← The Monopoly Report
The Monopoly Report
Episode 70: Ad Tech at a Turning Point with Allison Schiff of AdExchanger
00:52:34
Loading summary
Transcript102 lines
- [00:01]
A
This is adtech God and if you know me, you know I love Miami. And if you're heading to possible event in Miami on April 27th to the 29th, then you already know the sun is hot and so is our content and our events. Preach on the beach and the annual AdTech God events are back and the whole crew is pulling up. Arie, Jeremy, Sam, Hannah, Amelia and of course yours truly, Ad Tech God. If you want hype, visibility and your brand letting up socials, newsletters and group chats, this is your moment. We are talking premium exposure before, during and after possible Miami energy industry leaders, real conversations, serious buzz spots move fast so you need to get in touch with us now. You can contact us@marketecturemedia.com Go to the Contact Us page and use the dropdown Possible Event. See you there. This podcast is brought to you by audiohook, the leading independent audio dsp. Audio Hook has direct publisher integrations into all major podcast and streaming radio platforms, providing 40% more inventory than what could be accessed in omnichannel DSPs. What's more, audiobook has full transcripts on more than 90% of all podcast inventory, enabling advanced contextual targeting and brand suitability. Audio Hook is so confident that in addition to CPM buys, they offer the industry's only pay for performance option where brands can scale audio and podcasting with peace of mind, knowing they are only paying for outcomes. Visit audiohook.com to learn more. That's audiohook.com. Welcome to the Monopoly Report the Monopoly Report is dedicated to chronicling and analyzing the impact of privacy, antitrust and other regulations on the global advertising economy. If you are new to the Monopoly Report, you can subscribe to our weekly newsletter@monopoly-report.com and you can check out all of the Monopoly Report podcast @monopoly report pod.com I'm Alan Chappelle. I'm a privacy and regulatory attorney and have worked with hundreds of digital media and adtech companies over the years and taken a bunch of those companies to successful exits. I also publish a monthly regulatory outlook for digital media worldwide called the Chappelle Regulatory Insider. You can find a link to a sample copy of the Chappelle Regulatory Insider in the show Notes. Today's guest is someone whose byline you've almost certainly read if you follow the ad tech and privacy space. Alison Schiff is the Managing editor of Ad Exchanger, where she covers privacy, measurement, a little bit of meta, the app economy, and whatever random ad tech stuff she finds interesting. Alison received her MA In Journalism from The Dublin Institute of Technology in Ireland, her favorite place. And I'm with you there. And BA in history and English from Brandeis University in Waltham, Mass. She's got a black cat mermaid and a red Australian cattle dog, and one or the other may make an appearance on this podcast somewhere in the background. I'll look forward to that. I want to discuss Alison's recent piece on the recent RFI request that ICE made to a bunch of ad tech companies and commercial data brokers where ICE had asked those companies to describe their capabilities for immigration enforcement purposes. What struck Allison wasn't who responded. It was who went silent. Allison is sharp, candid, and genuinely funding. I think you're going to really enjoy this one. So let's get to it. Hey, Alison, thanks for coming on the pod. How are you?
- [03:49]
B
Oh, yes. Salute emoji. I'm good. Just busy living the dream.
- [03:54]
A
A lot of. A lot of stuff going on here in the ad space, which is. Which is kind of great for us, but it also becomes a little maddening and maybe even exhausting at times.
- [04:02]
B
We're at this interesting point, and I experienced something similar when I worked at a CPA Society's newspaper. It was the New York State Society of Certified Public Accountants. I wrote about public accountancy for a bunch of years, and it was.
- [04:14]
A
Right. I'm sorry, I'm already asleep.
- [04:16]
B
I know. It's such a long. The New York State Society of Certified Public Accountants. It was called the Trusted Professional. That was the name of the newspaper. And they launched it because cpas has such a bad reputation after Enron. And we just spent a lot of time writing about Sarbanes, Oxley and also New York State tax law. But it was a strange moment for that industry because there was so much scrutiny on CPAs. And who cared about CPAs before, unless they were CPAs. So we're having that moment now. There's so much scrutiny of. Of online advertising.
- [04:48]
A
Oh, for sure. You know, before we get into the real juicy stuff, I would love it if you shared a bit on your background. How did you get into the digital media space? What fun story can you regale us with? I mean, no pressure.
- [05:00]
B
I just fell into it, really. I think a lot of people who end up in the trades fall into it. I studied journalism. I studied abroad in Ireland. It was just for fun because I wanted an excuse to live abroad. And then I graduated right into the financial crisis. So I moved back home and I'd apply for jobs in. And I freelanced for my local town's newspaper. Like the one that shows up for free on your doorstep. And then I just watched Six Feet under with my dad on Blockbuster DVDs through the mail, which dates it. And yeah, I mean I, I remember sitting in on an editorial meeting at Ad Exchanger right when I started. I kind of meandered here. So I wrote about CPAs. I was a medical copywriter for a textbook publisher for a while and then also direct marketing news, if anyone remembers that publication, DM News. I was there for years.
- [05:54]
A
I didn't. So we. I don't think we overlapped. There was a time in maybe 04 and 05 where that was one of that and imediate connection was like. Whereas I was trying to build my little profile here, I wrote a whole bunch of stuff. Ken McGill I think was the name of the editor at the time. So that, that may. Yeah, that's it for dates.
- [06:13]
B
We just by a little bit, not by that much. And that's actually where I met Ryan Joe, who is the editor in chief of adweek now. And when he left dmn, he went to Ad Exchanger to be a senior editor. And when they had a job opening, he told me about it and I applied and I got the job. I've been there ever since. But I was going to say that I remember sitting in on an editorial meeting right at the beginning and Ryan and everybody else was speaking so fluently about DSPs and SSPs and RTB, and I literally had no idea like what the hell they were talking about. And I just, I recall thinking, I am so screwed. I just. I don't know how long can I fake it before they realize that I have no idea what they're talking about? But. Yeah, it's been almost 13 years. I still don't know what some people are talking about, but.
- [06:58]
A
Yeah, but that's, that's increasingly about them and, and not about you. There's, there's a lot of that. Well, people are just really good at talking in this space and then they, they, if they use the word salad, they think they can. And you know what? For better or worse, you can get pretty far in your career by going down that route.
- [07:14]
B
I mean, salad, Salad is good for you. Word salad is bad for you.
- [07:18]
A
I agree. So I have been wanting to have you on for a long time and there were so many different topics that I was thinking about having you come in and speak to. But then I read your piece on data sales to ice and your piece opens with a pretty striking observation that your inbox, which is Normally overflowing with pitches on everything from CTV to AI. It went completely silent after the ice RFI dropped. And I'm curious, what do you make of that silence?
- [07:50]
B
I mean, you'd think it would be the same as what would happen for other news events. People just racing to offer commentary, at least from companies that aren't participating. Like, here's our company, Stan. Like, here's why we wouldn't touch this, or actually even, like, here's why we think we can engage responsibly or whatever. And when I read about the rfi, I wanted to write about it, but I got busy and I kept putting it on my to do list. And often when I do that, a reminder to get off my ass is the deluge of emails that I get. Are you writing about this? Are you writing about this? And I just realized that was the story. And so I kind of read at least for how we. We were going to cover it. And I read that silence as kind of like a collective flinch almost, you know, like, I think people inside these companies understand how this looks like from the outside, and they don't want their name or their logo next to a headline about, like, ad tech tools being used for immigration investigations. But that said David Nuremberg, if you know him, he wrote a column for us about this whole situation more recently, it was early March. He's the SVP at Intermedia and focus on Digital media. It had a great title. The privacy zealots were right. Zealots in air quotes. Ad tech's infrastructure was always a risk, and I think he put it really well. And it was. It's a point that I tried to make too, which is that in our industry, incentives shape behavior more than like a public statement or ol meaning buzzword would ever do.
- [09:26]
A
But.
- [09:27]
B
But it's easier to stay quiet and to keep your options open and then to hope that no one asks you for, you know, an on the record comment about what you're willing or not willing to do. So the evidence, or the silence, I should say, is not evidence that people don't care. It's like evidence that they care enough to be nervous and not take a public position.
- [09:48]
A
Yeah. And there's a lot of people out there who don't entirely know where the bodies are buried within their own orgs. And so there's. There's a little bit of reluctance and there's also a sense, and, boy, I'm using two tired analogies in a row. So go, Alan. Everybody's living in a bit of a glass house and so there's this like, if I get up there and start railing that you guys need to stop that, you know, somebody may say, hey, by the way, your company responded to the RFI and here's the info. And you may be unaware of that. And so it's sort of, I think, easier to just do and say nothing. But I like David's turn there because I think there is something, I think there's something that, and I've talked about this a bunch over the last year or so, like the tinfoil hat folks who I used to kind of make fun of, I think have a point. And I think that we collectively at least need to admit that. And I think particularly with respect to precise location data, because I just don't think you can ignore the number of bad things that are not could, but are happening as a result of certain uses.
- [11:01]
B
Before we talk about location though, because I know you want to get into that. As you were speaking about glass houses, I was thinking about how I cover the privacy beat and sometimes come off a little bit scolding, talking about, you know, how the opt outs work or how you get permissions or cookie banners or whatever. And sometimes it's really embarrassing, but it happens. Someone will be reading one of those articles on our site and they'll go on addiction.com and they'll get like a pop up that doesn't look compliant and they'll screen grab it and they'll put it on LinkedIn and like, oh right, yeah. But then it, it's in stark relief to me that I am doing my thing, I'm writing my stories, I have my beat and there's a whole Ad Ops team and all of these people that are doing the implementation of that kind of stuff. And so there is kind of a divide and not enough communication. And so you can make statements like that and get on your high horse and then look a little silly.
- [11:59]
A
Yeah, but, but you know, there is supposed to be a separation between the editorial side and the business side for sure, sales.
- [12:07]
B
And so like I would love to be more compliant.
- [12:11]
A
Fair enough. It's funny, I had a back and forth with the Cal privacy folks because there was a time where their website had a couple of like, I don't know, LinkedIn pixels or whatever that weren't operating under the CMP. And like, you know, that stuff is kind of embarrassing, but it also just goes to show how hard it is exactly to maintain this stuff. But also a couple of LinkedIn pixels, in the grand scheme of things aren't what we're talking about here. What we are talking about is people being pulled out of their homes because of information that, that ICE was able to obtain. And like to compare those two things. I'm not saying you're doing that. I'm saying others are.
- [12:50]
B
I am not.
- [12:51]
A
Yeah.
- [12:51]
B
For the record.
- [12:52]
A
Yeah. That seems kind of disingenuous.
- [12:55]
B
Yes. No, I'm not really drawing a comparison. But, you know, it's, it's more to the point of getting out there and speaking up can be tricky for a few reasons. Not, you know, least of which you can. You get called out for potential hypocrisy and no one likes that.
- [13:14]
A
See, I think that's a badge of honor because you're saying uncomfortable truths and that's really, really valuable because we have a shortage of people willing to do that around here.
- [13:26]
B
I'm also lucky because I have, you know, it's. Our readership is, you know, pretty niche. But I have a bully pulpit from which I can, I can pronounce things. And when it feels write and I get the green light, I like to use that to make points that I think are important. So not just covering the product announcements, but writing op eds. And I encourage all of our writers to do the same. And I think we're one of the only trade pubs out there that really regularly publishes thought leadership. And it's a lot of work to vet it. I think it's really important because these are the voices that are shaping the industry. Of course, sometimes people try to submit things that are thinly veiled or not so thinly veiled sales pitches. It's hard to really get some, like, strong opinions, but we try.
- [14:14]
A
Well, good, and kudos to you because I do think that stuff is, is. Is really, really important. So you had described on LinkedIn that, that there is a kind of a reaction, and I'm going to use air quotes here, that it was sort of like social media venting and it was more that than sustained discourse. What would meaningful industry engagement actually look like in this context? Is it related to the dearth of sophistication on privacy issues more generally within the business community?
- [14:43]
B
I don't want to dismiss, by the way, the people that took to LinkedIn and, you know, made their statements. You know, it's good that people were a little disturbed by this. But yeah, I, I think I made this point that that kind of venting is costless. Like it doesn't really commit anyone to anything. And so I guess meaningful engagement would look like taking like a really public, specific position. You should say we won't provide granular location or behavioral data for immigration enforcement, period. Like, that's not a crazy thing to go out there and say. Or, or, you know, if you want to mitigate it a little bit, like, we'll only participate under XYZ safeguards, you know, and here's what those are. Yeah, but I mean, I think it would also include the trade associations picking a clear lane or. Right. I mean, apparently they're debating this internally, but emerging from those conversations, you'd want, like a clear stance and then publish that. And even if not every member is thrilled, like, that's okay. And I also think vendors should acknowledge that there is a level of responsibility here. And David makes that point in his column. You know, there's a level of honesty. You need to acknowledge that the very design of addressable advertising created the exposure that makes ICE's interest, you know, possible.
- [15:59]
A
No, well put. And I, I agree. I, I know that the various orgs are deliberating, and I also know it's, you know, always difficult to herd cats, particularly on a thorny issue. But a simple statement that we will not sell, you know, browsing data to the government, not crazy, I think would go a long way and I would argue probably doesn't implicate that many companies. And if it does, then there maybe needs to be a discussion about that.
- [16:29]
B
I will say it's even hard to herd cat. I just have one and it's challenging.
- [16:35]
A
Yeah, those guys just do whatever the heck they want. So you had noted that the RFI was framed as market research and not yet a solicitation. And I'm curious if that distinction matters. So, you know, for example, the ICO in the UK and the CMA and even the ftc, they'll routinely have broad inquiries to better understand the industry. Is this different because it's ICE related?
- [17:01]
B
I do think it is. I mean, I think the label matters because it's not a contract or even a bid for business. It's just fact finding at this point. So you can kind of say, oh, it's not as big of a deal as someone putting out a bid for business. But, like a. You don't issue an rfi. Like, this is a purely academic exercise. Like, you do it to map capabilities, to see who has what, to see how mature the tools are and, like, what they could do theoretically or not so theoretically. So it's all laying the groundwork for a real use case. And so, like when the ICO or an entity like the FTC launches, like one of those broad inquiries, it's to understand a system, but it's really to like constrain it or to oversee it. And when you're an enforcement agency like ICE or you know, ICE under dhs, when they're asking, it's to understand a system so they can potentially operationalize it and make it part of its investigations. So I think, you know, that the formal distinction that this is just research and not like an RFP doesn't really change the ethical question for vendors. So you really just have to ask yourself if you're comfortable helping an immigration enforcement agency evaluate how to use commercial ad tech and location data. And you know, for a lot of people outside the industry, that's not a subtle question, but it somehow becomes like this nuanced and subtle question when it's your business.
- [18:22]
A
Okay, I agree with that. But it actually might be worse because you were, you were educating ICE on how all of this stuff works. So if you raise your hand in that RFI now, you can say, well, you know, we're probably not going to sell to them anyway. Okay, well fair enough. But you've now educated them on it and how long is it going to take them to start subpoenaing in the name of law enforcement, these types of records anyway? And so I don't know that it's even a smart long term strategy, even if you're thinking, well look, we're just trying to be good, you know, good soldiers here and, and so we're going to provide this information. Well, you may regret that decision down the line. I'm not here to provide legal advice, but that seems rather risky. It's almost like going to like the SEPA plaintiffs and like, you know, opening up the kimono and tell, you know, that's going to come back and bite you pretty quick. And few would do that. But I don't know the people are quite connecting the dots to, you know, the government is just as likely to be as big an adversary to this space as anything.
- [19:30]
B
That's an excellent point. Right. It doesn't even have to progress to RFP stage. Like the RFI is enough.
- [19:36]
A
So the ad space has fought hard against the surveillance advertising label. I remember 2023, David Cohen and Alm had called the that term, you know, insane. And I guess my question is, is like, and I probably should have David on and ask him this question, although I'm pretty sure he's not going to answer it. You know, does the ICE RFI make that defense harder to sustain?
- [20:01]
B
I think it makes it harder to sustain with a straight face. I mean, you can argue about definitions like you can say you're literally not being tailed by a private investigator or being watched, like with someone's eyeballs, but, you know, when an arm of the Department of Homeland Security is explicitly exploring how to use big data and ad tech tools to support their investigations, then it just looks a lot like the future that critics were warning about. And it also, it kind of, it reminds me of something I heard someone say. A lot of people have said this, which is that when you wear your tinfoil hat, right, and you're a conspiracy theorist, but then all of the conspiracies start to come true, then you're just a realist. So, I mean, you may dislike a slogan, right? You might not like the term surveillance advertising, but then that's fine. The onus is on you not to say I don't like it. And you know, it's too extreme. Explain why that system that by design tracks people across apps and locations, explain why that is now firmly on the radar of an enforcement agency focused on immigration and why that shouldn't be understood as enabling a surveillance like infrastructure. I mean, I don't know, I don't mean to sound, you know, so scoldy, but it seems obvious to me.
- [21:19]
A
Yeah. And so for those of us who are attempting to have, you know, open discussions with policymakers like a Tom Kemp, like folks at the ftc, all of this stuff makes it so much more difficult because I'd like to be able to push back on the surveillance advertising moniker. But boy, this certainly makes it hard. Like I can't defend this. And I'd like to think of myself as, as big an advocate, you know, for the, the small to little ad space as there is out there. And yet I, I don't know what to do with this. And that has a cost because that enables, you know, the, the, the Lena Khan's of the world. And no disrespect to, to, to Ms. Kahn, she's brilliant, but she was, I think, the one who really popularized that term. And it, it just gives ammunition to that mindset. And I'm sort of at a loss, to be fair.
- [22:14]
B
I don't know the names of any companies that responded to the rfi. I just know that some did. And so in a way, you could argue the existence of the RFI is not a company's fault. Right? I mean, yes, the infrastructure exists, but they're also just existing. And now someone at ICE was like, ooh, maybe I can use this. And you're just sitting there like I'm just trying to sell toilet paper. But the infrastructure is the infrastructure. It caught their attention for a reason.
- [22:41]
A
Okay, so location data brokers have been in regulators crosshairs for years. Years. So does the ICE RFI suggest that regulatory pressure alone isn't enough to change behavior?
- [22:53]
B
Yeah, I mean, I think. Well, for one, it's a reminder that enforcement is always going to just be playing catch up with business and business innovations and business incentives. And I mean, we have seen the FTC and then a few state AGs bring cases against location data companies or brokers or whatever, but it doesn't really, like, none of this removes the profit motive. I don't think it does. So what this RFI shows is that even with regulatory heat, the underlying infrastructure is very much there. Like we were just saying, it's very attractive, or at least attractive enough that the government is looking for ways to plug into it. And that's like what privacy advocates like Johnny Ryan and Max Trems, that's what they were talking about. Like if you create big pools of data, like governments will want to access it and like, just because the original use case was to target you with an ad for a trip to Cancun or a pair of sneakers or whatever, like that has nothing to do with it. Like the use case you have in mind isn't necessarily the use case that other entities have in mind. So I, yeah, I mean, I don't think it's enough to change behavior.
- [24:07]
A
I'll note. And look, it's hard sometimes to draw a straight line, but I think it's a fairly reasonable inference to say that that law that passed very quickly in Virginia, which is banning the sale of precise location data, you've got a similar one in Maryland and one in Oregon and like we're one or two more dominoes from falling to the point where I don't know that there's going to be a location graph business to be be had. And if I were running one of those companies, you know, the heck with the industry associations, I would be jumping up and down and saying we are not going to do this. We think this is beyond the pale. And you know, whether or not that's going to, you know, undo some of the damage being caused to the industry, you know, by laws like Virginia's, I don't know, but that seems like as good an approach to any to maybe stopping the bleeding.
- [25:00]
B
For sure. I think that regulation is necessary. I just don't know if we're not going to get anything Federal forever. And there's just this ethos that still exists despite all of these mandates for data minimization that you should collect more and share more, you know, and that's what the business model like requires and what it rewards. And so you're going to have this sort of like gravitational pull toward those uses that like regulators and you know, the creators of certain technologies, they might
- [25:31]
A
not have anticipated it EU style consent but you know we're now, we've even crossed past that. We're into, we're into prohibition and so like I don't know what those could these companies, these companies do. And by the way there was an initiative, it started in the Mobile Marketing association and then the NAI ultimately took it over a couple of years ago. Duncan over at Place IQ I think was leading it but it was, you know, we're not going to target or we're not going to create sensitive locations and like it was a start but I don't think it went far enough. So I don't know that I have a question in there which I sometimes do rather than. So if you have a reaction I'd love to hear it. If not we can just jump onto the next, next question.
- [26:13]
B
No, just it, it was an, I guess a nice start but if you just have a few meetings and you know, agree on a few things and they don't really translate into practice, it does seem like a lot of the protection has to happen upstream like at the prohibition level because just asking people a million questions in the moment, that doesn't work. I mean it's, I don't have the right answer. There have been so many FTC workshops about this and I've seen so many panels about this and you talked about it with Mark Metter at markitecture. Like the cookie based opt outs, there's just no great, there's just no great answer. And asking people every two seconds for permission to do every manner of thing is also not the solution.
- [26:56]
A
I love the discussion with Commissioner Mad or I was grateful that he came on. I was hoping that we could get him to maybe give a nudge regarding opt out mechanisms and but hopefully that nudge is going to have to come from a different place because boy do we need it. And I don't know that GPC signals are the answer but you know, my understanding is that opt outs via cookies persist for a grand total of what, 30 or 45 days on a good day. That's not good enough and I think we need to acknowledge that.
- [27:29]
B
Acknowledged. I don't Know what the answer is though?
- [27:32]
A
Yeah. Well, there's GPC signals and like we can go back to the do not track wars.
- [27:37]
B
I suppose I was going to say it just feels like another version of DNT and then you have to enforce it, but. Or what?
- [27:43]
A
Well, I think. Or we can get the folks at Cal Privacy who have really been leading the charge on GPC to at least recognize that there are potential anti competitive impacts around allowing a browser who has their own ad product to decide that their ad product is not a sale, but somebody else's is a sale. There need to be some criteria around that. And because, you know, say what you want about the do not track days, back then there was at least a plausible argument that a browser was a user's agent. Now, and I'm not here to beat up perplexity, but they have made very clear that they see their browser as a piece of software that they can use to monetize users that's not a user agent. And so I think we need to understand that the browser market has shifted pretty significantly. We'll see. I've, I'm, I'm providing feedback to Cal Privacy. I know a bunch of other folks are. We'll see where they land. I think there's a tendency in regulatory circles to say as long as it gets rid of tracking, it's just great. And I, I really hope that the Cal Privacy folks do not fall into that trap.
- [28:56]
B
Yes. Because you know, there are a lot of businesses that do good work and keep content free and all of that stuff. So it does ladder back to journalism and I care about journalism. So Commissioner Meador did acknowledge that, you know, the, the browser is, shouldn't have too much power and they shouldn't be able to make decisions that could impact not just their competitors. Because, because that's not what I'm talking about. The bazillion third parties that, you know, are trying to also just get through the day.
- [29:27]
A
Yeah, that, that's a great point. And, and, and thank you for, thank you for underlining that because. Well, and Commissioner Meddaughter is essentially a, you know, his, his area of expertise has traditionally been an antitrust law. And so he gets the competitive impact going way back around the ad space, which is another reason why it was just great to be able to chat with him a bit.
- [29:47]
B
Yeah, I liked his candor.
- [29:48]
A
I did too. No, he, he, he was, he was just great. So I, I want to shift to more of a discussion around ethics. And like I always do this with some reluctance because ethics in the ads, in the, the, the pirates, you know, bay of the ad space is, is always a little bit tricky, but, but I'm going to go for it. So the populations most likely to be targeted by ICE investigations are often, you know, undocumented immigrants, asylum seekers, or people who just happen to look Latin. And I think that those people are often amongst some of the most vulnerable. So my question is, does the ad tech industry have any obligation to consider who ends up on the receiving end of the data that it sells?
- [30:33]
B
Yes, I do. I do think it does. I mean, even if there's no law yet to explicitly spell out that obligation. Because one theme that runs through what I wrote, and also what David Nuremberg wrote, is that the online ad industry has been really good at abstracting, like, people, quote, unquote, people out of the conversation. So we talk about consumers and users and devices and maids and households and segments and all of these euphemisms, basically. But like, that device is going to be linked to a person trying to buy cereal or cross a border or seek an abortion or vote or go to a certain religious institution. You know, like a phone connects to the Internet in a coffee shop and that gets logged and shared and connected to other information. And if the person on the other end of that chain of events is someone that doesn't have enough safeguards and people, these are people who already live with a lot of like, precarity in their lives. Like, that should be, I think that should be acknowledged. And I don't think it's acceptable or really enough to say, like, we just sell data piece out. Like, we don't decide how it's used. Because the moment that you know your product is likely or could be used in ways pretty easily that could disproportionately harm people in general, but also certain groups in particular, like you do have an ethical obligation to at least acknowledge it, but also maybe like crazy to reevaluate what you collect and what you
- [32:01]
A
sell, that's a whole separate rant for me because I think that the ad space needs to embrace data minimization and purpose limitation. If for no other reason, then it allows those of us who are trying to advocate for responsible rules around privacy can have something to point to. Because in the absence of that, those discussions become much, much more difficult. And you're going to see concepts like data fiduciary, which I think is really, really difficult to enforce, and I think it creates a whole series of challenges for this space, but you're going to see those concepts, I think Take hold within policymakers and we will have nobody but ourselves collectively to blame.
- [32:46]
B
Self regulation didn't work super well, I'm sorry to say.
- [32:50]
A
Yeah, most people who listen to this know I'm the board chair of the nai, but, but, so, but just in case you don't, I just want to at least put that out there. I think that it was valuable to a point. I don't think that it evolved much past, you know, we can debate over the date, you know, you can say 2012. Maybe it was 2016, when Google just decided that, that it was going to merge all of its identifiable data with its pseudonymous data. And like, was that within the NE code? I have no idea. They just sort of did it and kind of dared everybody in the room to object. And, and when everybody in the room, you know, is getting a million dollars or more in revenue from Google, they're probably not objecting. And so there we are. And so. But we're at least a decade into the point where self reg hasn't caught up or hasn't, you know, hasn't. Certainly hasn't caught up with state law, but it hasn't evolved nearly as much.
- [33:43]
B
Yeah, it's a little bit of that milquetoast vibe that you were describing before.
- [33:47]
A
Yeah. So location data gets most of the attention here, particularly in a post Dobbs world. I'm curious, is that the only type of data that's a concern? Are we thinking health children? Just generally identifiability.
- [34:01]
B
I mean, location data. Yeah, I'm for sure all of the above. Location data gets a lot of headlines for obvious reasons. It's instantly, it feels instantly creepy to people, you know, like, I'm watching you. But yeah, I mean location is just one data point, so it's just one field in a database, albeit a pretty sensitive one, and just like one data point in a profile. And you know, if you're collecting, you know, linked behavioral data, like what sites people visit to the content they read, what they buy, what apps they use when they're active, like all of that stuff you don't really need, although it's in there like a GPS coordinate to infer pretty sensitive and personal things about them. And we saw that from the healthline decision. And so like health is a really big one. Like you don't need a diagnosis like code to know if someone is dealing with depression or fertility issues or addiction or like someone close to them might be, but you just look at what they're searching and reading and you can make a pretty clear Inference. Also, I, I feel like it's worth mentioning that a lot of ad tech companies and I've talked to a lot of ad tech companies and data companies, they way over promise what they're actually able to deliver in terms of precision, you know, whatever, one to one. But it's also true that like so much of what the industry has historically called like anonymous, like air quotes, like it's trivially easy to find out, you know, who somebody is or to make a pretty good guess if you have enough cross context data. Like it doesn't really take all that much, so it can't just be like location is not the only thing. It's just like the sharpest edge of this much larger set of questions about what happens when you build a business around data connected to people.
- [35:52]
A
Yeah. And you know, even in the health space, you know, you see people out there pitching, you know, we, we make tens of thousands of inferences around data points in a way. But it's totally HIPAA compliant. And you're like whoa, whoa, whoa, whoa. What?
- [36:05]
B
I love that when everyone's just like blah, blah, blah, blah, sell, sell, sell. And then just PS it's privacy compliant. I'm like okay, well you can't just say that. It's, it's not like just a quick disclosure and then like you magically are.
- [36:17]
A
Well that's when like you know, their privacy officer is also their director of sales or something like that. You're like okay, that's so funny. Get how important it is. Well, that way, that way, that's how you assign an ROI to privacy apparently is you just make the director of sales your, your, your cpo.
- [36:33]
B
It's all about incentives.
- [36:37]
A
But, but I, to, to your point, I think that's a, that's another sort of endemic challenge for the industry is that like we don't do ourselves any favors by over promising and under delivering and like I, you know, going back probably 15, maybe even 20 years, like Jeff Chester. And like look, Jeff is a super interesting guy and maybe not the most successful. He's not on the Schrems hall of fame in terms of privacy advocates, but he would routinely launch complaints into the FTC based almost entirely on, you know, marketing materials at ads companies. And it's sort of like you're not really doing yourself any favors by putting your product or service right into the eyes of core regulators.
- [37:20]
B
I had that thought even before privacy became a big coverage area for us. Maybe like seven or eight years ago, I would sit in industry events and I would listen to Some of the sponsored sessions, and also just people speaking on panels thinking, oh my God, if someone from, like, the FTC was here, they would just be taking some furious notes. Just so much bragging. And I don't know how totally tied to reality some of it was, but even if some of it is, it's the sort of thing that would definitely catch a regulator's attention. Not the way I think they would talk about themselves in other companies.
- [37:53]
A
Right, but. But there's a. There's a larger issue in there, in that nobody in that room understands the data flows well enough to even know if this thing is. It's not even that they don't know privacy, but they don't understand their own data flows well enough. And I think that in and of itself is an endemic challenge. And look, I don't want to be the privacy guy who says the end is near because, like, we've been doing that for 40 years.
- [38:15]
B
People tune that out, right? Like you're the guy with a cardboard placard or something, you know, like standing on a street corner. They're like, okay, here's a dollar. Bye.
- [38:23]
A
I try everything not to be that. That. That person. But, you know, there are now requirements in what, 12 states that you have to do some flavor of a data protection impact assessment and an AI assessment. And that's. In order to do that, you need to have a much better understanding of the data flows. And that is an endemic challenge within the ad space.
- [38:42]
B
It really is. I mean, I. I find it really amazing when I interview people. They're the spokespeople that are given to me to talk about some announcement, some feature release or whatever. And I'll ask, not a crazily technical question, because I'm not a technologist, even though I've been at Ad Exchanger for a lot of years. I'll ask, like, pretty basic questions. And my favorite, for example, is explain this to me like I'm five or six or whatever, or that like. Like I'm not in the industry and everyone just immediately slips into jargon and using words like leverage, like a verb, and it just becomes abundantly clear that they're reading or they don't know. It just sort of peters out and that's it. And then I just. I do my best to understand how the thing works by talking to somebody else.
- [39:32]
A
And that's really it. It sits. I would imagine covering the space is a huge challenge because it's really about sorting through the various, you know, elevator pitches to really figure out what's going On, I'm just curious, how long did it take you to where you, to the point where you felt really comfortable knowing that like the pitch you're going to get is not really how the data flow works and that you need to. Do you ever get comfortable with that?
- [39:57]
B
I don't know. I guess, I don't know. I thought your question was going to be like, do I understand this industry? I was going to be like, nah, not yet.
- [40:06]
A
Um, yeah, I don't believe that for a second. I think you've got as keen an understanding of what's going on in this industry as just about anybody. I'm not going to smoke.
- [40:15]
B
I don't know.
- [40:15]
A
I don't. Also, you like it. And I don't mean this is going to sound like a backhanded compliment, but like look at everybody else. I mean just, just by way you compare yourself.
- [40:26]
B
What's that, what's that line about like, you know, having one eye? You know, in a, in the world
- [40:31]
A
of the blind, the one eyed person is king or queen.
- [40:34]
B
There we go.
- [40:36]
A
So I want to shift gears. I just picked up a book, I haven't read it yet, but there's a book that just came out called your Data will be used against you. And so that's going to be. I don't know that it's quite on the insidification level, but that's a book that just on that title is probably going to sell and he's going to get a lot of attention and maybe at some point I even have him on. It's a GW law professor named Andrew Guthrie Ferguson. And the book looks at a lot of these issues, albeit from a fourth Amendment analysis. So in the book, Ferguson calls for judges, legislators and communities to rebalance security and liberty before the machinery of surveillance becomes too entrenched to reform. So your piece essentially issues the same challenge to the ad industry. And so I'm curious at this point, which of those three actors, courts, Congress or the industry itself? Which of those actors do you think is most likely to, to move the needle to push for reform?
- [41:36]
B
I wish I had a really good answer or like a confident answer to this question. I mean, my honest one is going to sound like kind of mushy because I think each one of those actors has serious limitations. So maybe like together they can do something, but like courts can be powerful, like they're slow and they're reactive and then lots of damage can be done before the right case makes it up to the high court. And like, you never know what a Court's going to do, or like any court, Congress, I guess in theory they could change the incentives by passing some kind of comprehensive federal privacy law. But like, that's obviously not happening anytime very soon. And the industry can move very fast, but it has a profit motive and the incentives are still there. So I mean, the most realistic near term movement we'll probably see is in some kind of messy combination. So state level laws, like in Virginia and like a zillion others, a few targeted enforcement actions, handful of companies maybe deciding that certain revenue or contracts just aren't worth it. Well, what I was trying to express the main point of what I wrote, and if I can be so bold as to speak for David Nirenberg, it's like the ad industry, any, any industry doesn't get to like wash its hands and say, like, we'll wait for someone else to sort this out or, you know, we'll be a little rah rah on social media. And then when it matters, like total silence. Like, if you've built infrastructure and you have, you know, you, you have rights, you have, you know, you live in this country, you have agency, like you can decide what business you're in. Like, the question is whether you'll do it on your own or whether a scandal or a court or a regulator forces your hand. But like, eventually I think something does have to happen. I don't think we just keep hanging out like we are.
- [43:26]
A
I hope you're right. So, just one quick thought. Every time this year, I confidently predict two things. Number one, that the jets are going to win the super bowl.
- [43:37]
B
And number two, I know nothing about football. I'm so sorry that we're going to.
- [43:41]
A
It's funny, even people who don't know anything about football probably know that the jets are just hopeless. But, but the second thing I predict is that the US Congress is going to come up with the privacy law. This is the first year I have not made that prediction. I will just make one other point and I would love your reaction. The courts are an interesting one and there's sort of a related notion here. I can say with a lot of confidence that all of the SEPA litigation that seems to be overtaking the industry is not helpful. It's not really helping consumers. It's not focusing on the right things. It's certainly not pushing for better practices. But I feel like that argument falls on deaf ears given all of the things that you raised in your article.
- [44:26]
B
It does kind of feel just like plaintiffs attorneys and they're doing their, their Payday. Although one more compelling argument to do something so that you're not a target for plaintiffs attorneys might be that it's not just about the fine. I was talking to a bunch of different people. I think I'm going to write some something about this. I think it's quite interesting that you're targeted by a class action or, you know, you get some kind of, you know, attention from the plaintiff's bar and you have to take action. Or like a regulator tosses a fine in your direction, you pay that fine and you come to some kind of settlement, but that's not it. Like you've paid tons of money and you spent tons of time and all these hours dealing with the thing. It's so much more expensive than the fine itself. So if you only care about the bottom line, like try to avoid scrutiny for that reason because, yeah, maybe like $375,000, which is a fine we saw recently. You know, that's, that's very little. You could say, whatever, but if it's $375,000 times, I don't know, 20, then that's significant.
- [45:32]
A
Well, and just you wait to see how the live ramp and the trade desk SEPA cases resolve themselves because those are the ones that, I mean, heck, you could make a compelling argument that SIPA was the last straw for Oracle Advertising because they were staring at a pretty big fire. I think that was in the hundreds of millions. And so it's going to be really interesting to see. But again, I don't know that we have an argument to say, hey, this is unfair legislature, let's reform that. Because the legislature has got to be looking particularly at. The California legislature is looking at this industry and saying, you know what, you made this bed, so now you got to live in it.
- [46:10]
B
It's tricky too though, when you see enforcement actions against. Although there have been companies that people have definitely heard of, like Ford and Disney, but there are these sort of like random companies and people are like, oh, whatever, and the fines aren't huge.
- [46:23]
A
You know, it's funny, the Cal privacy folks, I thought have done some really interesting things in terms of enforcement. And overall their enforcement and the AG's enforcement have been pretty measured. There haven't been huge surprises. And they have gone after traditional brands, which is something that has been severely lacking in industry self rag. And I'm not here to pick on the brands or even publishers, but you know, they are part of this ecosystem. And the idea that, you know, for 15 years it was almost entirely going after ad techs I, I don't think it was quite right. And so I, I want to give credit to California for, you know, for taking a look at the, the ecosystem now. They haven't reined in big tech yet but. And that was the promise. And so hopefully they get there.
- [47:09]
B
They do deserve, they do deserve a lot of credit, but. And they also, it's not been a gotcha like none of these have been. They should not be surprising really. I mean they've told you like, hey, it's coming. Yep, the, it's, it's coming guys. Trains coming in the station at this specific time, you know, like check the schedules. It's not that hasn't fallen from the sky, this attention.
- [47:29]
A
Is there anything that you're seeing out there? Like what do you think is next in terms of like the, the focus areas for, for regulators? As somebody who's, you know, doing a lot of coverage of what the states
- [47:39]
B
are doing, I think there's going to be more focus on age related stuff. And kids, of course, I mean that's not revelatory to say, but I don't hate it. I really am quite thankful that I was young enough that social media didn't exist as a thing until I was or just out of college because Mark Zuckerberg is, he's like slightly younger than me, so he was making that stuff like MySpace existed, whatever. But I'm grateful that I didn't have that as part of my childhood. And I don't hate the idea of some kind of regulation. I mean, I see my friends, kids, they're like totally addicted to their phones. They're like younger than 13, they all have Instagram accounts and like TikTok and it's just such a time suck and so much garbage. And I don't like it. Not to mention all the data collection.
- [48:29]
A
It's hard to argue with that. And it's interesting. I don't know where age verification is going to land because it does seem to come squarely up against the first amendment here. And also I want to be respectful that there are, or at least acknowledge that there are some downstream consequences to making sure that you can verify everybody on the Internet. And, and God help you if you're one of the people that gets identified incorrectly. And then you need to spend how many hours, you know, convincing Meta that no, I am actually, you know, a person in my 40s, so that's going to be a challenge. The thing that I think is going to be a big regulatory thing that I don't know that many are Talking about yet is, you know, you had that court decision coming down with respect to Germany and there's a similar one against Critio where they seem to be really hooking on the idea that ad techs are joint controllers of data and are therefore responsible for vetting the consents that they've received. Which, you know, 10 years ago that would have been almost laughable for somebody to say that. And now it seems like we're, you know, that that's the enforcement that the standard that they're measuring against what we
- [49:38]
B
were saying before, like, good luck. Your data flows are a mystery. I mean this, this is a man made industry. It's not like it was came down from God and yet like no one understands what's happening in it.
- [49:47]
A
Well, hopefully that changes. So, Allison, this has been a fantastic discussion.
- [49:52]
B
Where can people find you@exchanger.com and I've been encouraged to and don't do enough. I should be posting on LinkedIn, but yeah, I mean, I got me a LinkedIn and just read our stuff, please. Every time you come to adexchanger.com, you feed a journalist.
- [50:10]
A
So also sign up for Alison's. Oh, I have a privacy newsletter.
- [50:14]
B
Oh my God, thank you. I forgot that I write a privacy newsletter. Oh my. I'm really bad at self promotion. Every couple of weeks we put out a privacy newsletter where I get to be a little funny and try to find some new angle and educate and entertain if possible. So thank you, Alan.
- [50:32]
A
Well, Allison is being very humble. It is an absolute must read. And so if you're listening to this and you're not signed up for that, you should be gracias. Alison, thank you so much for coming on. This has been great pleasure. That was a great discussion. A few things from our conversation that I keep coming back to. The silence after the ICE RFI dropped. Alison framed it perfectly. It wasn't indifference. It was a collective flinch. Companies understood exactly how it looked and they made a calculated decision to say nothing rather than take a public position. That's a choice. And as Alison put it, silence isn't neutrality. But that begs the question, what would meaningful engagement actually look like? As I mentioned, if I were running a precise location company, I wouldn't wait for the industry associations. I would put my stake in the ground that my company will not provide granular location or, or behavioral data for immigration enforcement, full stop. That's not a radical statement. And the fact that it feels radical to some people in this industry tells you something important about where we are. The surveillance advertising debate is one I've been reluctant to engage with directly because I think it's more of a buzzword and not a statement that indicates that one is interested in an actual debate over the nuances, because there are nuances to many of these discussions. That said, when an arm of the Department of Homeland Security is actively mapping ad tech capabilities for enforcement purposes, there really isn't a ton of room for nuance. And equally, our industry doesn't get to call these things fringe concerns anymore. The tinfoil hat crowd, as Alison put it, has a point. If you want to read Alison's work, head to adexchanger.com and please sign up for her Privacy newsletter. It comes out every couple of weeks. It's smart, it's funny, and it's genuinely one of the better reads in this industry. If you found this episode useful, please share it. We've got a bunch of other fantastic guests coming up on the Monopoly Report podcast over the next few weeks. Please subscribe to the show@monopolyreportpod.com or on Spotify, Apple, YouTube, wherever you listen to your podcasts. And thanks for listening.
- [52:59]
B
The UPS Store is making packing and shipping Easter gifts quicker than ever this year with UPS Air.
- [53:04]
A
How quick?
- [53:05]
B
Quicker than a walk around the park. Quicker than eating all the Easter candies. Quicker than finding a golden egg that you know is stuffed with cash. When you ship UPS Air at the ups, your items arrive on time or your money back, guaranteed at no extra cost. Exclusively at the UPS Store US retail locations. Send Easter Joy on time at the UPS Store. Visit the upsstore.com air guarantee for full details. Terms and conditions apply.