The Awin Report 2019 – Legislation Q&A

Online data privacy is currently an issue of utmost importance to users and regulators around the world. What do you think of the current attempts to regulate its use, and how effective do you think these laws might be in preventing data misuse by the wider online ad industry?

(EJ): The recent attempts to regulate the use of personal data, thinking particularly about GDPR and the upcoming ePrivacy Regulations, are arguably long overdue. When it comes to personal data, the previous laws effectively predate the internet.

These laws do two things.  Firstly, they make it more difficult to use personal data without reflecting on how that may impact individuals and society generally. Secondly, they bring into focus the traditional online value exchange – free services in return for data – so that consumers can now consider whether that value exchange is a deal that actually works for them.

Ultimately, effectiveness will be determined by enforcement. We are yet to see how GDPR will be enforced to any material degree, and whether that enforcement action will cause businesses to change their approach.

(LCG): We think that GDPR has been a huge revolution, with special reference to how data protection is addressed. In our view, GDPR changed the perception of data protection in many companies’ daily lives.

There are still huge gaps to be resolved though; the law still does not match (i) the industries’ needs, (ii) the protection of users’ data and (iii) the lack of awareness from users.

In order for these laws to become more effective, it should be emphasised that you have to enable users to make well-informed decisions.

(GK): In the United States, the digital media industry has embraced a self-regulatory approach through organisation such as the Digital Advertising Alliance (DAA), Network Advertising Initiative (NAI) and other trade organisations.  Industry established standards are always preferred by businesses over legislatively dictated solutions. However, as questionable privacy practices have emerged and concerns have been voiced by the public, lawmakers are re-examining their hands off approach and considering new laws to regulate how data is collected and used online.

What do you envisage being the likely consequences of California’s Consumer Privacy Act and/or the EU’s ePrivacy Regulation upon the advertising industries?

(EJ): The CCPA is state level legislation in the US, and therefore does not have the same reach as a federal law. It seems to be inspired in part by the EU's GDPR and if so, the consequences are likely to be similar, assuming the territorial scope applies. As for the ePrivacy Regulations, there are still some key points which are not yet totally clear as the draft is bounced between the various EU institutions.

It's conceivable that ePrivacy Regulation will actually make things slightly easier for advertising industries, as it may provide website publishers the opportunity to block access to their content if cookies are refused. Under GDPR, which feeds new definitions in to the existing Privacy and Electronic Regulations, this is not strictly permitted although continues to be prevalent.

(LCG): In the wake of GDPR, the market’s attitude will be to become stricter and more careful from a formal perspective (such as data protection clauses in all agreements, or data processing agreements), but at the same time, from both a technical and a business side, there will be an attempt by many to identify new loopholes.

(GK): The California Consumer Privacy Act (CCPA) is a watershed moment for the advertising industry in the United States.  For the first time a State will be broadly regulating personal data.  The CCPA is extremely broad.  Under the CCPA, “Personal Information” includes online identifiers, browsing history and even “inferences” drawn from such information.  The law requires that individuals be provided with an opt-out opportunity before such information is shared with third parties.  This infrastructure generally does not currently exist in the industry.  If the law is not significantly revised through further amendments or rule making, or pre-empted by a federal privacy law, then the industry will have to materially change its practices to comply.

How at risk does legislation like this leave the traditional affiliate model?

(EJ): The traditional affiliate model, although it does depend on some very basic user profiling and tracking across devices, is not in any way as invasive as other forms of online marketing. In the traditional affiliate model, user journeys are tracked individually, and there is no creation of rich databases relating to individuals or their behaviour. Any new legislation has the potential to create risk to incumbent businesses, but I think the affiliate model will be considered a model of online advertising which is much easier to operate in a compliant way, and a form of advertising inherently less impactful on privacy than the alternatives.

(LCG): The problem for the affiliate model is the nature of its role: being an intermediary, in any industry, always has its disadvantages. As for the wider advertising market, the biggest problem is that both publishers and advertisers will ask for guarantees. So it will certainly be a great challenge to balance those needs for reassurance whilst continuing to provide these services effectively.

(GK): These laws have a common theme of transparency and data access rights.  Presently, businesses in the U.S. are not under a legal obligation to share with consumers information about the personal data they have collected from them.  With the advent of these laws, affiliate marketers, like all marketers, will have to share certain information with consumers upon request. That’s a new process that most in the affiliate marketing space are not accustomed to handling.

The rise of influencer marketing has arguably highlighted the necessity of disclosing paid-for advertising partnerships in an online environment. Do you think the next couple of years could be pivotal in clamping down on non-disclosure in order to improve transparency around this issue?

(EJ): Yes, I do think this will be the case. We’ve seen action and guidance from the Advertising Standards Authority, changes to the CAP code and also more recent measures taken by the Competition and Markets Authority. These measures relate to influencers specifically, but also affiliate links in general, and mostly deal with disclosure requirements to ensure that those links are identifiable as ads.  However, based on my understanding of the impact of these types of disclosures in other scenarios, I don’t expect there to be a huge impact on the efficacy of this type of marketing.

(LCG): In Italy in the past two years we have had a great revolution of this from a regulatory perspective (new self-regulation and decisions by local authorities) and from the gradual increased public awareness. We see now in each negotiation with influencers that these issues are frequently raised. There are some brands (and influencers) still resisting this, but the agencies are almost all on board and in favour of disclosing paid-for advertising partnerships. After a first phase of awareness of the issue, the next two years could lead to consolidation of the legislation and practice in a more systematic way.

(GK): Proper disclosure of influencer marketing relationships and activities was a key focus for the Federal Trade Commission (FTC) in 2018 and in earlier years.  Since that time, the FTC has replaced all five Commissioners with new individuals.  These Commissioners set the agenda and enforcement priorities for the Commission.  While it’s likely that influencer marketing will continue to be a focus of the Commission, it remains to be seen how this issue will be prioritised amongst the many issues facing the agency.

Effective content monetisation remains a fraught issue for many online publishers (particularly in online news and media). Do you think that regulators should play a role in ensuring that digital content creators receive a fair payment for the services they provide?   

(EJ): I think that government, rather than regulators, has a role to play in ensuring that these important services can be monetised fairly and that digital content creators do not find their content exploited by third parties.  That said, I do think that regulators have a role in avoiding unnecessary damage to creators of this content.  There needs to be some level of understanding from regulators that, while there is a public benefit to ensuring individuals privacy is respected, there is also a public benefit in individuals having access to trustworthy journalism and investigative reporting. There is a balance to be struck here at a policy level.

(LCG): Not so much the regulators, but in our view this role shall be played mostly by self-regulatory bodies or associations. We find it very interesting that there are so many current initiatives about certifying inventory and its quality. IAB Italy has just launched a project on this, and it seems very promising: with a reliable certification, the advertisers will have the power to choose only trustworthy publishers. As a direct consequence, the market will automatically exclude suspicious suppliers.

(GK): The FTC is focused on protecting consumers, not mediating B2B disputes.  However, lawmakers could always wade into issues that they feel are ripe for new legislation.  However, mere B2B disputes and negotiations over payments are often unlikely candidates for new laws.

An increasing number of countries around the world are discussing (and in some cases have already implemented) online tax laws that are designed to create more balance between digital and real-world retail. What’s your take on whether this can be done in a way that protects bricks-and-mortar while not stifling ecommerce?

(EJ): The tax laws around the world clearly advantage online businesses which operate globally, or according to their tax returns, don’t appear to operate or even exist anywhere at all.  This is an extremely complicated area of law and one on which a large number of vested interests come to bear.

It is assumed that these laws can only work effectively if implemented globally. That may well be true, but ultimately individual nations and also institutions like the European Union can take on some of this challenge.  The recent implementation of a location-based tax for digital services in the UK is, in my view, a welcome step towards a fairer application for the tax laws in this country.

(LCG): This is a complex and evolving problem, mostly connected with economic aspects. In our view, instead of drafting laws in order to promote and/or facilitate one of the two worlds, measures are needed in order to ‘connect’ both the digital and real-world environments of retail. 

(GK): The United States Supreme Court recently ruled in South Dakota v. Wayfair that states may collect sales tax on internet sales between in-state consumers and out-of-state retailers who don’t have a physical presence in the State.  As a result, many States are passing and/or updating their nexus tax laws to take advance of this new flexible standard which is not rigidly based on a physical presence in a State.  We can expect to see this trend continue. 

The affiliate industry has had some success in regulating itself in certain markets. What do you see as the benefits of this approach versus the enforced regulation of an industry by external organisations or bodies?

(EJ): The main benefit of self-regulation is that an industry would never propose to regulate itself in a way which is fundamentally damaging.  It therefore offers industry an opportunity to propose a legislation that works well for industry. Whether the self-regulation goes far enough is often the big question here. However, I think self-regulation can be an excellent starting point, as long as there is a means of enforcement.  Otherwise, there is the inevitable concern that the regulator may not have true insight into knock on effects its regulations may cause.

(LCG): We have great respect for self-regulatory bodies and initiatives. We think that for the advertising market they are the best choice. The main benefit is that, for a complex market with many players involved, the rules will be fairer if they are drafted by someone who knows not only how the market works (technically) but also about the business dynamics behind it.

(GK): As mentioned previously, self-regulation is generally preferred by businesses.  However, a truly robust and effective self-regulatory regime with real consequences for non-compliance takes time and work to establish and get buy-in from the industry.  Once in place, regulators may defer to such comprehensive schemes if they do a good job of regulating the applicable industry.  The affiliate marketing industry is not there yet.

Google and Facebook’s advertising platforms currently dominate worldwide growth of digital ad spend. Do you think legislation should be used to prevent the kind of monopolisation we’ve witnessed in the industry in recent years?  

(EJ): Google and Facebook both operate models where a monopoly is required in order for them to be most successful. Facebook is only a successful social network if all of society appears on it - if half of your friends are on another platform, neither platform will be truly successful. Similarly with Google, its search results are most accurate because it learns from the broadest use and interaction by individuals. Where monopolies arise in any territory, or where a particular business or sector offers some kind of a societal function (be that energy, telecoms, water or transport) they may find themselves subject to regulations intended to maintain effective markets and prevent abuse. Personally, I think it is only a matter of time before Facebook begins to see specific regulation, particularly given their impact on elections over the last few years.

(LCG): Yes, of course. If we think about antitrust or unfair competition laws, the problem is that most of the times it is not worthwhile for a company to challenge the big tech incumbents, and this is something that the law should consider and prevent.

(GK): The United States has a well-established body of antitrust law to ensure that there is fair and legal competition in an applicable industry.  A well-known example of the exercise of such laws was the breakup of the Bell System in the early 1980s. I don’t think we’re anywhere close to that right now. There is competition and these are not essential services. You can live without posting on Facebook!

Regulating an industry like online advertising, which is notoriously fast-paced, appears to often leave legislators at a distinct disadvantage when attempting to create laws that reflect the reality of the marketplace. Is this simply the nature of law-making or can lawmakers be better empowered to improve this predicament?

(EJ): Most regulations attempt to be technology neutral, and therefore they focus on principals and outcomes which become the focal point of compliance. It is therefore possible to create laws which reflect the reality of the marketplace and stay relevant over time.  That said, paradigm shifts inevitably arise, causing changes in societal behaviour.  A great example is the post-Data Protection Act 1998 rise of Facebook.  The Data Protection Act 1998 could not foresee a ubiquitous worldwide service in which individuals volunteer huge amounts of extremely revealing data to a large company based abroad.  There is therefore only so much law makers can do to future proof the laws they make in the longer term.

(LCG): Drafting useful legislation requires time and involves a lot of bureaucracy. The online advertising industry is the perfect example for this comparison. The law is on one track, at 10 km/hr and the industry is on the next track at 200 km/hr.

May they meet at some point? We think so. But the ways in which they have to be innovative and reach a fair compromise between the two perspectives.

GDPR is already different from any other regulation, it established milestones and principles with the purpose of not making them outdated since their introduction. Such principles could be a guidance for other more flexible forms of legislation such as guidelines or self-regulatory codes, which are issued by experts in the market.

(GK): The law and regulation can never move at the speed of technology.  The challenge for lawmakers and regulators is to draft and enforce standards that are technology-neutral and flexible enough to withstand the test of time.  The most effective laws operate in this way.  However, it’s challenging to establish generic standards that should apply not only to current services, but future services that have not yet been launched or even conceived.

What advice do you have for advertisers with regard to handling their affiliate relationships?

(EJ): My advice to advertisers is to take a collaborative approach to complying with data laws when working with affiliates.  As a starting point, advertisers are likely to need to obtain information from some affiliates in order to come up with their own privacy impact assessments and compliance strategies.  This is especially relevant when working with ad tech affiliates.  When implementing those strategies, there will also need to be an understanding of the roles of each of the advertiser, the network and the affiliate, particularly in respect of things like notice obligations.  The network will have a hand in shaping these roles, as the entity determining the overall structure of the relationship between affiliates, networks and advertisers, but advertisers can also use their programme terms to impose any extra requirements.

(LCG): We recommend advertisers to use only reliable affiliate providers, and to check carefully the ‘chain of guarantees’ in the agreements. Plus, we recommend them to consider that partnerships with ‘cheaper’ providers can lead to unexpected consequences. Therefore, within the considerations to be made when running an affiliate campaign, reliability should be one of the top qualities to look for.

(GK): Document and monitor.  You should have a sound written agreement with every business partner that accurately reflects the rights, obligations and responsibilities in connection with the relationship.  You should do your due diligence before entering into any new relationship.  Thereafter, do not just sign a contract and shove it in a drawer.  You should monitor the relationship and promptly address problems or make improvements along the way.

What is your future vision for how digital marketing could be subject to legislation in five years’ time?

(EJ): In five years’ time I expect to see two things happen to digital marketing from a legislative perspective. The first is to see a history of enforcement action which allows us to understand the real impact of GDPR. The laws of a country tend to be comprised of two things - the statute itself and the interpretation of that statute by the courts, as recorded in a series of judgements to court cases. With GDPR, we really only have the statute itself; the fine-tuning offered by court judgements is entirely missing.  This is inevitable when a new law comes in to place.

The second thing I expect to see is a shift in the use, by individuals, of technology to manage their personal data when held by multiple service providers.  This would be driven partly by technological advancement (particularly in the use of increased decentralisation and personal data APIs), and partly by a change in consumer behaviour as individuals become more aware of the value of personal data and seek to renegotiate the traditional value exchange.  This will then impact on the way digital marketing is subjected to legislation.

(LCG): I think it will be divided from all the other markets from the perspective of tax laws and data protection, simply because the nature of this market is so deeply different from others. This demands a different legislative approach from lawmakers.

(GK): If I could predict the future, I’d pick stocks instead of being a digital media and privacy lawyer!  That said, I think we will see a shift to more privacy laws on the federal level and more regulation of an industry that has previously operated much on its own.  Therefore, companies are well-advised to get ahead of the compliance curve and put in place comprehensive privacy and data security policies and programs that comply with applicable law, satisfy consumer concerns and help their businesses grow.

Want more affiliate marketing insights from over 80 contributors around the globe? Download The Awin Report 2019 in full here.