This year’s Data Protection Forum at Google EMEA brought together privacy, legal, and compliance professionals to discuss the evolving landscape of data privacy and its impact on business growth. The event focused on Google Ads policies, audience solutions, and measurement tools, featuring insights from Google experts and new research on digital advertising’s effect on European competitiveness.
Understanding Google’s EU User Consent Policy
Claire Norburn and Charlie Delaney provided an overview of Google’s EU User Consent Policy (EU UCP), a cornerstone of Google’s compliance efforts since 2015. This policy ensures that advertising partners offer users consistent transparency and control over their data.
Key Takeaways on EU UCP:
- Scope: The policy applies to users in the UK, EEA, and as of September 2024, Switzerland.
- Requirements: Partners must obtain user consent for:
- The use of cookies and similar technologies.
- The processing of personal data for personalised advertising.
- Personalised Advertising: This refers to ads based on historical data like search queries, activity, site visits, demographics, or location.
- Independence: Consent for cookies and personalised ads are separate requirements.
- Communication: For EEA traffic, consent must be communicated via signals, either through Consent Mode integration or by using the TCF framework.
- Resources: Google offers FAQs and an external checklist to help partners understand and meet policy requirements, including the need to link to Google’s business data responsibility site.
- Enforcement: Google aims to work with partners to achieve compliance. Non-compliant partners will be contacted, and if they fail to engage or comply within a reasonable timeframe, enforcement action will be taken.
Google clarified how certain products fit within the policy:
- Customer Match: Considered an ads personalization service, as it involves retargeting individuals based on collected information.
- Enhanced Conversions for Web & Leads: In their purest forms, these are measurement services designed to track conversion after ad views. However, if used to create audience lists for retargeting, user consent must still be considered.
It’s important to note that some products have their own specific policy requirements in addition to the EU UCP, such as Customer Match’s need for disclosures about data sharing.
Privacy Enhancing Technologies (PETs) at Google
Monisha, from Google’s Privacy, Safety, and Security product and engineering team, discussed Privacy Enhancing Technologies (PETs). These are engineering tools designed to safeguard privacy and security by minimising data collection, use, and exposure while still enabling insights.
What are PETs?
- Definition: PETs are an engineering toolbox that protects and improves privacy and security.
- Benefits: They help comply with data minimisation principles, demonstrate privacy by design, and add security to data processing. They can also unlock new business use cases.
- Examples:
- Differential Privacy: Used in features like Google Maps’ ‘Popular Times’ and Covid-19 mobility reports. It adds noise to data and aggregates it to protect user privacy while providing useful information.
- On-Device Learning: Used in Gboard, where data for model training stays on the user’s device.
- Considerations: PETs are not a complete solution; their effectiveness depends on how they are used and combined with other technologies. Users should be aware of ‘PET washing’ – misleading claims about PET usage.
Google is open-sourcing some of its PET work, like Differential Privacy, to make it more accessible.
Confidential Computing: A New PET for Ads
Kamal Jabardhan introduced Confidential Computing, a PET that protects first-party data through isolated processing. This technology allows businesses to use and gain insights from their data without it being accessible to anyone else, including Google.
How Confidential Computing Works:
- Encryption: Data from parties is fully encrypted before processing.
- Trusted Execution Environment (TEE): Encrypted data enters a secure, isolated space.
- Matching: The system identifies matching data points while ignoring unmatched data.
- Output: Matched data is made available in a usable format for activated solutions.
Technical Guarantees:
- TEE: Creates a secure space inaccessible to Google or the TEE operator.
- Data Encryption: Customers can optionally encrypt data with their own keys.
- Attestation: Allows verification that the matching process is as intended and Google is isolated.
- Data Minimisation: Only matched data exits the environment; unmatched data is deleted without Google accessing it.
Confidential matching is now available for Enhanced Conversions for Web and Customer Match via Google Ads Data Manager, with plans to expand to more solutions. Google is also open-sourcing this technology to promote industry-wide adoption.
The Impact of Digital Advertising on Europe’s Competitiveness
Seb from Public First presented findings from a study on the impact of digital advertising on Europe’s competitiveness. The research surveyed over 4200 SMBs and nearly 500 UK businesses, alongside larger companies and publishers across 13 European markets.
Key Research Findings:
- SMB Support: Personalised digital advertising significantly supports European SMBs by aiding customer acquisition, providing a competitive advantage, and driving revenue growth.
- 75% of European SMBs agreed it helps them compete with larger businesses.
- 86% reported increased revenue directly attributed to personalised digital advertising.
- 54% found it helped them acquire new customers.
- Reaching Target Audiences: Personalised ads are more effective than contextual advertising for reaching specific customer groups, with 53% of businesses selling to niche markets finding them more effective.
- Market Expansion: A third of European SMBs reported that digital advertising helps them market products in new markets.
- Measurement: Over a third of surveyed businesses found that ad measurement tools improved their advertising ROI.
- Disruption Impact: If personalised digital ads were unavailable:
- 38% of SMBs anticipated increased marketing costs.
- 46% predicted a decrease in revenue.
- Around half of SMBs and large advertisers would consider increasing prices or reducing staff.
- Publisher Impact: 44% of publishers indicated they would decrease content production without personalised advertising revenue. Many would introduce paywalls or increase ad density.
- AI and Advertising: Businesses are generally positive about AI’s impact, with a third of EU SMBs believing it will save money on creative development and optimise targeting.
The study highlights the vital role of personalised digital advertising for businesses of all sizes and the potential disruption if its use is limited. The findings offer critical insights for policymakers as the digital advertising landscape continues to evolve.
