Loading summary
Transcript70 lines
- [00:00]
A
Foreign.
- [00:10]
B
Welcome to the Monopoly Report the Monopoly Report is dedicated to analyzing the big issues impacting the global advertising economy. I'm Alan Chappelle, outside Counsel and fractional Chief Privacy Officer to a bunch of tech companies, and am the principal analyst at the Chappelle Regulatory Insider, which is a monthly report that focuses on privacy, antitrust and other regulations impacting digital media worldwide. You can find a link to a sample copy of the Chappelle Regulatory Insider in the show. Notes this week my guest is Andy Dale. Andy is General Counsel and Chief Privacy officer of Open AP, a TV adtech joint venture backed by NBCU, Fox, Paramount and Warner Discovery. So 25 years ago, a handful of ad tech companies made a bet and it went like this. If we police ourselves, we can keep the regulators at arm's length and build something better than what Washington or Brussels would hand us. That bet, called Self Regulation, started as the Network Advertising Initiative, which was created to address transparency and control concerns and to make sure that our real world identities were not merged with our browser information. A notion that was incredibly important back in 1999 but in today's sensibilities comes off as almost quaint. But I digress. Eventually Self Rig brought it into the Digital Advertising alliance, which was created to push self reg standards out to advertisers and publishers. That's the little blue Ad Choices icon you've seen in the corner of most banner ads over the last 15 years now. Fun fact. According to legend, the Adjoic's icon was originally conceived on the back of a bar napkin at some watering hole in Washington, dc. So who says privacy can't be fun For a long stretch? The bet that is self regulation paid off, as evidenced by a lack of a comprehensive privacy law in the US and to some degree a market was created around privacy in the ad space during that time. And here's what I mean by that. If you wanted to be considered a legitimate ad tech player in the opinion of media buyers, you needed to be on the industry opt out pages. And the idea was if ad techs would take a few extra privacy related steps, they could reduce commercial friction. To a certain extent it worked up until the point where it didn't. Then the ground shifted. The GDPR arrived, California passed CCPA, and today we're sitting with over 20 state privacy laws, more than a handful of data broker laws at the state level, and new state AI laws, all with no comprehensive federal law anywhere on the horizon. When the law itself creates consumer rights, sets a compliance floor, and comes with real enforcement teeth, you have to ask a difficult question. What exactly is self regulation for these days? I have a personal stake in this one. I chair the board at the nai, so I'm not coming to you as a neutral observer. I'm coming to you as someone trying to figure out what the next five years should look like. And over the last few weeks, we've seen real turnover in the senior ranks across the space. Lee Freund left the nai. Prewood saw its own shakeup. And with so much change, it seems like a good moment to stop and take inventory. So I called someone I trust to think this through with me. Andy Dale, a longtime ad tech lawyer. He's been in house with Data Zoo and OpenAI on the streaming television side, and he hosts one of my favorite privacy podcasts, going the Data Protection Breakfast Club. Alongside my pal Pedro Pavon, Andy has a rare vantage point. He's seen self regulation from the inside and from the outside as a paying member deciding whether it's worth the check. And that is precisely the thread we pull on today. Is self regulation dead? Or is all this regulatory chaos actually a business opportunity in disguise? We get into the three legs of the stool, advocacy, standards and compliance. We talk about whether the industry still needs the DAA icon. We talk about managed services, AI governance, and whether the third party ad tech community still needs an independent voice at all. It's a candid conversation, one that just might tick off some people. But it's necessary. If anything, we need more of these types of discussions in the ad space. So here's Andy Dale. Let's get to it. Hey, Andy, thanks for coming on the pod. How are you?
- [04:47]
A
Good to see you, my friend. I'm good.
- [04:49]
B
Great to see you as well. Where is my audience finding you today?
- [04:52]
A
I'm in West Newton, Massachusetts in my upstairs office.
- [04:56]
B
So we don't do this by video, so I'll just tell people. This is the command control of one of the best podcasts that I listen to regularly, the Data Protection Breakfast Club, where you and Pedro go at it. What are you guys back on, by the way?
- [05:12]
A
We're going to take a little summer. We always take a little summer break to do some vacation, so I think we'll get back in in the fall. We just pushed an episode out maybe a couple weeks ago, but you've been on twice, you know, so Plug for Alan's got two good episodes as a guest on the pod. It's been really fun. It's fun to do, you know, a lot like you try to do. We try to talk about these things in a. A lighter, more, you know, kind of open, down to earth way. It's fun.
- [05:37]
B
Well, at risk of gushing, I love the setup because you two really work very well together. You're a weird peanut butter and chocolate thing, my friend, because you're, you're kind of come at things differently, but, but you end up balancing each other just, just really well.
- [05:53]
A
We're good friends and I think that helps. And I've, I've known him, you know, long, long time and, and that always helps.
- [05:58]
B
Yeah. Well, let's jump in.
- [06:00]
A
Yeah.
- [06:01]
B
I want to talk about the future of self reg and we've had some turnover in the senior ranks just over the last couple of weeks. I mean, Leaf Royan just left the NAI and just disclosure, if folks don't know that I'm the board chair, pre bit had a little bit of a transformation where Mike Racik and a couple of other folks left pre bid. And so it seemed to me that now is a pretty good time for us as an industry to maybe take stock in. What is it that our industry associations are bringing to the table. So this isn't necessarily just an NAI or a pre bid or a tech lab conversation more broadly. I wanted to walk through with you. What does this industry need? What will put this industry forward over the next five years, by which time hopefully you, me and Pedro will have bought our bar in St. Barts and we'll be giving scuba lessons or whatever the heck it is we're doing. Yeah.
- [06:55]
A
You just described us living the movie Cocktail, which I really like.
- [06:58]
B
Well, let's just jump in. And first, I want to acknowledge the elephant in the room. I mean, the idea of self reg in the ad space really came out of a set of issues going back 25 years ago. And many of those issues are no longer relevant. I mean, states have surpassed self reg. You flagged, you know, more than 20 US state privacy laws. I think we're 24, 25 now. I've lost count. And there's no comprehensive federal law on the horizon. So what does that mean for the thing that we used to call self reg to self reg get killed or is all this chaos closer to a business opportunity?
- [07:36]
A
Yeah, I think it's time for change. But interestingly, Alan, like, when the GDPR happened, I was actually on the NAI board in like, I guess it was 2014 or 15 when everyone was. Was preparing and I openly raised, like, what's our future? You know, when there is a comprehensive privacy law, which there, there had been, you know, that, that previous European directive. But now we've got something more significant, big impact to adtech. We had the Cookie Directive as well that was in flux at that time. So everybody around that table was talking pretty openly like what do we have here? What's next? And they did a nice job over the years of continuing to find ways to add value. And then California happens and we start to see all of these laws in the US not exactly the same, but similar. Right. Creating consumer rights, creating a compliance floor, creating, you know, a lot of, a lot of good if you think about things that didn't exist before. So it puts the organization that is initially, you know, having a mission which was let's police ourselves because we can do it well and let's be thoughtful about it and let's talk to Capitol Hill about it and let's do all these things. It puts us in a very different posture. And I think we just are in a place finally where as you noted, the, the federal law on the horizon seems very unlikely. You know, not because it's not important, but it's, it isn't really a priority right now. And I think that's just a fact that we have to consider. Won't say never. I mean that's silly to say never. But even if one happened today, I still think we'd be asking ourselves how do we want to govern ourselves? And is this way, the way we've been doing it in the past, the most effective? And yeah, I agree. I think my answer would be I think things should change now. Now I don't wipe it away and I don't think it should be gone, but it should look different.
- [09:28]
B
Well, the, the big thing about self reg from day one to maybe into the first 12 to 14 years is that if you wanted to be considered good, you had to be in the NAI or at least on an industry opt out page. Now that never really materialized in the mobile space, certainly doesn't apply in the CTV space. And now I think that the decision we reached a couple years ago at the NAI was like, I don't think that those browser based opt outs are really helping anybody. And so we've sort of moved away from that. But the byproduct of that then is, is, well wait a minute. If you know, that's no longer the gold standard, if the agency holding company person just needed to look at the list of who's on the opt out page to know if you're a valid partner for them, well that's no Longer the thing. And so then that sort of begs the question, once you've lost that point of stickiness, then where do we go from here?
- [10:29]
A
I think what one of the things I learned when I came to open ap, which is a TV focused streaming TV joint venture, was how many other issues there are out there and how prevalent. It's going to sound silly, like maybe I should have known this, but how prevalent cross context advertising or cross channel advertising really is. If you think about Ford Motors is the advertiser. They buy on every TV network, they buy in every media channel, they buy out of home, they buy mobile, they buy web, they buy, they are doing creator and influencer marketing. So that what where we are in 27 is a very different landscape than we were 10, 12 years ago, where programmatic is hot and it's a thing and people are starting to see the ability to do bidding and buying and just a different era. Now we're in, I would say a really interesting place where people are buying all these different ways. So what do they need? They need things that help unify and help them understand the roi. It's always been the, the chase of the ROI behind ad dollars. Now we're presented with a really unique, interesting time and then you just add AI into it. It's going to completely keep evolving. So I think you get, you get us really quickly into that key question of what do people need? What do companies need? What do the advertisers and advertising technology companies need to do and need to get together and what are the most salient things? So that's the lens, I think, to think about what does self reg look like? We have totally different needs now.
- [12:01]
B
Totally agree. But then that begs the question, you know, what's the list? What are the things that, in your view that the, the industry. And by the way, it depends on how you're viewing the industry, but like what does the industry need?
- [12:14]
A
So joining a TV company became pretty clear to me, like what the NAI and perhaps a few others potentially provide. That doesn't exist in tv. Meaning there isn't a group of companies that get together, talk about key issues, talk about best practices, deliver events together around those very specific issues to their vertical. So I noticed that wasn't really in place in tv. I think TV needs something, I think for all these other channels too, audio, out of home, all these other contexts, they need things. I think measurement is almost a separate topic. And if you look at the way measurement has been carved out of, of some state laws, those have a very different set of things that we can, I think as an industry take positions on if something is measurement or something is attribution versus direct targeting or directly sort of programmatic ccba, you know, as the CCPA defines it. So I think those things are important. I think we need to think about what services do people need. I think whether that is specific data protection officer type services for advertising because it's such a complex area of business. I think that's one option. I think AI governance could be an option. I think there's a bunch, I think AI and creative and how that's going to impact advertising. All of those things could be avenues to create, I think a new surface area for best practices and a new surface area for really important conversations that I think people would want to be in a group contributing to.
- [13:54]
B
And that's the challenge for me. I think what you're saying presupposes that each of the different niche areas, measurement, ctv, ad, CP and all the agentic buying stuff, that there's enough commonality in interests within those different groups that it makes sense for all of them to get into a single tent. And if you believe that, then what's the thing that's putting them all there? Because traditionally it's been focused on, well, we are the third party ad tech group. And you know, there's a, there's a sense as somebody who's been in that space for going on 20 something years, you know, there's a sense that you get marginalized, you're sort of the first to get into trouble if there's some larger set of privacy issues. And so that sense of purpose has, has sort of driven what the self reg movement had been at least in, in phase one or phase two. Does that still exist and if not, what replaces it?
- [14:57]
A
That's interesting. I think, you know, FPF has done a good job of a single tent for lots of different issues. So maybe you have to look at structurally, is the structure the same or is it a little bit different? If people have different focal points, maybe there are services and things that affix to those particular focal points and then provide concentric circles around things that are really relevant for the larger tent. The FPF has done a nice job of that. They have a much wider mandate. It's a very different business model. But I think no one would argue that they haven't done a good job for the privacy community. So there's the other sort of thing you said that got me thinking is like the third party ad tech, ultimately it's been Interesting to see in an enforcement scenario, third party ad tech lately has not necessarily been, you know, the companies that are taking the brunt. It's actually the more public, larger companies that you know either if you're like Sephora in California with the CCPA rather, that's a big brand. And so the focal point there is this is a brand, this is an advertiser. And you know, I don't think anyone suspected that Sephora would be, you know, a name that we would know in.
- [16:10]
B
I didn't have a bingo card.
- [16:11]
A
No, no, I don't think anyone did. But I think it's, it's instructive, obviously.
- [16:15]
B
Right?
- [16:15]
A
Where, where are, where can regulators, you know, make consumer focused impact? Some of that is going to be larger platforms. I think frankly, third party ad tech is so complicated and difficult that I think you're going to see some, you always will. But I don't know that as a, as a, as you said under the tent, that, that necessarily when you're speaking strictly about sort of self reg and building, you know, best practices that are, you know, trying to show regulators what you're doing. I think it's helpful and it's as it is always helpful when you build a compliance program. And your answer to a question that you may get from a regulator or being diligenced by a potential customer is you can explain your program and you have logic and you have documents and you have things to show and you have thought process that you went through that always plays better than. I just started thinking about this on Tuesday. I don't know how to, how to get my, my shit together.
- [17:10]
B
Yeah, I, I think that self reg is sort of struggling a little bit from an identity crisis because heck, I remember this goes back to the Trevor Hughes days of the NAI where the analytics people. Oh no, no, no, we're in our own tent. You, you ad tech people, you, you stay away. We're doing our own thing here. And, and there was sort of, there's sort of these little mini fiefdoms and what I think needs to happen is a recognition of the places where there are shared interests. I'll give you an example. We've done a lot of coverage of the attribution spec that the W3C is putting out there. And I would argue that with respect, philosophically to what they're trying to do with that spec and I get the privacy component. But there is also a, we want to limit data to entities who have enjoyed that data. Google is making the same argument in search cases. In the US and the eu, there's sort of a. We think that we should have the data and we can come up with a hundred reasons why somebody else should not have the data. In my view, that seems like a place where a number of entities who have not sat within the same tent might be able to coexist.
- [18:29]
A
I agree with AI focused marketing. Outcomes matter more than ever. So it's always mattered. But I think you're seeing this open AP just has this new product coming. It's a conversion API. Why? That's what people want. They want to be able to figure out which devices were exposed and which ones actually bought something and actually had Lyft in tv. This is exist. You know, Facebook has had this for a while and a few others, few other big players. But unsurprisingly, to your point, like, I think that's outcomes are where it's going.
- [19:04]
B
Right? Couldn't. Couldn't agree more. Okay, so let's assume for a moment that we can define self reg really broadly so that it's really a proxy for the question what will foster a vibrant third party ad tech community and maybe even broader than the third party ad tech community. But you know, I talked about this a bit at the recent NAI summit where I saw three legs to the self reg stool, as it were. The first would be advocacy, the second would be standards and guidance, and the third would be compliance. And I would love to get your thoughts on each of those individually in the following questions. So, you know, you said that policy and advocacy at the federal level isn't necessarily super useful. You know, do you see a role for advocacy at the state level? And more to the point, you know, would companies actually pay for that?
- [19:56]
A
I think they would pay for it together if they were able to triangulate around a critical issue or two. So I would think that if there was a group that had a very clear set of issues, that they're focused on one or two things that they want to have an impact on. At the state level, there are groups they could work with, they could develop a point of view and share those with, with, you know, particular groups that are also actively doing that. I think if you think of it as you noted, the three legs of a stool, maybe they don't pay for just that, but I think you pay for that alongside other things. And I think if it were really narrowly tailored, focused on the states, and then possibly even focused on the emergence of AI laws and the potential overlap into the advertising sphere, then I think you start to really get into something interesting on the advocacy side of things. I think at the federal level, I don't think the NAI is gonna. Is they could be amazing. And I don't think the NAI moves the needle on the federal level just because of things outside of the NAI's control.
- [21:00]
B
Yeah. So I would say that lobbying services, I'm gonna say this as a musician, is sort of akin to paying for social media promotion. Like, you spend a lot of money, you know, a lot of stuff is done. Measuring that impact is always really, really difficult. And this is not to beat up anybody who's a lobbyist, because there are some people doing some really good work. But holy crow, you spend a lot of money for something that is very difficult to ascertain, at least at a federal level. I think that David and the team over at the nai, Look, I'm biased, I suppose, but. But I think they do a great job at the state level because I think that their opinion is considered and they're well respected.
- [21:45]
A
Yeah. And they've got a great group around the table to be able to give an. And a summed up, cogent, thoughtful opinion to the right messenger.
- [21:53]
B
No, that's a good point.
- [21:55]
A
Yeah.
- [21:55]
B
So my second question then is what. What do standards and guidance look like? So is the role of self reg to clarify what's in the law? Is it to go above and beyond the law, which is beyond becoming harder and harder to even envision, at least for me and, you know. Or is it something else?
- [22:11]
A
When I first joined Data Zoo, which was where I first, you know, became a full, full court press ad tech lawyer, when I joined, it was, look, we participate in the nai. It is thought of as an extremely important piece to getting, you know, media sold through, through our platform. Having all of that information in our privacy policy is important. I first interacted with the NAI back when Jurgen was there, you know, and took us through things that we needed help getting through. So it was really valuable and it was valuable to have someone on the other end of that phone call that knew exactly how this stuff worked. And then you have. We had other things, like we had a trustee at that time, you know, privacy notice review. All of those things were geared towards holding on and getting new revenue. It was really important. And they were in every contract that I negotiated. You had to have reps and warranties around your compliance with those things. We now have state laws. So I'm going to be totally candid here in front of you and all the listeners here. Like, I Don't sign those reps now. I would never sign up to that rep now. Like we can't sign up to compliance with 20 state laws that are all changing, that are all being amended, you know, and then at the same time sign up to daa, nai, iab. Like it's just not possible and it's not realistic. And so I think what can and should change is the use case for these best practices is still great and still valuable. And the participation in looking at them and understanding them and learning about them and knowing about them for your business or for your Sock2 audit, which is another angle we can go again. These are still really good ideas.
- [23:57]
B
Yeah, the thing that I'm hoping to get out of self reg now is, you know, you get a new set of standards or you get a new law, say it's a state like New Jersey and you read through it and parts of it maybe are a little vague or you're not quite, you're understanding it and so. Or they weren't really written with ad tech in mind, which happens quite, quite frequently because that's not the biggest industry. It's not the first thing anybody's thinking about to have a separate entity say, well, here's a path or at least key considerations for how one might comply. Now that's totally different than contractual reps, but I do think it's something that can be valuable because it allows the internal privacy officer, who is the NAI member and usually the lead contact person, it allows them to look smart and to solve problems within their org. And if you can help somebody to do those two things, particularly the latter, you've got a really good shot at being renewed in subsequent years.
- [25:00]
A
I think also Alan, if you can, if the, if the NAI can or other organizations can wrap key services around those things. So if you can wrap the we're sort of working group development aspect of, of those best practices because that raises the all ships. That's really valuable if you can wrap events around that that allow for connection with other people in the industry and having like key conversations around those things and even compliance services to get to your sort of third leg of the stool. Like I think all that stuff put together is what makes the thing still valuable in my view.
- [25:37]
B
Yeah, I would agree. I think that the, the basic framework is there. I think it, it still needs to be maybe developed a little bit more all three of those legs and yeah, they're getting there. They're certainly getting there. And you know, with respect to events, I think I would like to see. I don't know that we need a Knowledge Net type thing in every city for the nai, but I do think you know something quarterly in the four or five major hubs where, where one person from the nai, maybe it's David Luc because he's pretty brilliant at walking through things and somebody just says look, we're going to plunk down $1,000 for an open bar and David's going to talk. And then the rest of you are just going to, are going to have the opportunity to either ask David questions or talk amongst yourselves and solve problems on your own. Boy, to me that seems like a pretty valuable service that, that I don't think most self reg orgs have totally availed themselves of. They do an annual event or like, you know, occasionally, you know, here or there, but just those sort of, those on the ground work can be just really helpful in terms of developing your brand.
- [26:44]
A
Yeah. And I think playing around with alternative structures like you're noting for events are really important. Like having one, one sort of annual summit is really great, but if there were another one focused completely on AI or another one focused completely on something else, a couple times a year doesn't have to be a big thing. But I think the, the key for events nowadays is they can't all be the same and they can't all be four brilliant people on stage talking and asking each other questions like that's valuable in some ways. And then breaking out and having conversations are valuable. Like having exercises and other things happening and having different ways of, of connecting. I think really important.
- [27:25]
B
You know, there's a two or three times a year event quasi organized in Oakland. They get a couple of hundred people there to do a periodic Thursday happy hour. I mean even things like that. And look, I'm not here to say which is going to work and which isn't, but I do think that, that we need to become a little bit more entrepreneurial in the thing that we, we used to refer to as self regulation.
- [27:50]
A
Well, you've been part of this every year ahead of the IAPP summit, there's a roundtable of advertising and technology and television folks that get together and have real conversations for half a day. That's really important stuff like that. Here in Boston we do dinners every quarter outside of Knowledge Net. And George Jones who runs knowledgenet, does a good job. He's had a DPO at Zoom Info, he does a great job running it here in town. But we have like off the record dinners, you know, some folks, you know, that Go Omar 10A and other people that are like in the circle so we can actually get together and talk about what's really bothering us, what we're really finding interesting and how we can solve real problems. So I think you got to combine all that good stuff into new event formats and I think that's another role that these organizations can help, you know, do.
- [28:44]
B
So I want to circle back to managed services because I want to. Can we expand upon that a little bit? Because I'd love to get your thoughts. What does that look like in 20?
- [28:55]
A
When I was at the board, NAI board meeting 2014, I said NAI should explore providing outsourced specific to ad tech DPO services. We should create a division and we should hire a couple people and start providing this service. Highly specific area. And I don't, I think it was the one period of time maybe you weren't on the board. So I don't know if, I don't know if you were there.
- [29:20]
B
I was not on. There was. It's funny, I think in the exact two years that you were on the NEI board was the exact two years of the last 20 that I was not.
- [29:28]
A
Yeah, well I, I was lucky to still know you. But, but in any rate, like I raised it and it was received but I think that the message was that just isn't what we do. That's just not our mission. That's not what we're here for, that's not what we do. And, and that was raising the specter of the GDPR and me probably being fatalistic when I read it, when I, when I was saying it, basically saying, hey, existentially, do we have a business still, you know, probably a bit reactive at the time. And I think that's probably, that's proven out, but I don't think that it's a question that should ever have been, should be off the table. So I think some sort of service that allows people to continue to be able to comply, something where the service provider understands the complexity of like all the stuff in ad tech that nobody outside of the business really understands, like the complexity of the controller processor designation and in ad tech is very, very hard. And that is not something that somebody, if you're a small to mid size, even like a small public company struggles with that designation. I actually, I take that back. Every company struggles with that designation. Not because it's like impossible to provide, but because every decision that you're making is essentially one of first impression and you're trying to make the best decision you possibly can make within the bounds of opacity, changing laws, AI impact. So all these things are happening. So you have to stake a claim and you have to come up with positions on things. And I think the services that can help enable people to make really hard decisions are really valuable. Which is like, are you doing the basic stuff, risk assessments, are you doing, you know, tools, inventories, Are you getting another look at your privacy policy by someone you know, outside of just outside counsel? Like I think there's a lot of real valuable stuff that could be provided by an organization that has the depth of understanding that a self reg organization does about a particular business.
- [31:38]
B
Yeah, I couldn't agree more. I think that nothing should be off the table. I've been pretty vocal that I, you know, I think the NAI and really every trade association should be really looking into the agentic space much of those initiatives and I'm not here to, to badmouth anybody, but I would note that most of those initiatives are being led by the business folks and not necessarily by the legal or the privacy or the data governance folks. So number one, I think those initiatives need to make sure that they continue to have the right North Star to make sure that they don't get too far off the, off the track. But more importantly, the people who are data governance legal privacy pros need to have a forum in which they can think these types of issues through again so they can look good and sound smart in front of their respective organizations.
- [32:31]
A
One of the things that our, our friend Trevor at the IAPP did well was lean in hard into AI governance a couple years ago and seeing that that's a thing that people are going to need and unsurprisingly, a lot of privacy people are being tapped with that responsibility inside organizations because those people understand the technology really well and they understand data flows and so not surprised at all that those privacy people are all kind of, you know, rip raring to go and get, get AI governance. You know, either they want it or it's saddled, you know, to them. And so I think there's a huge opportunity there as well.
- [33:05]
B
Yeah, couldn't agree more. I want to change gears a bit and talk about, you know, we haven't really talked much about the DAA or even the iab and you know, there's sort of a sense within parts of the industry, so I'm not trying to put words in your mouth but, but that, that those orgs might need a refresh of sorts. And so what's the issue or the, the, the the change in the mission that would require a refresh.
- [33:33]
A
Let's start with daa because I think IAB is a different lens. I think with respect to daa, I think you're, you know, two things and if I miss what they're currently doing, you know, let me know. I think, you know, we need to ask the question, do people want to click on a button on an ad now and opt out or because we have all these state privacy rules, are people having different behaviors? Are they going to privacy pages? Do they. They're going to go be able to opt out as a. Across data brokers, you know, with, with both drop and now all these states are, you know, more states are adding data broker rules and amending laws to add data broker concepts. So are consumers, you know, really going to click on the button and is that value in and of itself with all these other ways for consumers to effectuate preferences? And then the other thing is sort of the code and self reg kind of concept which is really again sort of supplanted by the law itself. Not that it's bad or those are bad things to do. They're great things to do. But I think those are the kind of existential questions that, you know, I would ask like, do we need that still? I don't know. I don't. My, my guess is probably over time that's not as necessary.
- [34:53]
B
Well, if you think about, you know, the DAA came into existence primarily because John Leibowitz at the FTC said hey, nobody knows anything about this behavioral advertising stuff. We need to make it more transparent. And so they came up with the idea for icons on ads. But to your point, that was a long time ago. And so query whether either the market or even consumers need that type of transparency tool and the resources that that apparatus currently requires from the ecosystem.
- [35:28]
A
There's cookie banners. Sorry, on, on. On so many websites there. There's lots of ways in which consumers are. And they don't love. I don't love cookie banners. So not like, you know, hailing the cookie banner, but it's a different surface area now. And so I think you're dead on. Like do they need the button? Do they need the icon or not? Is, is the fair. A fair question?
- [35:46]
B
You know, talk about managed services. I think one of the biggest mistakes that the the daa, I don't know if they allowed but they sort of enabled to happen on their watch was when they launched. It was effectively the evadon serving the icon or trustee or trust ark. They may have changed their name by then serving the icon and the Evadon thing was this Cadillac. It like you click on it, it tells you the name of the advertiser, it gives you a list of, of the, the ad techs who were helping to serve the ad. I mean it was a, it was a premium implementation and then the alternative to that was sort of like you click here and then you end up somebody's opt out page. But it didn't really tell you anything. And I think that was a missed opportunity because the marketplace, if forced to pay for a Cadillac, would pay for a Cadillac and we would have been better off, but the marketplace would rather have a Hyundai and pay for a Hyundai. And that's sort of where we landed, where we landed. And I just don't think that the tool is serving the purpose that it was initially intended for.
- [36:48]
A
There's just other stuff, you know, and there's way more companies, you know, funded in the privacy space. So when the GDPR happened and the CCPA happened, unsurprisingly, Venture capital has supported a bunch of technology out there that now exists and supports compliance and supports cookie consent and supports all these things that just weren't around before, right?
- [37:09]
B
Completely. I've got one more set of questions and I really appreciate you coming on Andy. This is always a blast and honestly we need to catch up more because you're definitely a person that I want to be talking to more, particularly as we try to rethink the, the future of self Reg. But you had floated the idea that industry associations might absorb, you know, other associations. You know, there was cimm, the JIC and maybe even partnering with each other. And, and I'm, I'm curious to know, in your view, what does that really look like?
- [37:43]
A
There's a little bit of fatigue right around some of the, the memberships and people, you know, feeling like where am I getting the most value? I think everybody knows that there's value in industry groups and I think there's, they all kind of tend to do a couple things that people, you know, really like and enjoy and sometimes they do those things for a period of time and those things are valuable for a period of time and maybe they're less valuable and they need to change and do something else. So when I think about consolidation, I think of, I think about it more just in sort of the user space. Like as a user or consumer of these memberships, where would I get the most value and how would I get the most value out of all these things rather than having to keep track of seven Newsletters and build a machine in Claude that tracks everything. For me to try to understand all these different things, it would be better if there were some consolidated efforts and there were some consolidated things that were happening. And I actually think those organizations could deliver better results if they had the knowledge base of each other, you know, working together. So whether that's a partnership to do more things together or whether some of them want to actually physically exist together, I don't know. But it's worth them thinking more strategically in terms of how would we partner together and then I can more easily see the path towards recurring managed services as a thing that these organizations can provide in addition to all the other great stuff that they layer on top of it, events, connection, networking, opportunities to be together, all that stuff, it goes together to me.
- [39:20]
B
So the thing that comes to mind for me, and this is specific to the third party ad tech community, is I fear that that is the community that needs an independent voice. And so the minute that that gets subsumed into, you know, I don't know, the ANA or the IAB or, or some other larger group that you've just set the timer for how long the that voice is still going to be at least somewhat prevalent within the rest of the industry.
- [39:52]
A
Yeah. Why? So I'll ask, why do you fear that that is a group that needs that as compared to other groups?
- [40:00]
B
Well, I would say historically that tends to be the first group that when a federal privacy law comes down, that's the first group that everybody else in the industry kind of says, you know what, the heck with them, we can kind of throw them under the bus. And I've seen that happen repeatedly. Now maybe you can argue that that's less true now, but I'm not sure it is.
- [40:21]
A
It's possible. I don't think that if you think about third party ad tech now, again, it's this sort of theme of our conversation. If you think about it now versus five, ten years ago, what third party ad tech is, is very different now than it was back then. We had a whole crop of startups back then that were gaining rev share, gaining opportunity, data was free flowing. It was a different in time, a different environment.
- [40:47]
B
Sure.
- [40:47]
A
Now the companies that have revenue and participate in the third party ad tech space, many of them are public or profitable and, and funded or private equity backed. So I think you actually have the sort of thing that everybody was worried about with the gdpr which was you're going to crush small business and the only ones that are going to be able to Comply are going to be the large platforms and they have the, the ability and the machine to comply. And I actually think it's possible that you could argue that lots of third party ad tech now has the ability to comply because we've, you know, we have more technology at our disposal, we have more knowledge at our disposal. They're ready to potentially. I, I, I want to be careful. I'm not saying, okay, no tent for third party ad tech, they don't need it anymore. I don't think that's right either. I think it's, you know, perhaps third party ad tech isn't necessarily in the same place it was five, ten years ago.
- [41:44]
B
Fair enough. And I don't think you're saying this but like I'd be uncomfortable with the idea going well, you know, you've got problematic and you got magnite, so good luck, that's enough. But here's the thing that nobody really wants to admit. To what degree are the startups in the ad space aligned with the current mission of the trade desk? I mean lead aside Google, but some of the other larger players and that's always been the, this is a disruption environment. And so I may be just blowing up my own argument here but I think that we need to figure out who's sort of still in the tent.
- [42:25]
A
Yeah, I think that's interesting. Like sort of a related question is, is the startup ecosystem around ad tech like at all similar to what it was when you started working with Blue Kai? Like to me it's completely different in the sense that lots of those big platforms have been built, built and made. The trade desk is an incredible example, right company that was built at a time when data was free free flowing, available and not necessarily subject to the same, the same regulations as it is today. So building a startup today in the ad tech space, if you asked me right now, go build a startup, you're going to go have to, you know, raise money in this space. If I wouldn't pick ad tech. It's, it's complicated and it's, it's got a lot of overhead in terms of, you know, people like us, they, they need on staff at a much earlier or place or, or outside counsel that are going to have to help them build it from day one if you want a lot of, to be entrusted with data and to be entrusted with, you know, running ads in, in a highly regulated environment because people don't want to admit it. But this is a highly regulated industry at this point. So I think the building of the third Party adtech ecosystem. I think that's sort of one of the drivers as to why it's different now is that it's just in a different place. And I think AI is probably a very, in a very similar, less regulated place. There are a ton of startups right now and there will be a movement towards, you know, towards something when there is something meaningful around, you know, AI kind of standards, which CEO of DeepMind just said they should recently. There should, there should be standards. And I think that's a place that another place self reg groups could be influential.
- [44:11]
B
Well, I want to leave you with one other way of thinking about this. You know, there's sort of, broadly speaking, two different ways of looking at a business. You can get, you know, a million people to give you a dollar. You can get, you know, you can get a thousand people to give you a thousand dollars. And where in the spectrum do you want to be? Because that's sort of, you know, self reg has been a high enough price tag for some of these small to mid sized startups where you wonder what is it I need here? Can I, can I bring in a fractional GC privacy officer or do I need to self reg groups? And I think that's the type of math that a lot of these C level people are doing right now.
- [44:58]
A
Yeah, that's right. And it's what we talked about before, like what else comes with it? If I get the compliance piece under control and I get the sort of reputational piece under control. Oh, but also, by the way, I get five more things that are tangentially significantly valuable and I get exposure as a smaller company to the big companies and how they're thinking about things. It starts to become again the sort of same value prop it always has been. I don't think it's, I don't think it's at its core super different.
- [45:30]
B
Okay, well, let's leave it there. Andy, where do people find you today?
- [45:34]
A
Connect with me. I'm out there on all the social. The social places and LinkedIn. Try to, try to toss out some witty things there occasionally. The Data protection Breakfast club as you mentioned, shout out to Pedro and go listen to Alan's episodes. One of them, I think he was on a houseboat for one of them. We had interesting audio and conversations there but you know, generally available.
- [46:01]
B
All right, well thank you so much for coming on, Andy. Hopefully we have you back soon. Have a great rest of your summer.
- [46:06]
A
Good to see you.
- [46:09]
B
Andy is great. You can see why his podcast is so successful. I have a Bunch of observations, but my leading one is that we need more of these discussions about the future of our industry trade associations and we need to have them out in the open. So first, the diagnosis. Andy and I agree on the core problem. The original value proposition of privacy self regulation in the ad space. Be on the opt out list, rep self reg compliance contractually and earn your spot at the table. Well, that has largely collapsed in my view. Self reg didn't adapt fast enough in setting rules and and the law caught up with and then surpassed them. When you've got two dozen state statutes creating consumer rights and setting a compliance floor, a voluntary code of conduct doesn't carry the same weight it did in 2010. Some of the trades, including the NAI, recognized this trend a few years ago and have started making plans towards a post self reg or a redefined self reg world. Progress has and continues to be made, but in my view we are much closer to the start of a reinvention than we are to an end. Second, the opportunity. And to be clear, I am extremely optimistic about the opportunity that's in front of us. Complexity is our friend here. Compliance at AdTech is difficult for every company regardless of size and that difficulty speaks to the value of collective solutions. I'm on record saying how bullish I am on the opportunities around the number one advocacy, number two guidance and standards and number three compliance. Andy has some intriguing ideas around additional services which can be provided to the market as part of self reg. I think all of that should be on the table for discussion. But before we can get there, I think we need to build consensus on community. What is the constituency that each trade is trying to serve? And that gets me to my third point. My fear has always been that the third party adtech community needs an independent voice because historically speaking, when a federal privacy law or some other regulation comes down, third party ad tech is the first group everyone else likes to throw under the bus. Now Andy made a really strong counter argument like he often does. He noted that third party ad tech in 2026 is not what it was a decade ago. Fair enough. The free flowing data startup era is over. The companies with real revenue now, the magnites, the pulmatics, the trade desks. A lot of them are public, profitable and or private equity backed. And even the startups with only a handful or a dozen employees, well most of them need help too. A lot of them don't realize that yet and that presents its own set of challenges. So I agree with Andy here. We need a rethink of the constituencies being served by the industry trades. If you look at any of the lumascapes, we need to ask ourselves which of those entities are sharing the same pain points. Too many of our industry trades are trying to serve everyone in the marketplace, and when you attempt to serve everyone, you end up really serving no one. My thanks to Andy Dale. And if you haven't already, check out the Data Protection Breakfast Club podcast. We've got a bunch of other fantastic guests coming up on the Monopoly Report podcast over the next few weeks. Please subscribe to the show@monopoly-report.com or on Spotify, Apple, YouTube, or wherever you listen to your podcasts. And thanks for listening.