Is Contextual Targeting Safe in a Privacy-First World?


IAB Tech LabMany anticipate that as digital privacy protections around the world tighten and browsers sunset third-party cookies, we’ll see more advertisers turn to contextual targeting in order to reach their audiences.

But contextual targeting isn’t inherently privacy-safe. In fact, one of consumers’ primary fears around online targeting is that contextual information from the websites they visit will be paired with their own personal details, giving marketers a window into personal information.

This is especially true when that contextual information yields ‘special category data’ – types of data outlined by the EU’s General Data Protection Regulation (GDPR) as requiring special protection. This includes data on an individual’s political beliefs, health, sexuality, and religious beliefs, amongst other things.

IAB and Google questioned on context

This issue has been highlighted over the past year as both Google and industry trade group the IAB have been questioned over their use of contextual data within real-time bidding (RTB) bid requests.

UK data regulator the Information Commissioner’s Office (ICO) outlined its concerns in its report on ad tech last year, saying that both the IAB Tech Lab’s ‘Content Taxonomy’ (which it uses to categorise content based on context) and Google’s ‘publisher verticals’ (use to define the type of site a user is visiting) can yield special category data. The IAB’s content taxonomy included categories like ‘Mental Health’, ‘Sexual Health’ and ‘Infectious Diseases’, while Google’s publisher verticals included categories like ‘Politics’, ‘Substance Abuse’, and ‘Ethnic & Identity Groups’.

Both Google and the IAB have since taken steps to address these concerns. Google announced late last year that it would simply remove contextual content categories from the bid requests it sends out to buyers participating in its auctions.

The IAB meanwhile says it is taking a look at areas where the content taxonomy could indicate special category data. “IAB UK is currently working on developing guidance for the UK market to minimise the inclusion of certain kinds of content category data in a bid request when it is generated,” Christie Dennehy-Neil, head of policy and regulation affairs at IAB UK, told VAN. “This work is based on identifying content categories or tiers within the Content Taxonomy version 2.0 that are obviously sensitive so that they can be excluded from bid requests.”

The ICO suggested it was satisfied with these changes. The ICO’s executive director of technology and innovation Simon McDougall said in a blog post earlier this year that these changes, if implemented, would result in “real improvements to the handling of personal data within the ad tech industry”.

Substantial changes from Google and the ICO?

Google and the IAB have obviously taken significantly different approaches – Google has chosen to cut its contextual categories completely, while the IAB believes that its Content Taxonomy can be reworked in a privacy-safe manner.

“Content category fields, such as those detailed in the Content Taxonomy, do not in themselves constitute special category data because they do not reveal information about the individual user, or concern their health, sex life or sexual orientation,” said Dennehy-Neil. “However, we recognise the concerns raised by the ICO that this type of information could potentially constitute special category data, depending on how and for what purpose it is processed. Our guidance is part of our work designed to help our members to minimise this risk and we will share the draft proposals with members for comment.”

However, not everyone agrees that these changes are sufficient. Dr. Johnny Ryan, chief policy and industry relations officer at Brave, says that the IAB’s changes “lack substance and urgency, it also relies on a system that is incapable of correcting RTB’s security flaws”. He said too that Google’s change makes little difference, since the same information can often be gleaned from URLs, which are included in the bid request (for example, URLs such as “Gay.co.uk”, “Islam.org.uk”, or “NHS.uk/Conditions/Cancer).

Dennis Buchheim, president of the IAB Tech Lab, believes that URLs are not in themselves generally indicative of detailed context. But he agreed that some URLs could be used to give contextual information about the site an individual is visiting, and said “to the extent that contextual insights are determined by parties with access to URLs, each party is responsible for how they use any related data and remain in compliance with the law.”

Taking personal data out of the equation

The IAB believes that more sensitive handling of contextual categories should be sufficient to ensure no special category data about individuals is being shared around the ad tech ecosystem. But what would privacy advocates like Johnny Ryan like to see changed?

While Ryan’s complaints towards RTB are often portrayed as an effort to take down RTB wholesale, he doesn’t see it this way. Rather, he wants to see personal data taken out of the process.

“I think that it may be possible to remove all personal data from bid requests,” he told VAN. “Google and the IAB could mandate that change, and it would apply across the entire industry. Now I know one professor of computer science who doesn’t agree with me on that, and one who does agree. And both of them happen to work for Brave too! So that tells you that this is something that needs to be examined.”

Ryan believes that bid requests could include information about the user’s general location, a URL and potentially some other information, which could include contextual information about the website. But Ryan says privacy is only protected if the personal information is stripped out.

“What I’m saying is that RTB broadcasts personal data to all and sundry. And the solution is: remove the personal data!” he said.

Christian Dankl, co-founder of Precise TV, a video advertising platform which enables contextual targeting and brand safety screening on YouTube, says that removing personal data is vital for companies like his own, which deal with sensitive content categories.

“We just launched a product in the US for the healthcare market, where pharmaceutical clients can use our technology to target hard to reach healthcare audiences on YouTube in a safe and compliant way.” said Dankl. “Obviously people have privacy concerns when it comes to medical conditions, and there’s a privacy regulation in the US called HIPAA which is designed to protect privacy.”

Precise TV uses deep learning AI, paired with a US taxonomy of medical terms, to understand videos which talk about medical issues. Rather than targeting keywords, this is used to help advertisers avoid misleading content or non-evidence based medical content and  on YouTube, a huge problem highlighted by a recent BBC story about ads running next to YouTube videos which say donkey milk is a cure for cancer.

“Now obviously it’s scary if you combine the level of detail we have with a cookie or an ID,” said Dankl. “However our systems are purpose built and third-party audited to not store any personal identifiable information (PII) in our contextual data management platform (DMP). That’s really what you need to do if you want to use video or page level contextual targeting and offer services in regulated markets like kids or healthcare advertising.”

He added that his company is routinely audited in order to be certified for HIPAA and COPPA, to ensure that it’s not storing personal information or combining it with other data.

Is privacy-safe contextual targeting too broad?

One of the concerns from marketers around a shift towards contextual targeting is a loss of effectiveness, especially if it can’t be supplemented by any personal data.

But Dankl believes that tools like his own, which offer a deep understanding of individual bits of content, represent a much more advanced version of the contextual targeting which marketers have used in the past. “We are using predictive contextual targeting based on billions of data points of historical campaign and cookie-less audience data. This is a complete paradigm shift compared to what contextual targeting used to be, it’s not about just placing travel ads in endemic travel properties.”

And Brave’s Johnny Ryan, while acknowledging there may be value in contextually analysing individual pieces of content, believes a return to more old-school contextual targeting isn’t such a bad thing. “You don’t need to be sophisticated about the technology, you just need to understand humans. Which is what marketers have always had to do if they were any good,” he said. “Don Draper would have known which type of magazine and article Betty would have read, and would have bought his placement there. So let’s rejuvenate the art, and bring it to digital.”


Subscribe to Weekly VAN Newsletter

 
Ad TechDataMeasurementMediaPrivacy