With the introduction of GDPR, we have seen many instances of advertisers losing reporting and optimisation granularity because of cookies and unique identifiers being considered ‘personal’ data. This can cause remarketing and new prospecting strategies to suffer, which can lead to a reduction in advertising spends, and more importantly, ROI.
What is the benefit of using personal data?
Personal data can be used to enrich your database of potential prospects.
- Understanding user-level demographical information to refine media targeting to the specific age, location, and gender of the people who convert.
- Identifying an individual to understand their behaviour across multiple media platforms to generate stronger attribution strategies.
These targeting techniques have been crucial to the growth and optimisation of digital over the past 5+ years and the increased concern around user-level data due to GDPR has generated some concern in the industry. However, the impact of new ‘personal data collection rules’ coming through due to GDPR may not be as drastic as some might expect, but this does not mean that the way we work to collect and repurpose this data at the moment will not need to change. Some various tools and processes can be used to still ensure digital optimisation and targeting can continue to be effective at a granular level; including GDPR Data Processing Agreements (DPA), the Google Ads Data Hub (ADH), and secure bespoke data warehousing techniques.
Data processing agreements
If you are collecting personal data for a specific reason, such as postcodes collected for out of home targeting, the process will now require some additional steps to ensure the information is collected, stored, and shared securely and legally. You need to ensure that the user has given the right type of consent to collect their personal data and that the privacy and cookie policy outlines exactly what is collected and the reason why.
For most scenario’s, All Response Media functions as the data processor when we handle personal data for our clients’ media campaigns, and the client is the data controller. For personal data processing, GDPR requires sufficient process and restriction documentation is in place through requiring a (DPA). This is a way for the data controller to outline the specific purpose and usage limitations of the personal data and ensures that data is only used per the client’s privacy policy (and consent).
It is important to note that All Response Media cannot provide legal guidance with regards to GDPR and the above should not be seen as such. Although we are more than happy to advise about what personal data might be involved in the processing we perform and how it may be worded in the privacy and cookie policies, we suggest that clients discuss their consent management with their GDPR representative as needed.
Google Ads Data Hub
Google recently developed and is slowly releasing the ADH. This platform is designed to collect data from all Google-owned platforms and aggregate the data for attribution analysis and retargeting, but without exposing any user-level identifiers. Furthermore, first-party user-level data can be uploaded and joined with Google’s event-level ad campaign data to facilitate improved advertising efficiency.
This sounds like a great future solution for secure user-level merging, but worth keeping in mind that the upload (processing) of personal data will still require DPA documents (potentially multiple) and the relevant consent as per GDPR. ADH is definitely something to investigate further as Google’s release becomes more widespread.
All Response Media viewpoint
We are working to create a data collection strategy using our in-house web tracking technology, Tag4ARM. The tracking tag drops a cookie that is used to match visit level data and can be adapted and used as an impression and click tracker. This means there will be a centralised ARM data warehouse of digital and offline activity across all channels. This is similar to how we aggregate data currently, but rather than requiring multiple DPAs for each media platform we use, we will only require one agreement that will specifically cover Tag4ARM. It also means that we will not need to pass the cookie ID into other media platforms, or pull user-level data from those platforms, making the setup process much cleaner and reduces the data privacy security risk.
Read more information on our digital services.
