Cookies: Why the European Commission regulation could reinforce the domination of adtech walled gardens

What do you think of this regulation?

The process of standardisation and clarification it initiates is commendable, as legislative instability constitutes a significant risk for the industry. Unfortunately, we are not sure to this day whether this regulation actually fulfils the objective of clarification and stabilisation of the legal framework. Ever since a draft of the project – which would have required that third-party cookies be blocked by default in browsers – was leaked last December, the entire industry has been on the alert. This new version recommends that browsers systematically ask end users whether or not they agree to the use of third-party cookies upon installation. At least this way the advertising industry is spared from a shockwave.

The objective of these documents is on the one hand to prevent citizens’ communications from being spied on, and on the other hand to empower people to protect themselves against companies making marketing solicitations without their consent. The problem here is that somewhere between the statement of these principles – with which we agree, of course – and the proposal of concrete measures to enforce them, we lose sight of the objective.

Admittedly, this is a complex subject, but our impression so far is that this multi-layered regulation is a source of confusion and strategic insecurity. In December 2013, the CNIL (the French National Commission for information technology and civil liberties) required French website publishers to set up the much-talked-about information banners and, most importantly, to wait for visitors’ consent before storing any cookie. The news industry – already weakened and largely dependent on ad-based audience monetisation – was hit hard, since in theory it could no longer display targeted advertising without first receiving user consent. It was possible to upgrade to full compliance, and we assisted our clients, including Renault or Ferrero, in this process. But it came at a significant financial and human cost and, regardless of the law, the brands that did it were aiming to develop a sustainable, user-centred digital strategy abiding by these principles of liberty and control. But the document published today acknowledges the fact that the measure failed to fulfil the objective of increasing transparency and handing power over to end-users. It also mentions the costs incurred by companies. Today, what kind of signal does this regulation send to the companies that made the effort to ensure compliance? And to those that did not and were not sanctioned? Will brands and market players submit to this new law, knowing that another law going back on its key measures could well be passed three years from now?

The cookie provision is part of a larger series of legislative proposals aiming to reinforce the right to privacy in electronic communications. It is being introduced by the EC as a means to simplify the way users accept or refuse the cookies that are used to access data stored on their computer or to track their online behaviour. What consequences could it have if it was passed without modifications?

It could jeopardise independent advertising players, the media, and reinforce the growing domination of GAFA companies. That being said, it is impossible to know beforehand what proportion of users would refuse third-party cookies when installing their browser. People found the banners annoying but, for our part, we observed very low rates – often insignificant ones – of cookie disabling when such an option was available. We could well be surprised by low rejection rates after all. This, however, is not the issue – if the rates are low, it will be a vain effort in the fight against undesirable marketing, and if the rates are high, it will stifle part of the market and some industries, thereby strengthening the monopoly of the GAFA companies. The central issue here is citizens’ education and understanding of what is at stake. The use of private browsing and ad blockers shows that there is a real concern for the subject, and that a number of Internet users are doing some research, getting organised and taking steps when they are bothered by advertising or tracking. On the other hand, educational initiatives from content publishers asking users to disable their ad blocker – such as the one taken by Le Figaro in France or Bild in Germany – have had promising results. Similarly, the informative cookie header banners that multiplied all over the French Internet following the publication of the CNIL’s recommendations in 2013 – which admittedly were not perfect and not necessarily in keeping with the initial spirit of the document – also helped raise awareness of the fact that the web ecosystem is based on the use of cookies, even if their role and the way they work are still little known.

Some analysts point out that this reform only focuses on third-party cookies. Tracking cookies used by publishers to collect information about their own connected, identified and logged-in audiences, also known as 1st-party audiences, would thus be beyond the reach of the regulation. In other words, platforms like Facebook, which are already crushing publishers, would not be affected by this restriction of the use of cookies. Do you agree?

The regulation focuses on third-party cookies, i.e. the ones that enable information sharing between several websites. The settings for other cookies, in particular analytics cookies, are not affected here. And yet the latter can also be used for advertising purposes. In its present state, this regulation actually allows Silicon Valley giants such as Facebook – whose advertising technology arsenal is partly based on cookies but also relies on users voluntarily logging in to “walled gardens” – to continue offering targeted advertising just as before, while other players will no longer be able to benefit from the advanced ad targeting possibilities offered by digitalisation.

The EC considers that the “confidentiality of users’ online behaviour and devices has to be guaranteed”, and that control should be handed over to users. Thus, the data stored on computers or smart devices should only be accessible after the user has given consent. In your opinion, how can this principle, which is deemed essential, be reconciled with the need to finance online contents through advertising? In other words, what kind of “adjustments” do you think should be made to this regulation?

In our opinion, the law should focus on promulgating principles and defining punishable cases of misconduct. As for the rest, it should promote education and market self-regulation, which is already underway with initiatives such as the IAB’s LEAN protocol (Light, Encrypted, Ad-choice supported, Non-invasive), or the Week without ad blockers organised by the GESTE (French association of online service and content publishers), during which publishers raised awareness among readers about the financing of free content through advertising… Setting aside our doubts as to the ability of the measures provided for in this regulation to achieve the desired outcome, if the regulation was passed as is, a major issue would be to define what a third-party cookie is and then to explain it clearly to the public so as to allow each person to make a truly informed choice. Who would be responsible for this – browsers, the legislator, the advertiser? If we merely explain that they are cookies used for purposes of ad targeting, then we neglect to specify that they are the ones allowing us to measure and cap the number of views, and thus to limit ad repetition – a parameter which, when poorly handled, is at the root of Internet users’ discontent…

This interview was originally published on January 16th 2017 on Ad-exchange.fr, and translated from the original French by Marion Beaujard.