Publishers frequently ask us whether they’re really responsible for their vendors’ use of user data, particularly if they use a consent management platform (CMP) or are participating in an IAB privacy framework. The short and inconvenient answer is “yes.” We'll explain why and then show you some solutions you can implement today.
You may have noticed an increase in privacy enforcement activities by European Union (EU) courts and regulatory agencies: there have been several large fines issued to publishers for privacy issues related to inappropriately sharing user data or failing to ensure that vendors were complying with the General Data Protection Regulation (GDPR) law. As a result, it is more important than ever for publishers to manage the data flows, and especially the vendors, on their sites.
The GDPR restricts businesses from tracking EU citizens without a valid legal basis. In practice, publishers usually rely on Consent, and their ad tech vendors usually rely on Consent or Legitimate Interest as their preferred legal bases. To put it briefly, EU users must be offered notice of data collection/processing practices, and be given a granular (purpose-specific) opportunity to opt-out or object to this data collection and use.
The GDPR only went into effect three years ago, and enforcement actions are slowly but consistently catching up. Not surprisingly, we’re starting to learn more about how courts and enforcement agencies interpret publisher obligations under the GDPR, and publishers will want to take note of what this means for them.
The GDPR assigns responsibility for compliance to every member of the supply chain, including publishers and their vendors. The EU regulators were clear about their intentions in drafting the GDPR: they will pursue any organization regardless of size.
European regulatory and enforcement agencies have made it extremely clear in recent years that publishers can be held responsible for the actions of their vendors. Let’s review just a handful of the applicable cases.
The CNIL confirmed that publishers have “a share of responsibility” for their partners’ cookie placement, and clearly stated that publishers cannot allow vendors to place cookies before consent has been established. What’s more, the CNIL pointed out that it does not differentiate whether the cookies originated from Le Figaro or their partners, therefore holding the publisher responsible for 3rd party cookies delivered through their site. In addition, it found that publishers must ensure that their vendors are respecting user choice. Despite the CNIL being located in France, 60% of its judgments have applied to companies outside of France.
Insights provided by EnforcementTracker.com
The following statistics show how many fines and what sum of fines have been imposed per month so far. The first overview contains a cumulative summary, that is, all fines accumulated up to each month. The second overview contains the sum and number of fines per month.<
Note: Only fines with valid information about year and month that are already included in our database are taken into account.
The cases above highlight a clear trend of EU regulatory bodies toward holding publishers accountable for the actions of their vendors as well as for obtaining appropriate legal bases for data processing on their behalf.
Publishers’ vendor contracts won’t protect them from being fined if a data processing vendor allows data leakage, misuse of the user data, or even when an ad tech vendor drops a third-party cookie on a user through the publisher’s site before confirming consent. In the above cases, the non-compliance issues were related to the vendor’s actions or mishandling of the data, leaving the publisher (the data controller) liable for sanctions.
The above examples of fines and judgments make it clear that regulators see adtech and their publisher partners as needing to step up their privacy compliance game. Enforcement authorities look at what is actually happening on the publishers' sites.
Privacy compliance is challenging, but it doesn’t have to be costly. Here’s what you can do to minimize your risk:
Confiant’s mission is to make the digital world safe for everyone, and that includes helping our publishers protect themselves from privacy risk.
Privacy Compliance by Confiant examines a publisher’s site in real-time to identify whether ads respect the user’s preferences and the expectations of the law, mirroring (but going far beyond) the techniques used by regulatory enforcement agencies to root out non-compliance. If an EU citizen reaches the publisher’s site and has not consented to tracking, the record of that consent mismatch is reported to the publisher in their dashboard, empowering them to understand any violations, identify which entities are non-compliant, and address the issues immediately. Publishers have the option to receive alerts about non-compliant ads or block them automatically, providing an added safety net for the publisher. It was designed to provide the information and controls that publishers need. Even the smallest of sanctions in the examples above far outweighs the cost of the solution that could help publishers avoid the penalties.
Publishers that are interested in Privacy Compliance by Confiant can go to www.confiant.com or request a free trial
For more information: #DataPrivacy #Publishers