We’ve seen quite a range of interpretations from digital publishers of how consumer consent for data processing should be collected under the EU’s general data protection regulation (GDPR) which came into force last year. And there is still an element of uncertainty around what a ‘good’ cookie consent mechanism looks like, in the eyes of the regulators.
The UK’s data regulator the Information Commissioner’s Office (ICO) aimed to clear this up earlier this year with a “myth-busting” blog post and new guidance on the use of cookies which laid out best practices. But in response to a Freedom of Information request, the ICO says that after implementing its own best practices it has seen a ninety percent drop in traffic measurable via analytics, implying a ninety percent drop in opt-in rates.
The ICO doesn’t run ads on its site, but it does use Google Analytics, and asks for permission to drop cookies which allow it to track users via the service. The ICO’s stats show that in the three months prior to updating its consent tool, average measured traffic in Google Analytics was 119,417 users per day. But in the three months following the update, average measured traffic fell to 10,967, a 90.8 percent drop.
The Programmatic Advisory’s founder and CEO Wayne Blodwell, said the figures suggest there would be “huge ramifications” for publishers adopting the ICO’s best practices. “Publishers who customise their content strategies based on how users interact with their site (using an analytics provider to help them understand) will now need to find other ways to better understand what to produce,” Blodwell said.
And advertisers will be hit too. “Brands who have an online presence will be unable to track where users came from, how they interacted and ultimately what it was that led to the last touch point (in many cases a sale of a product) – for those investing significant sums in premium analytics providers this will not sit well. If you take a look at Amazon for example, there currently isn’t any form of CMP where the user can give explicit consent for analytics, and analytics tags are dropping freely,” added Blodwell.
There are also worrying implications for advertising revenues if opt in rates for cookies drop by 90 percent when publishers use best practice consent mechanisms. Stuart Austin, programmatic innovations manager at The Guardian, said that the fact that users become invisible in Google services is worrying for publishers, “especially when we consider their penetration of the ad server market”.
There are a few mitigating factors. Firstly, publishers’ consent management systems don’t need to be identical to the ICO’s. The ICO’s consent form collects consent via an on/off slider for Google Analytics cookies, which is set to ‘off’ by default, with the consent form only covering around a third of the page. But opt-in rates could be higher where publishers use, for example, consent forms which cover the whole page, and invite users to either accept or decline the use of cookies in order to continue.
And for cookies required for analytics specifically, it’s still possible that the ICO could change its stance that explicit consent is required for analytics tracking. Blodwell says there is still a case to be made that analytics cookies could be categorised as ‘necessary’ under GDPR’s definitions, meaning they wouldn’t require consent. “Analytics is what underpins many other decisions across the web, all for the benefit of the consumer and can still adhere to all other GDPR principles. Analytics goes far beyond just digital advertising,” he said.
But the ICO may find itself under pressure from the UK government to take a harder stance on consent, not a softer one. Earlier this month the Joint Select Committee on Human Rights reported “serious grounds for concern about the nature of the consent people provide” when handing over personal information, calling the current consent model “broken”.
