Re-Architecting Digital Media for Predictable User Privacy

Project Rearc One Year Later—Recent Releases for Addressability, Privacy, and Accountability

A year ago at the IAB Annual Leadership Meeting (ALM), we initiated Project Rearc as a global industry effort to focus on technical standards for preserving addressability with privacy and accountability, in response to the fact that third-party identifiers are set to be sunset by 2022. Then in July of last year, we joined forces with the Partnership for Responsible Addressable Media (PRAM), adding critical business and policy stakeholders.

Over the past several months, in collaboration with PRAM’s other working groups, we engaged in an industry-wide process to:

Understand the problem and educate our industry on the impact;
Consider technology alternatives—staying on top of ongoing changes and proposals by browsers, operating systems, and others; and
Design approaches that can move the industry forward responsibly—developing the standards necessary to fuel proprietary innovation, competition, and an open playing field.

So what did we learn?

It’s an understatement to say this is a complicated problem. Companies and governments (even state-by-state in the U.S.) have many fragmented approaches to solutions. And there is no shortage of perspectives, speculation, and confusion (such as what followed Google’s March 3, 2021 blog post, which we’ve just clarified within our own blog post). While we all want to know exactly how the future looks for addressability, there are still no guarantees other than continued evolution and disruption. This said, we can place some bets with confidence.

The Bets We Can Make

First off, with a perfect storm of increasing consumer concerns, privacy legislation in every region, and browser/OS/other platform changes, Privacy-by-Default disruption is happening and we cannot expect today’s digital ad infrastructure to operate in the same way going forward. If you don’t fully understand how the global changes in privacy and technology affect your business, you need to.

Second, we must recognize that data use permissions are now between consumers and the brands they explicitly trust. Consumers want to have options for privacy and personalization, so they can make different choices…even among publishers and brands they trust. Uniform controls and choices should be offered to consumers consistently across platforms and devices, and choices must be respected reliably by all parties in the ads/media ecosystem. This is what we call “predictable privacy”—consistently presented and reliably honored privacy controls.

Third, we must be absolutely certain that user preferences are respected. The only way to do this is by ensuring that their choices are reliably captured, encoded within a standard format, and passed through the ads/media supply chain. We must step forward voluntarily as an industry to be held accountable—through auditable data structures that can quickly identify who is involved in the delivery of digital experiences and can surface any erroneous or malicious non-compliant behavior.

Why? Because we can’t ask consumers, regulators, browser/OS platforms, or even our own partners to trust our systems if there’s no way of verifying for ourselves. We cannot preserve addressability without privacy and accountability.

Fourth, we must accept that open standards, developed collaboratively, are critical to all stakeholders. Think about the complexity involved if every digital advertising use case varies in HOW it is to be executed based on device, operating system, media channel, browser/app, user controls, publisher, marketer, vendor privacy jurisdiction, and user location! Only open standards can simplify execution and interoperability while, most importantly, providing users with predictable, consistent privacy features across their ad-supported digital experiences.

And, fifth, we must collectively discourage and admonish short-term technology “work arounds” to these realities we face, and instead focus on long-term, sustainable approaches. Let’s work together to ensure data protection for consumers and the brands they trust, and a level playing field for all participants—this is how we fuel the next wave of innovation in the digital economy.

A Portfolio Approach to Addressability

While there’s no silver bullet, with open standards and a strong foundation of accountability, addressability can flourish. A portfolio approach to addressability will be needed, as unconstrained ad tracking continues to be limited globally. We see three key areas for innovation in addressability:

First-Party Audiences, now disconnected from other audiences, are one safe bet. With no 1:1 link to advertiser audiences through cookies, IDFAs and the like, this is where seller-defined audiences, contextual signaling, and private marketplaces play their roles.
Browser/OS-Linked Audiences (e.g., Privacy Sandbox) will also be part of the portfolio—albeit new, untested, and disruptive. They propose to allow publishers and advertisers to connect audiences for addressability use cases—including measurement and attribution (e.g., SKAdNetwork)—but without tracking.
1:1 Linked Audiences, linked between publisher and advertiser, using either an explicitly opted-in device-based ID or secure, user-enabled ID from a login, email, etc. potentially connected to a clean room approach. Note that we are not suggesting that email is the only solution, but when it is used (as with Unified ID 2.0 or any first party login solution, including Google’s), it has to be secured, have transparent uses, and offer consumer privacy-focused controls.

There are also other offerings in-market that use artificial intelligence (AI) / machine learning and other approaches to connect audiences across sites/apps. A closer look here is warranted, especially to ensure that there isn’t a risk of unconstrained, unauthorized data leakage.

Tech Lab’s Releases for Addressability, Privacy, and Accountability

Within the context of our findings over the past year and the three approaches described for addressability, we released an initial set of four standards for comment, which draw from existing standards in-market.

No identifier? No problem. The Taxonomy & Data Transparency Standards to Support Seller-Defined Audience & Context Signaling enables publishers to achieve scale by passing anonymized, seller-defined audience and contextual attributes to buyers within OpenRTB (real-time bidding), when no user-provided or third-party identifier is available.

Our Best Practices for User-Enabled Identity Tokens Guidelines aims to ensure security and consumer privacy in scenarios where publishers and marketers offer personalized content and services tied to a user-provided email or phone number.

The Global Privacy Platform is a specification for encoding regional user data rights and references into a standardized format for the entire supply chain, simultaneously improving user transparency/control AND industry compliance amidst ongoing regulatory evolution.

And finally, the Accountability Platform is a specification for open, auditable data structures and standard practices to reliably demonstrate digital advertising supply chain conformity to references and restrictions set by users and the digital properties they visit.

Industry Call to Action

We know our industry wants feasible solutions to preserving addressability with privacy and accountability. We want to know what the future holds! Well, we have the opportunity to influence the outcome. Here’s what we need from you:

Plan for a portfolio approach to the aforementioned addressability scenarios.
Ensure the feasibility and durability of those scenarios by supporting accountability in 2021, and by insisting your partners contribute Accountability Platform data in 2022.
Support open standards and predictable user privacy. Join the relevant PRAM and Tech Lab working groups—there is much more work to be done!
Invest in consumer engagement: education, transparency, controls, and earning opt-ins.

Together, we can improve rapidly on the base we’ve built as an industry, ensuring addressability is maintained with built-in privacy and accountability.