Panel Discussion: “How new regulations are shaking up adtech”

Check out this panel “How new regulations are shaking up adtech” with: 
Laura De Boel, Partner, Wilson Sonsini Goodrich & Rosati
Cornelius Witt, Group Data Protection Officer, eyeo
Udbhav Tiwari, Senior Manager Global Public Policy, Mozilla
Aurelien Maehl, Senior Public Policy Manager, DuckDuckGo 




⚫ What is AFDS?
 
AFDS 2022 was a hybrid event with speakers from Meta, Opera, Google and many more. Thank you to everyone who took part in making AFDS, the industry event for ad-filtering and the future of web monetization.
 
⚫ What is eyeo?
eyeo, the company behind AFDS 2022, is an online technology and monetization solutions provider dedicated to empowering a balanced and sustainable value exchange for users (end users and the users of other platforms such as browsers), advertisers and publishers. We have a clear vision: Putting you in control of a fair and prosperous internet.
Our 250+ employees are distributed worldwide, working remotely, or housed in one of our offices in Cologne, Berlin, or Malmö. We develop and provide a suite of innovative products and services, with our flagship ad-filtering technology powering some of the largest ad blockers on the market, like Adblock Plus and AdBlock, and our Acceptable Ads Standard reaching over 250 million online users


🛑 Install Adblock Plus : https://adblockplus.org

📲 Install Adblock Browser: https://adblockbrowser.org

💚 Sign up for Flattr : https://flattr.com

👍 Acceptable Ads : https://acceptableads.com

Facebook : https://facebook.com/eyeoGmbH
Instagram : https://instagram.com/_eyeo
LinkedIn : https://linkedin.com/company/eyeo-gmbh
Twitter : https://twitter.com/eyeo

📧 Email - info@eyeo.com

0:00 Introduction
2:00 Will DMA and DSA have a huge impact for EU users?
8:00 How are the new regulations enforced? 
15:00 The future of targeted ads
22:00 targeted ads and the protection of minors
27:00 Q&A 
37:00 Data protection and competition laws
46: Q&A

Thank you, Laura, for this great introduction.

And maybe I can start by telling you how I prepared for this session today.

So we had this speaker training last week.

And I had this coach who gave me tips and tricks on how to moderate a panel, et cetera.

And then I said, yeah, you know, it's from 11 to 12 right before lunch break And then he said oh, that's even worse And then finally he asked me what is the panel about and I said, you know it's this legal panel about new EU regulation, out of text online advertisement.

And then the speaker coach didn't say anything at all anymore.

So having that in mind we want to, even though we might be in a tough spot time-wise and maybe also content-wise, we want to keep this very open and flexible.

We have a little Q&A kind of when we are halfway through with what we want to discuss.

So I just invite all of you to be interactive if you have questions you get to ask.

And we also have a Q&A planned at the end of the session.

And with that, I think we can dive into our discussion.

You know who we are and where we're from.

You know now also a little bit about the key challenges that edtech is facing based on these new laws.

And this brings me to my first quick question, if we could do a quick round with the speakers.

And I'm just wondering, do you think that now that we will have the DSA and the DMA changing regulations for online ad tech, Do we have a better place in Europe now compared to before?

So we're gonna try to be fun, I guess in that particular slot Yeah, definitely, you know, these are I think it's fair to say that these are maybe once in a generation regulations that are going to have a big impact for sure.

But the question for us really is how this is going to be enforced.

And maybe later I can come back to this issue of DAC patterns that actually is already regulated, but hasn't been very much followed by actual actions.

So I think this is going to be the real focus in the coming years.

I mean, we definitely, at least in Mozilla, have worked a fair bit on many of the provisions that Laura just spoke about, as well as transparency, dark patterns, consent for sharing data services.

And we think that while many of these are already present in other regulations, some in data protection, some in consumer protection, the fact that both these acts were very much crafted keeping the largest players in mind.

And as a participant in the internet economy, but not 1 of the large players, we think that they hold great potential to open things up.

But completely agree with the Aulian where it's a question of enforcement.

And enforcement not just in the what do regulators end up doing, but how well do they understand the issue?

How well do they understand ways in which you can very much follow the letter of the law, but not necessarily its spirit.

And we've seen, I think, a lot of that with the GDPR over the last 5 years as well.

So I think it's an opportunity to see whether the ecosystem has learned the lessons from coming up with great laws, but maybe not necessarily going after enforcement the way they should.

And it's something that we're very much looking forward to engaging in.

Yeah, just sort of to add to that, I think companies are looking at enforcement as well, but maybe also, you know, but a bit of a worry because these laws are not the best drafted laws, Which is super exciting as a lawyer, by the way.

I don't understand at all why your coach reacted like that.

But companies are very concerned about what this means in practice and investing heavily into making design choices now to make sure that they comply with both the MA and DSA with a lot of uncertainty.

Because these laws don't spell out what you have to do and also what you have to do when you've got overlap with other legislation like the GDPR.

And so with this enforcement in mind, it's quite worrisome for companies.

Okay, so I get the sense generally good moves, enforcement, and what it actually means remains to be seen.

What do you think is maybe missing from the new laws?

Is there something that the lawmaker did not think about or something that was thrown out through the legislative process which you would have liked to have seen?

Yeah, I mean, you know, during the process we brought our support a few times around stricter rules around behavioral advertising, at least the collection of data that enables that.

But on the other hand, we also see that the final deal does contain a number of important elements.

And generally, the idea that users, both through the DSA and the DMA, should be put much more in effective control of what they want to share and how.

And what matters then is to turn this into designs and products that actually work for users into really deciding what they want to do with the data.

I mean, I think that 1 would definitely be how the definition of what co-platform services within the law, especially in the DMAs, has expanded a fair bit.

That's something that we in our work were advocating for a fair bit of, like, sort of judicious interpretation, because anything that's a co-platform service, while the law really makes it look like it only applies to the gatekeepers, there may be lots of other co-platform services, for example, a browser, which is a co-platform service, that is caught up in the implications of a lot of these laws.

And I think, like, Laura's presentation definitely talks about why while these obligations may just apply to gatekeepers, That doesn't mean that anybody who's not a gatekeeper can go about doing whatever they want to right now, right?

There may even have to be some business model changes.

And we think that those were a little bit of an afterthought in a lot of the rhetoric and the conversation of the law.

And it's something that I think when the subsidiary regulations get created under the DMA and the DSA, it's something that both people should advocate for and should be kept in mind to make sure that 1 of the experiences, for example, with the GDPR was that – and it's an argument that I don't think is completely without merit, is that it ended up creating a regulatory moat around the largest players, which allowed them to comply with the law or seem to comply with the law's harshest provisions, but also ensured that unless you were someone who could invest billions of dollars into trust and safety compliance, data protection compliance, you would never be able to cross that moat again, and therefore they were the only ones who could provide certain services at that scale.

And I think that this is a little bit of an opportunity to try to balance that out, both in terms of, of course, enforcement, and we will talk about it, but also in terms of the regulations that you design under these laws as well that account for what happens to gatekeeper platforms and what happens to platforms impacted by these regulations but are not gatekeeper platforms.

And now that you, that I think all of you mentioned in enforcement, maybe we can dig a bit deeper.

And I also, from my daily work, I also see the struggles with enforcing of enforcement of GDPR, even though the GDPR is now here for quite a while.

And then you have a lot of different authorities, and there's 1 national 1 in each EU country.

For us in Germany, you have 1 for each state, so it's super fragmented, everything takes forever.

And, yeah, I think a lot of people argue, and I have some sympathy for that argument, that the enforcement part of GDPR falls short.

How, maybe twofold questions, A, how is this foreseen, especially with the DMA, will there be like a new authority, new thing where a lot of people work and go after the big companies.

So how is this foreseen and also what are your wishes or hopes, how this enforcement should look like that we end up having not only new rules but actually having them implemented?

So just on what it would look like in practice, I think they're going to be, if I understand this correctly, right, They're going to be adding more people and resources to the commission, I think to existing units in the commission.

They're not creating a new body for enforcement.

We've seen with the GDPR that that's fragmented enforcement, which is at the national level, is not helpful.

Maybe it's helpful actually for big companies who most of them have their HQ in Ireland and know that the Irish Data Protection Authority is just a bottleneck for GDPR enforcement.

And that's been heavily criticized under the GDPR.

Issue is I mentioned other laws that are being made in the EU as well.

Same thing, like AI Act will have national enforcement as well.

And so I spoke with someone at the European Parliament about this exact issue and said, well, actually a lot of people in the institutions would want some centralized enforcement for all these digital laws, but it's just not foreseen.

It's not foreseen in the budget that they have for years to come, and it would probably require a lot of political will to bring enforcement power at the EU level and taking it away from the national level.

So even though I think it would make a lot of sense, I don't know if it would happen anytime soon.

Yeah, you know, like, it's, I think countries were very sensitive with the GDPR experience and really wanted to avoid floating in the same situation, but they also did not want to put in money to create a new agency, so they did the default choice of saying, well, the European Commission can do it.

And so we're going to have these new regulations, and the European Commission, which finds itself suddenly with having a whole new enforcement power, which wasn't the case before, or in a much more limited way.

So clearly, we are part of companies that are really asking very clearly for more resources for the commission.

If you put that level of responsibility to the commission, they need to have the resources that go with it.

But the good news is that they do have very important experience in dealing with large companies in the tech sector, especially when it comes to antitrust.

And so a number of people that are currently dealing with antitrust cases, they are going to be the ones dealing with the DMA sort of things in large parts.

And it's good that they can draw from that experience and maybe move to some place that is a bit less like kind of looking at specific cases and sanctioning behavior after it happened to instead try and build some more like core regulatory approach where, you know, we can get to a place where companies adjust their behavior before any sanction comes.

I mean, I think that we'll disappoint your vocal coach if we don't end up cracking, you know, using some, like, lawyer-y Latin terms.

But I mean, the DMA is a legislation, and the DSA in a way are both ex ante regulations.

And what that means in practice is that they're regulations that don't just get enforced when you do something wrong.

Like if there is a law that says this is what you should do as a law, And if you breach that law, then there is premedial actions taken, which means that if you're not supposed to pick up a water bottle and you pick up the water bottle, the government can come and tell you you shouldn't have picked up that water bottle.

But these laws are actually more about both more subjective enforcement, but also in preventing certain kinds of harms from occurring in the first place, right?

And I think, Ali, sort of hinted towards that direction by saying a co-regulatory, like, the intention is not, say, this is what you are supposed to do and not supposed to do.

There are provisions like that in the law.

But also, this is the kind of behavior we want to encourage, and this is the kind of behavior we want to discourage.

And that distinction is a pretty important 1, because of the rate of evolution of technology, it's very hard to come up with how many have 100, 000 words that you want that encodes a certain set of behaviors.

And 10 years later, you might have technology that makes a lot of it very relevant.

And I think we are starting to see that even with some parts of the GDPR as well.

And I think that that distinction, that flexibility that the law quite deliberately, I think, provides is both the opportunity and the – like, something to be a little wary of, because the opportunity, of course, is that that means the regulator that is being set up in the commission is not just going to be, here is a letter, we are filing a case against you, right?

It will be a, we are coming up with a code of conduct.

That code of conduct says that in this field, this is how you're broadly supposed to behave.

And on that behavior, if you don't follow it, then we will launch an investigation.

But if you think you're following that code of conduct broadly, then things will be better for consumers.

That flexibility of It's something that actually in many other sectors I think is a lot more mature because they've been around for much longer.

If you look at the automobile sector, if you look at like I think the airlines industry and the aviation sector, the amount of back and forth between industry participants and regulators is much more than it has been traditionally in the tech sector, but the tech sector in a way in these regulations is like 15 years old, probably even lesser.

So because of that, I think that's also from an enforcement perspective an interesting angle, which is not just saying what is allowed and not allowed, but encouraging certain kinds of behavior.

And I would maybe add the hypothesis at least that then you could also believe that the laws are more future-proof when you don't define exactly everything in great detail, but if you follow this co-regulatory principle based approach similar like GDPR in some cases, then you have also covered future technologies that you are maybe not aware of that it might be a problem already.

This brings me to another question, and it's something that Laura, you also explained in your introduction.

So 1 of the provisions of the Digital Services Act covers this targeted ad span on either sensitive personal data, so political beliefs, for example, or medical information, et cetera.

And we learned yesterday a little bit how hard it is to say what is political and what not, but maybe we packed it for a second.

And the second provision is that there should be no more targeted ads facing children and minors.

But I recall from the debate, the parliament and some parties in the parliament, they tried to push a complete ban on targeted advertisement.

So it was debated for quite a while if the law should say no more ads targeting people based on any kind of personal information.

And obviously, this was a huge debate in our industry.

And I remember on both sides of the arguments, very, very vocal debates.

We learn now that we ended up with kind of a middle ground compromise.

But still, I think the question is very interesting to think about how personalization for ads should work online, because of course you have the privacy and the user interests and rights on the 1 hand, and then you have also the arguments, of course, from the publishers and the advertisers, who say, you know, we need some form of personalization to monetize our content and to keep content free.

So even though the legislative debate is now on that ban over, at least for now, maybe, Oryel, if you can share what your take was on this proposal, and then also what your general thoughts are on this balancing act of the 2 interests.

I mean, when that targeted ban conversation was taking place, we as Mozilla didn't.

We were actually 1 of the, I think, a lot of people expected us to sign on to the thing that said ban all targeted advertising.

And the primary reason that we did not is because we did a fair bit of work internally to determine, imagine this were to pass, and by, say, early

you were not able to target people on the basis of personal data.

What would its impact on the internet be?

And what is the outcome that the people who are pushing for the ban want?

And we thought that they were 2 quite far apart.

At least we think that eventually there is a world and an outcome where the privacy harms that arise from targeted advertising, I think, significantly override the benefits that come from targeted advertising, but we don't think that the ecosystem is ready to do or to serve advertising without targeted advertising.

So we think it will be like taking a hammer to what is a very delicate problem.

And internally, at least, the way that we've been approaching it is what, at Mozilla, we broadly call privacy-preserving advertising, which are ways in which targeting can take place, but without the privacy harms that occur.

And for us, the privacy harms actually begin with collection itself.

So Ben, who just gave the presentation before this when he was talking about IPA, a lot of folks have been pretty surprised that Mozilla is really working with meta on something to do with advertising.

And our response to that has been very clear, which is that we think that it is the most tangible and thought-through way that we've come across in all of the – and we've been part of these groups for many years

that actually attempts to do something like attribution without collecting people's data and without leading to outcomes that, like I think Ben mentioned, even if a service provider is compromised, will protect user information as well.

And the way that we see it, it's a gradual process.

It's clear that in the short term, there needs to be a lot more research, things like, does contextual advertising work?

Are there ways in which it can be improved and be made better?

In the sort of, like, medium term, What are the technical solutions that allow for similar outcomes without the harms that we are associated with?

And in the long term, that's where we think the question of what kinds of behavioral advertising is OK and what kind of behavioral advertising should actively be prohibited is a conversation that we should have.

But we think it's, like, at a minimum, a five- to ten-year, like, conversation, not 1 that – like, there are definitely merits and benefits to pushing for, you know, like, banning – because that moves the conversation forward, and it's a movement, so there are – in the whole spectrum of people in that movement.

What was your position on the proposed ban?

Yeah, you know, the approach we have on this is that in our case we've been profitable since 2014 on the basis of contextual advertising.

And so, you know, we tend to think that should more investments go into that type of advertising, it's something that would also become, you know, much more popular for the whole ecosystem.

So that's why we tend to have this sort of position on behavioral ads.

But another very important point for us is that users are able to make a choice for their own privacy.

So that's the philosophy behind our product, right?

We are trying to be not just a search engine that is a track queue, but also the simple button for privacy wherever you browse and whatever app or device you use.

So that's what our extension does on browser.

It blocks the different third-party trackers.

That's what our app tracking protection does on Android that we're going to release from beta at some point.

That also blocks trackers within your phone coming from the different apps.

And it's really important that these features are able to work properly.

And that's also where once more regulation of the DMA can be useful in ensuring that apps like ours have access to the right features and functionalities on a device, on a browser, to make these features work properly.

Usually those discussions about banning targeted ads, for example, bring in very much thoughts and reactions, so we want to open up now our half-time Q&A in just a second, so you can get ready.

Before that, I want to ask 1 more question, maybe, Laura, to you, because you also briefly mentioned this.

The way the targeted ad spend now ended up being in the law is, among other things, those protections of minors when it comes to this.

And I'm very curious how this will work in practice, because obviously most publishers don't know how old their users are.

And then I think when you go on a website of a beer manufacturer or something, they have RU18, and then you can click Yes, and nobody checks.

Then I think if you need a verification, then you end up processing more personal data in the end.

So just curious if there's already some guidance or some ideas on how to actually make that work.

And I'm curious just as you are and so are many companies.

So the DSA provides that you can't target users with targeted advertising if you have reasonable certainty that the users are minors, but you don't have to collect more information about their age than you already have.

At the same time, under the GDPR, there's more and more companies implementing age verification mechanisms on their websites because of regulatory guidance, in particular in the UK and Ireland, that recommends that you verify the age of your users so that you can adapt the design of your services to the age of your users.

You can ensure that your privacy notice, for instance, is understandable if you have users who are minors.

And so we see that for those reasons there's more and more age verification.

But if you do that and you want to comply with that, it means you are going to have more knowledge about the user's age, which means you're making it more difficult for yourself and the DSA and bringing you into the scope of that targeted ad ban for minors.

So how is that going to play out in practice?

What we see in practice now, unfortunately, is a lot of companies who we see from their counter parties in contract negotiations very strict contractual provisions, don't send me any data that includes kids, don't send me any data relating to minors.

And that might actually be very difficult if you don't know or you don't have that certainty.

So how are you going to comply with that?

And then the question is, you know, what's your negotiation power?

So that's actually sort of an unfortunate result that we see from this DSA provision right now, that some companies just have that negotiation power and they say, well, we don't want to deal with this, you don't send me any data that might bring us in scope, even if you have no clue what data you're sending us.

So and same questions you can ask about the practical implications of that other ban, using sensitive data for targeted advertising.

So that, as well, it seems like a good provision.

I'm not sure if any of us would want targeted advertising using race, ethnicity, sexual orientation, like the sensitive information.

Why would you want to receive targeted advertising using that information?

But again, under GDPR, and the DSA refers to GDPR to give meaning to that concept of sensitive data, But under the GDPR, there was actually quite big development this year at the highest court of the EU, which issued a judgment in which it stated that when you publish someone's name together with the name of their spouse, that's sensitive information, because you can infer that person's sexual orientation from that data set.

And that's actually a big, big thing in the privacy community, because it means that if a data set In itself doesn't seem sensitive information, but you can infer sensitive information from it.

It should be treated as sensitive data under the GDPR and it becomes in scope of that concept of sensitive data under the GDPR.

And that's the concept that is used in the DSA, it's copied into the DSA.

So potentially that ban is actually much broader in scope than we initially thought and legislators initially thought when they drafted this.

So again, practical things to worry about and be curious about.

But at least your job will stay very challenging and excited, I guess, when you work with a lot of negotiations like this.

But having said this, and also looking At the time, maybe we see if we throw around the blue cube and see if we have already some questions coming in.

So I think yesterday we learned that what is a political ad is very open-ended, right?

Because it can be anything with Joe Biden's face, or it could be a neutral United Nations advertisement that might just be political because the UN is featured.

And I wanted to bring in this thought with the provision on minors in the DSA and ask Laura, actually, in your opinion, what is reasonable certainty?

And is there maybe like some sort of workaround?

Because isn't there many ways to infer a minor, right?

Like the amount of time they spend on TikTok, or their certain preferences.

And I was wondering if that could be maybe an opportunity for certain platforms to not have to process certain sensitive information, but identify minors, or if that could also be a loophole for companies.

And I wanted to kind of get your thoughts on that.

Yeah, I think if you look at guidance under the GDPR, there are different ways of verifying the age of your users.

And for instance, regulators are more and more saying, it's not sufficient to just have a tick box.

A kid knows that they have to select a different tick box.

So, actually what regulators are looking at is AI, like using AI tools to assess the behaviour of these users.

And that gives you an indication of their age.

So there's, yeah, there's definitely, like, new things being developed to help with that.

I don't know if that's then a good thing or a bad thing, because as I said, the more knowledge you have about the HFU users, the less argumentation you can make that you're not subject to that ban.

So it's many different things to think about.

I mean, the only thing that I'd add to that, and I think it is an example that's happened in a different field.

Like, it didn't happen much in Europe, but it's something that was enforced in the United States where over the last 3 years, both Twitter and Facebook were discovered to have targeted ads on users on the basis of their phone numbers that users had shared for two-factor authentication for security.

So when you were signing, creating your account, if you wanted to receive an OTP before logging in for security, they asked you to enter your phone number, and a lot of users said Yes.

But it turned out that they used that as a unique identifier when they showed ads to you both on their platforms, but also on other platforms without disclosing it at that point.

Both of them were fined a couple hundred million dollars.

Both of them had to disclose the fact that they were doing this.

But I think that's a pretty good example of intent, where even if you're collecting data for 1 piece, I don't necessarily think that there was a big board in a dark room that said, yes, we will use phone numbers to target ads on people.

It was much more of a, what is the information that we have on people?

This, what are the best unique identifiers?

And then the security teams and the privacy teams and the ad team spoke, and they said, and they probably went, we shouldn't maybe be doing this, but look at it.

That's, I think, the kind of risk that we run in these scenarios and situations as well, where once you're gathering information and data, like, companies are actually not that great at knowing all the information they have and what they should use and what they should not use.

The largest companies and, like, companies from our experience, at least, below that, sometimes are even less, from a capabilities perspective, capable of knowing what they should and should not do with certain kinds of information.

But that still means things like this can happen, even if it's without intent as well.

And I think all of the age verification questions just lead to more outcomes like that.

That if you have an AI that is analyzing people's behaviors well enough to determine when they're under an age or above an age or not, are you really going to use that AI just to show what kind of checkbox you should show?

Or would you also use that to do other things about that user, like deciding which video they should see next, or what features should be tested on them?

And it's very hard to tell a company, use it only for this, but not for that, and to enforce it.

So 1 of the things of DMA is consent, gathering consent from users.

See all eyeo transcripts on Youtube

Panel Discussion: “How new regulations are shaking up adtech”, AFDS22