can the platform that connects permissed data function now without anything more than GDPR or do you see the need for more detailed privacy protections?

There is a need for comprehensive privacy policies across sites because it is prohibitively expensive for small news organizations to keep up with all the details of all the privacy tools and requirements across every possible tech platform and jurisdiction. One major US publishing company was unable to do GDPR compliance for their sites so they ended blocking a whole bunch of US news sites for European visitors.

When I see a site that isn't able to comply with GDPR, I see a site that is getting its clock cleaned by data leakage. Every single person using that site is getting their data leaked out to other places so they can get reached without the original publisher getting any benefit from it.

If you can't even do GDPR as a big publishing company how are you going to be able to do California, Europe, and India as a small independent web site, or do clean user-data collection across Firefox, Safari, and other browsers out there?

This is good. We are talking about creating trusted news sites based on the way they work with user data.

The ways users indicate trust with a site are potentially all over the place. They might say they trust their local public radio station by pledging and getting a coffee mug. They might indicate they trust their local news site by filling in a traffic survey saying what neighborhood they live and work in. A user might indicate trust for a site by leaving a comment or a letter to the editor. Many different platforms all have a small view into user trust and all have an opportunity to capture some kind of consent for data use, but there's no good way to integrate all those. And if you do it through a conventional surveillance marketing mechanism you may be doing it in a way that doesn't even capture consent. User data without consent is not going to be sustainable on a regulatory or technical basis.

Your typical news site has 50-70 third-party domains showing up on it, and every one of them has a separate privacy policy, all written by different lawyers with the objective of staying out of trouble while giving you the least privacy possible. So if you are a publisher running some skeevy tracker on your site without the right consent, future browsers are going to look at that and say there is no way this user has given consent to this firm from a dark corner of the Lumascape, I'm not going to reveal any user data to that firm.

So what you end up is news sites with reputable content not having the right consent bits set in order to be able to prove that they have a valuable audience. We saw this with GDPR and unconsented impressions coming into real-time bidding platforms. Some of those impressions are coming in without the right consent bits set which means they aren't going to get bids from some advertisers. Even users who trust the site are not producing ad impression value for the publisher they trust, and that's a big problem. That's the first thing that publishers are going to be concerned about with browser privacy improvements. Without all the non-permissioned data we are used to seeing attached to the impressions, those are not going to have much value. Publishers are going to be selling remnant impressions on a quality site because they don't have the data.

Let's imagine we have a way to collect opt-in data from a variety of different news sites, and also the merchants and apps that supply those news sites with services. It provides uniform opt-in rules to gather that data and then is able to serve those opt-in users with different types of content. Sort of an opted-in Taboola. If that kind of platform were created would there still be a need for privacy policies as well, or would the consent management system replace that need for the privacy policies?

Consent strings in Apple Safari are managed like any other tracking state would be. So the platform has to be aware of the policies and limitations of all the privacy tools that feed into a user data collection opportunity. Privacy Badger is a niche tool. They look for a specific third-party tracking policy. That is not as important for mainstream adoption directly but some of the list-based tools out there like Disconnect, which Firefox feeds off, can be informed by trackers detected by Privacy Badger.

A common policy has a real role because it lets you address incompatibilities one at a time instead of having a big n by m matrix of site privacy policies and privacy tool policies. It is kind of like open source licenses. If you go to build a project and want to keep your licenses compatible, it is way easier if you have a single software license across that ecosystem or at least a set of compatible licenses.

That is super helpful.

This platform needs to come into existence in an incremental way. Many local sites are signed up with Google and use Google Tag Manager for their ad serving. Google has a lot of the needed functionality built out for their European customers, so the process of moving from unpermitted user data sharing to permission-based user data sharing can be done incrementally if you work it the right way.

Sites can use the Google tools according to their design, taking features that have been developed for compliance in Europe and applying those features to another need, like an off-label use for GDPR compliance features. It's like discovering you can cure some ulcers by taking a specific dose of antibiotics. This is a big opportunity for Google as well.

There is a need for a comprehensive policy because it is too complicated to do it across all the platforms, and even if there is a private label way to create some kind of opt in, how do you rely upon consent management? Like an open source license, you need a privacy policy that gives a you common language that allows you to cross all these different juristictions, tools and browsers.

Yes, and when this common policy is out there and able to be part of a discussion with tool and browser developers, that policy will inform the future decisions made by those developers. People will say I don't really want my tool to block permitted data sharing with trusted sites, how do I make my tool better reflect what the users are doing?

For more info

Multi-stakeholder convening process to develop consumer-friendly privacy policies and standards, organized by the Local Media Consortium, the Internet Society, and the Information Trust Exchange.