Will 2023 Mark a Tipping Point in Data Privacy Regulation?

Data protection is becoming a key discussion point among advertisers in the U.S. as central provisions in the California Privacy Rights Act (CPRA) take effect and publishers begin rolling out transparency notices to users. Will ​​2023 go down in history as a turning point in data privacy?

A number of states will join California in enforcing new data privacy statutes this year, including Colorado, Connecticut, Utah, and Virginia. The anticipated shift in data privacy protection that results from this enforcement could have major implications for decades to come, according to Mathieu Roche, co-founder and CEO of ID5, an identity provider for digital advertising.

“With the application of the CPRA and the debate around a federal privacy law, data protection will become a central discussion topic in the U.S. in the upcoming year,” says Roche. “The work done by the IAB Tech Lab on the Global Privacy Platform will create momentum and publishers will start rolling out transparency notices to inform users of the value exchange between advertising and content.”

Although substantive provisions of the CPRA took effect in California on January 1st, an overlooked provision delays the actual enforcement of CPRA until July. This gives businesses a little extra time to prepare their compliance programs and hopefully avoid costly fines. However, Roche sees bigger implications and changes coming down the pipeline for advertisers as well.

Roche predicts that “identity as currency” will become a concept on the tip of every advertiser’s tongue in 2023. As the digital ad ecosystem evolves, he believes the ability to establish identity will be key to publisher profitability and advertiser ROI. It could also serve as the underpinning of what will someday become a free and open internet.

“To effectively and seamlessly transact globally, we rely on a small number of widely used currencies, such as the dollar and the euro. The same concept can be applied to digital advertising. To buy and sell media effectively across channels, we need a few widely used IDs,” Roche says. “Historically on the web, we have been using multiple IDs, each platform has its own, and cookies to store them and match them with each other to exchange information for bidding purposes. To add to the complexity, we have been using different IDs on mobile and CTV. This is an inefficient way to operate.” 

Roche believes that in the future, advertisers will use a small number of “currencies” across all channels, and that will power all digital media transactions. 

Meta Ruling Has Widespread Implications

In light of the recent Meta ruling in the EU, which saw the tech giant fined for bundling data collection with registrations, Roche says the call to provide consumers with 100% control over how their data is used will almost certainly grow louder in 2023.

“We will see a move away from this consideration that consent for data collection and registration are one and the same,” he says. “Consumers must be given a choice. Whether that’s agreeing to register for a service and receive targeted ads, being happy with ads but not wanting to give away an email address, or being willing to provide personal details to be recognized but without that information being used for advertising.”

Meta’s case hinges on whether the company receives legal permission from users to collect their data for personalized advertising. The ruling, which was handed down in the European Union earlier this month, is widely seen as one of the most consequential data privacy judgments to date.

Now, with the application of the CPRA and the debate around a federal privacy law growing louder, Roche says data protection will almost certainly become a central discussion topic in 2023. 

“With these changes looming, the U.S. market must prepare for further alterations to how user data is collected and shared,” Roche says. “However, this does not mean an end to addressable and measurable advertising, which is key to free access to the digital content we know and love.”

If the push to give consumers more control over their data continues—which it is expected to—then Roche says businesses can’t afford to waste any more time reviewing their data collection and sharing practices. In addition, he says businesses should be auditing their partners to ensure they only work with those who can guarantee high data protection standards. Companies like Neutronian, for example, have created resources to help with those evaluations, including a monitoring service and scoring system that can be used to assess technology and media partners’ compliance.

“By leveraging cookieless identity resolutions, publishers will be able to increase the value of their inventory by making their cookieless traffic addressable and, therefore, attractive to buyers,” Roche says. “And with the ability to reach users in cookieless browsers, brands will see rising ROI due to the lack of competition in these environments. The testing and adoption of future-proofed identity resolutions will also allow these companies to ensure they are ready for the Chrome deadline, thus limiting its knock-on effect.”