A confluence of technological and legal developments may usher in significant changes to the multi-billion dollar digital advertising industry.
The online advertising ecosystem is currently dominated by targeted behavioral advertising—the practice of tracking people’s online behavior across websites by placing cookies or other trackers on their devices, building a profile based on their perceived interests, and then delivering personalized ads to them based on such profiles.
The backbone of the industry, as currently configured, is the use of third-party cookies and similar tracking technologies. When a person visits a website, a third party—with the permission of the website’s operator—may embed a tiny text file, called a cookie, in the browser. This cookie will then track the person’s online conduct, including other websites they visit and what they do on those sites (e.g., what products they purchase or evaluate), in addition to queries they enter into their browsers.
With data about the individual’s online activities in hand, digital advertising companies can deliver advertisements targeted to the person’s interests.
Commercial Trends to Limit Online Tracking
At the same time, Apple’s Safari web browser, several smaller web browsers, and a handful of search engines are already offering consumers the ability to block advertising cookies and cross-site tracking by default. One company, Brave, is seeking to further upend the digital advertising model by sharing ad revenue with users that opt in to view advertisements.
In the mobile application space, Apple’s new app tracking transparency framework now blocks devices’ identifier for advertisers by default and requires customers to affirmatively agree to tracking. The consent mechanism is prominently displayed in a large pop-up screen and asks if the user wants to allow the app to track their activity across other companies’ apps and websites.
Apps on Apple’s App Store also must now disclose data the app developer links to a user and what, if any, data it uses to track users. Google recently announced it will soon require Android app developers to make similar disclosures about how they collect and share user data.
Consumer choice is also at the center of efforts undertaken by the Global Privacy Control project, a group of technologists, researchers, and consumer advocates working to develop a technological specification that would allow users to set privacy preferences for all websites and apps they visit, across all browsers and devices.
New Legal Requirements Mandating Advertising Opt-Outs
These private sector developments come in the wake of new data privacy laws passed in California and Virginia. Beginning 2023, both laws, the California Privacy Rights Act and the Virginia Consumer Data Protection Act, will give consumers the right to direct businesses not to allow their personal information to be shared with third parties to deliver targeted advertisements.
These opt-out rights do not specifically prohibit businesses from engaging in first-party advertising, that is, delivering targeted advertisements based on information obtained from a business’s own website or app. Yet, in practice, the ability to conduct first-party advertising may arguably also be at risk because both laws give consumers the separate right to opt out of certain consumer profiling activities. Further regulatory or interpretive guidance is needed to better understand the scope of these profiling opt-outs.
Pressures on third-party cookies and other forms of internet and device tracking do not necessarily signal the end of targeted advertising. Businesses are adapting. In just the last few months, several companies have announced plans to monetize data collected about visitors to their own digital properties.
For example, while Google will remove support for third-party cookies that allow digital advertisers to serve ads based on individuals’ unique behaviors across the internet, it is testing a product that will offer to sell ads using information about groups of individuals with similar interests based on data gleaned from their use of Chrome and Google-affiliated products (e.g., YouTube).
Similarly, Adobe has a new software platform that will allow businesses to deliver targeted ads using data collected through Adobe products.
Changing business practices and new privacy laws are putting the squeeze on targeted behavioral advertising as we know it. But these changes present opportunities for innovation in the digital advertising industry.
This column does not necessarily reflect the opinion of The Bureau of National Affairs, Inc. or its owners.
Garrett Lance is an associate in Sidley Austin LLP’s Washington, D.C., office where he focuses on privacy and cybersecurity law.
Sheri Porath Rockwell is an associate in Sidley Austin LLP’s Century City office where she focuses on privacy and cybersecurity law.