By using 'legitimate interest', online publishers and vendors are playing Russian roulette with their users' data, writes Stuart Austin, digital consultant, ConsentEye. Now GDPR is in place, many publishers and tech vendors are banking on 'legitimate interest' to cover their use of data processing rather than seeking explicit consent from their data subjects. This obviously requires less work on their part, and little or no change to their current systems, but could see them being liable for big fines.

A large number of digital companies have opted for consent as their preferred method of justification. The legislation states that no one of the six justifications that are available for using personal data is better than the rest. But for the purposes of the advertising industry, particularly with regards to programmatic advertising, there is really just consent and legitimate interest as a reason for using data, as none of the other reasons are relevant.

Some vendors that have a contract with their users, probably via an opted in email, have had trouble with their programmatic revenue, as their contract doesn’t pass their consent status into the bid request. This has seen their impressions attract lower bidding rates in the ad exchange, leading to significantly reduced revenues. Although, with the drop in campaigns seen since the legislation was implemented, and a number of non-EU sites shutting their doors to EU traffic to try and remain safe, this doesn’t mean 'no fill', just less fill and lower yield.

Google has played chicken with the IAB, trying to railroad the vast numbers of its users to use its own system – only to have to bow down and integrate into the IAB framework. Although, as they have insisted on being a joint data controller with publishers using their DFP ad server and sharing their users consent, they have still seen a spike in revenue through their AdX SSP, as they have consent when many others don’t. This approach has angered some publishers and may see others following Axel Springer in abandoning the Google ship, although only time will tell if that comes to pass.

Retargeting specialists have seen the biggest hit to their business, with some arguing legitimate interest as reason for using people’s data. Whether this works for them remains to be seen, as without users' data they would have no ability to retarget them based on their online behaviour. Given the general public’s sense of disquiet about being followed round the web by the pair of M&S slacks that they looked at over lunch, and the lack of understanding about how retargeting works, it’s not likely that enough will opt-in at a rate that will make retargeting a viable business plan for the long term.

Looking at the risks from both fines and reputational damage, consent is clearly the safest option for all players in the ad ecosystem. Publishers need it to vouchsafe their ability to run advertising and make sure that their programmatic revenue stream doesn’t get dammed. On the ad-tech side, the stakes are even higher. With DSPs looking for consent in the bids between all parties, the volume of available impressions and vendors that can be matched has seen a big drop. The vendors are naturally nervous about how to proceed; but as more players secure consent, it is likely to be the oil that eases the current seizure.  

The sooner movers in the market adopt consent, the sooner they can move back into the fast lane.