What is digital advertising?

Digital advertising (often known as adtech) is a term used to describe the software and participants involved in a complex ecosystem which facilitates the delivery of online adverts. It enables brands and agencies to target advertising spend at users who are more likely to have an interest in their products/services and to utilise the data they collect (including to analyse the outcomes and return on investment of their campaigns).

Digital advertising has grown at a rapid rate and is now the biggest advertising channel in the EEA, generating more revenue than all other advertising channels combined. It is, however, sometimes criticised for compromising consumer privacy especially where adverts are targeted at a user based on their demographic information, location and/or interests (although this is not the case with all digital advertising).

There can be significant data exchanged and processed at lightning speed when a targeted advert is served. Regulatory compliance continues to be a challenge due to the multiplicity of companies involved and the cobweb of data flows, often resulting in a lack of understanding of the transactions, in turn, resulting in a lack of transparency.

What parties are involved?

It is challenging to generalise as there are different models of digital advertising and different participants can be involved. Often, though, there are multiple participants in any given digital advertising transaction including the advertiser, advertising agencies, demand side platforms, supply side platforms and publishers.

In very simple terms, demand-side platforms help advertisers and agencies automate ad-buying and execute digital advertising campaigns while supply-side platforms are used by digital publishers to manage the sale of available advertising space (often referred to as "inventory").

Typically, the various companies involved in digital advertising will comprise:

• ad servers which deliver and manage the ads so users can see them, and allow tracking of how users interact with ads
• supply-side platforms used by publishers to manage the available ad space and make it available to advertisers
• demand-side platforms, used by advertisers and ad agencies to manage their online ad campaigns and bid for and buy the right to show their or their clients' ads
• data management platforms who provide, or provide the technology to facilitate, the addition of enhanced information about users so advertisers and agencies can better target their ads and their budgets on users more likely to be interested in their products
• ad exchange – open marketplace for the buying and selling of ad space
• measurement and attribution partners who report to publishers and advertisers/agencies on the extent to which an ad was properly displayed, viewed and/or clicked on and whether the ad contributed to a purchase by that user (or other result that the advertiser wanted)
• invalid traffic/anti-fraud providers who try to ensure that 'users' seeing ads are human and not bots (software that mimics real-life users in an attempt to generate fraudulent revenue).

How does it work?

The process is complex and involves multiple parties, with transactions, bids and exchanges of data happening in milliseconds.

Real time bidding vs Direct Deals

Real Time Bidding (RTB) is a type of programmatic advert buying that allows multiple advertisers to bid to have their advert shown, using algorithms to determine the price of the inventory. Advertisers can then place their bids (usually through their demand side platforms) for the inventory via a virtual auction which happens in real time.

RTB contrasts with 'programmatic direct' where a human element is added and publishers sell premium advertising slots directly to advertisers (or sometimes, through a private auction, make inventory available to a small select group of advertisers to bid on). Once such a direct deal contract has been negotiated and agreed, digital advertising platforms are typically used to automate the campaign, serve the adverts and report to the advertiser on its success.  

Real Time Bidding has attracted more attention from a regulatory perspective because of the large number of demand side platforms who can bid on the inventory (sometimes in the thousands), each of them receiving personal data relating to the end user.

How is it regulated?

Digital advertising is regulated by a patchwork of rules. In the UK, the key pieces of legislation are the UK GDPR and the Privacy and the Electronic Communications Regulations (which implement the EU ePrivacy Directive).

A wider lens than the UK is typically required due to the complex cross-border data flows that bring privacy laws from all over the globe into play. For example, the US is currently seeing privacy laws introduced across States (including the California Consumer Privacy Act and the California Privacy Rights Act) and there is talk of a federal privacy law.

Regulation will only increase going forwards. The UK government's Online Advertising Programme will review the regulatory framework of paid-for online advertising in the UK. It aims to tackle what the government has described as "the evident lack of transparency and accountability across the whole supply chain". The review is happening in tandem with the introduction of the Online Safety Bill.

Separately, the UK Information Commissioner's Office (ICO) began an investigation into online advertising back in 2019. It was paused (largely due to the pandemic) and while resumed, its status is currently unclear following the change of Information Commissioner. 

The situation is also evolving in the EU with new laws such as the Digital Services Act placing transparency obligations on online platforms to provide information in relation to each specific advert including the legal person on whose behalf the advert is presented, who paid for the advert and the parameters used to determine to whom the advert is directed.

Regulators are taking note of the digital advertising industry's extensive use of personal data and the issues with transparency and consent under the UK and EU GDPR and ePrivacy legislation. Many have pinned hopes on the IAB Europe's Transparency and Consent Framework (TCF) designed to address data privacy concerns. However, a decision from the Belgian Data Protection Authority (APD) in February 2022 sent shockwaves across participants in the digital advertising ecosystem.

As we discuss in more detail here, the APD is of the view that the current version of the Transparency and Consent Framework (TCF) which is used across the industry and seeks to address the regulatory challenges in Europe around user consent and transparency, is not in conformity with data protection laws. In particular, they consider it insufficient for the purposes of obtaining consent from data subjects and providing transparency. Players in the industry are waiting for a ruling from the ECJ on the outstanding questions of whether user consent signals via the TCF can be considered personal data under the GDPR and the definition of joint controller. In the meantime, IAB Europe (which designed and operates the TCF) and the Belgian DPA have approved the IAB's proposed plan to resolve the DPA's objections. This has however, also run into issues following a further appeal from IAB Europe, and the six month implementation period has been temporarily halted.

Is the cookie crumbling?

The changing privacy landscape in programmatic advertising will lead to the demise of the third-party cookie. Ad blockers have been available in the form of browser plugins for over a decade now. Tech giants including Google plan to phase out third-party cookies from their web browsers.

A third-party cookie enables advertisers to follow users across the web (in its traditional desktop and mobile incarnations) and to track and re-target individuals. Initiatives such as Google's Privacy Sandbox (being led by Google to encourage privacy centric web standards and practices) aim to build new privacy enhancing technologies as an alternative to third party cookies.

This may mean that advertisers will depend primarily on their own first-party data to gain insights into user preferences and behaviours, making it much harder to track users across the web and serve them targeted adverts. The concern of marketers is that this will lead to less effective advertising and a reduction in the overall size of the digital advertising industry. It will also make it difficult for publishers to monetise their websites.

What's next?

Enhanced regulation and a change in approach are on the horizon. Consumer privacy concerns as well as enhanced machine learning and natural language processing capabilities are driving a shift towards contextual ad targeting. It works by matching the content of a webpage with the content of an advert instead of using personal data pertaining to the website user to target adverts.

A recent study commissioned by the EU Executive's digital department alludes to reform of digital advertising on the basis that the current approach is "unsustainable for individuals, publishers and advertisers". While we await the ECJ's decision in relation to the TCF, the implementation of the Digital Services Act, and the outcomes of the various investigations and consultations, the ecosystem is likely to continue to evolve.