How GDPR Feeds into the Hands of the Duopoly
The EU’s General Data Protection Regulation is nearing its two-month anniversary, and its effects are still somewhat unknown. The sweeping legislation had lofty goals – it was designed to standardize Europe’s data privacy laws, give citizens greater control over the use of their own personal data, and force organizations to be more transparent in their reasons for tracking users’ data.1
Since its creation, much of GDPR’s public intrigue has concerned the possible ramifications of the new law on large tech companies that utilize personal data for programmatic advertising and audience targeting.
For this reason, all eyes have been on two advertising behemoths since the regulation’s introduction: Facebook and Google. The duopoly dominates global advertising – global digital ad spend was $228.4 billion in 2017, and Google and Facebook reported a combined $151 billion in digital ad revenue.2
EU Justice Commissioner Věra Jourová visited with representatives from the tech giants last fall, expecting them to show signs of nerves with GDPR’s adoption rapidly approaching. Instead, “they were more relaxed, and I became more nervous,” she said to The Wall Street Journal.3
Two months in, worries are setting in that GDPR will fail to rein in the power of Google and Facebook. “As history has shown, we believe that regulation will embolden the incumbents and increase their market share at the expense of smaller tech firms,” said Mark Kelley, an analyst at Nomura.4
Here are some reasons why the duopoly is marching on, seemingly unscathed by the EU’s new privacy laws.
Google Flexes its Muscle
Google, a dominant presence in the digital advertising industry, has been vague about its ongoing GDPR compliance efforts, much to the chagrin of agencies, publishers, and smaller ad exchanges.5 Many believe that this approach has been strategic, allowing Google to take advantage of the new privacy laws.
On May 24, the day before GDPR’s adoption, Google warned advertisers not to buy any ads on their platform DoubleClick Bid Manager through third-party exchanges, because Google could not verify that they were GDPR compliant.6 Instead, Google instructed advertisers to only use their own exchange – temporarily devastating smaller exchanges.7
This warning had widespread effects – European advertisers used Google for 95 percent of ad buys on the first day of GDPR enforcement, whereas only 50 percent used Google’s exchange three days prior.8
Angered by the last-minute move, three major European publishers released a harsh joint statement: “Google is effectively putting a gun against publishers’ heads. This is a flagrant abuse of their dominant position.”9
In another alarming move, Google is now forcing all ad exchanges that help publishers buy ads through Google’s DoubleClick Bid Manager to sign a controversial consent guarantee agreement. The agreement states that the exchanges and publishers are 100 percent liable for any GDPR violations brought against DBM.10
If the agreement is signed, exchanges and publishers must ensure that all of their users have given consent to Google’s list of over 200 vendors. The companies are furious that they are being forced to assume all liability, arguing that GDPR gives people the right to withhold data from individual vendors.11
Unfortunately, Google’s partners have their hands tied. “They’re the largest ad network. You’re not going to not use them,” said Chris Tolles, CEO of Topix, a news media company.12
Facebook Relies on Reach
Like Google, Facebook has also used its position as a dominant advertising platform to charge forward amidst the GDPR chaos.
Pre-GDPR, there were worries that Facebook’s ad revenue would fall if users opted out of data-tracking in large numbers. CEO Mark Zuckerberg, though, seems encouraged by early consent numbers.
“One of the things that I found interesting is that the vast majority of people choose to opt in to make it so we can use the data from other apps and websites they’re using to make ads better,” Zuckerberg said. “The reality is that if you’re going to see ads in a service, you want them to be relevant and good ads.”13
Facebook’s greatest asset is the sheer size of its userbase – Facebook has 2.2 billion monthly users and estimates that over 1 billion people view an ad on Facebook every month.14
With such a large audience, many people would need to opt out before audience targeting was no longer feasible. But even if large swaths of users decline consent, Facebook could offer different advertising opportunities that would still be extremely attractive to advertisers.
“Facebook has tremendous reach. If they weren’t allowed to mine the personal data on the news feed, what could you still do for advertisers? A lot,” said Johnny Ryan of PageFair. “It can put in place more broad, contextual ads, as long as it isn’t using personal data. Then, you can give the advertiser reach and compliance.”15
Embroiled in several privacy scandals as of late, all eyes have been on Facebook to see how it improves privacy settings in the wake of GDPR. In a surprise move, the social media site decided to comply with GDPR’s rules globally, offering all users the ability to see how their data is being used by the company and even opt-out of data processing.16
GDPR Erects Barriers to Entry
Europe’s new privacy regulation not only aids the industry’s major players, but also erects barriers to entry for smaller tech firms.
Most notably, data from the Minneapolis Fed shows that GDPR compliance imposes a huge financial burden on small companies. For a company with less than $100 million in assets, the financial burden is four times higher than it is for a company with between $1 billion and $10 billion in total assets.17
This obviously favors Google and Facebook, as the two companies have the legal and financial muscle to implement a complex compliance plan and deal with any possible violations.
In addition, there is fear that the duopoly has set an industry standard for GDPR interpretation that will be difficult for smaller firms to achieve. The two tech giants have sophisticated compliance systems in place as well as direct relationships with their consumers, allowing them to navigate the process rather easily.18
Many smaller firms do not have the money or name recognition to weather the storm. Two months in, it’s possible that GDPR will leave Europe with “only the largest of global players to serve the needs of its citizens, which is precisely the type of company EU regulators seem to loathe.”19
1. “EU GDPR Information Portal.” EU GDPR Portal, 2018.
2. Markman, Jon. “GDPR Is Great News for Google And Facebook, Really.” Forbes, Forbes Magazine, 23 May 2018.
3. IBID
4. Markman, Jon. “GDPR Is Great News for Google And Facebook, Really.” Forbes, Forbes Magazine, 23 May 2018.
5. IBID
6. Davies, Jessica. “’The Google Data Protection Regulation’: GDPR Is Strafing Ad Sellers.” Digiday, Digiday, 4 June 2018.
7. IBID
8. Bergen, Mark. “Ad Industry Fear of Google Briefly Confirmed as GDPR Starts.” Bloomberg, Bloomberg, 29 May 2018.
9. IBID
10. Peterson, Tim. “’It’s Impossible’: Google Has Asked Ad Tech Firms to Guarantee Broad GDPR Consent, Assume Liability.” Digiday, Digiday, 12 July 2018.
11. IBID
12. Peterson, Tim. “Google’s Go-It-Alone Approach to GDPR Rankles Publishers.” Digiday, Digiday, 14 May 2018.
13. Lomas, Natasha. “Facebook, Google Face First GDPR Complaints over ‘Forced Consent’.” TechCrunch, TechCrunch, 25 May 2018.
14. Swant, Marty. “The Facebook Audience Network Now Serves Ads to 1 Billion People Each Month.” Adweek, Adweek, 12 Jan. 2017.
15. Davies, Jessica. “The GDPR Is Coming and Will Change Facebook Ad Targeting.” Digiday, Digiday, 18 Apr. 2018.
16. Constine, Josh. “Zuckerberg Says Facebook Will Offer GDPR Privacy Controls Everywhere.” TechCrunch, TechCrunch, 4 Apr. 2018.
17. Udland, Myles. “Regulation Will Only Make Facebook Stronger, Analyst Says.” Yahoo! Finance, Yahoo!, 11 July 2018.
18. Sweeney, Erica. “GDPR Will Help, Not Hinder, Facebook and Google, Competitors Say.” Marketing Dive, Marketing Dive, 25 Apr. 2018.
19. Gapper, John. “Facebook and Google Are Arbitraging the Data Laws.” Financial Times, Financial Times, 11 July 2018.