The document discusses how brands can stay safe from GDPR risk. It notes that brands face risk from holding non-compliant first-party personal data or buying personal data from other sources. It also discusses risk from buying behavioral ads online, which requires sharing personal data with many partners. The document then provides diagrams illustrating how real-time bidding works in programmatic advertising and where data leakage can occur. It emphasizes that contracts are needed between controllers and processors to ensure compliance. Overall, the document aims to educate brands on GDPR risks in online advertising and how to pressure ad tech partners to use non-personal data to eliminate risk.

1. HOW BRANDS STAY SAFE
FROM GDPR RISK.
johnny@pagefair.com
Dr Johnny Ryan
PageFair

2. Risk to
BRANDS

3. Holding first-party personal data that are now non-compliant1
Risk (brands)

4. Buying personal data (directly or indirectly identifiable) from other sources to augment
profiles
BROKER
2
Holding first-party personal data that are now non-compliant1
Risk (brands)

5. Buying behavioural ads online, which currently requires the sharing of personal data with
countless partners.
3
Buying personal data (directly or indirectly identifiable) from other sources to augment
profiles
BROKER
2
Holding first-party personal data that are now non-compliant1
Risk (brands)

6. How RTB/
programatic works

7. ///
Visitor Site Brand
$

8. ///
Visitor Site SSP DSP DMP Brand
$
“Demand side”“Supply side”
Ad Exchange

9. ///
Visitor Site SSP Ad Exchange DSP DMP
request segment
deliver segment
Brand
$
store data
“Demand side”“Supply side”

10. ///
Visitor Site SSP Ad Exchange DSP DMP
serve page
request page
request segment
ad request
cookie to SSP
deliver segment
Ad request
Brand
$
store data
“Demand side”“Supply side”

11. ///
Visitor Site SSP Ad Exchange DSP DMP
serve page
request page
request bid
request segment
ad request
cookie to SSP
deliver ad
deliver segment
Ad request
Brand
$
store data
“Demand side”“Supply side”

12. ///
Visitor Site SSP Ad Exchange DSP DMP
serve page
request page
request bid
request segment
ad request
cookie to SSP
deliver ad
sync
deliver segment
sync
Ad request
Brand
$
store data
“Demand side”“Supply side”

13. The Daily Bugle
1. Page loads.
2. What ad
should we
show this
user?

14. The Daily Bugle
ExchangeExchange
Exchange
Exchange
1. Page loads.
2. What ad
should we
show this
user?
3. Send details
of user to ad
exchange(s) to
solicit bids
from
advertisers

15. The Daily Bugle
ExchangeExchange
Exchange
Exchange
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSPDSP
DSP DSP
DSP

16. The Daily Bugle
ExchangeExchange
Exchange
Exchange
DSP DMP
DSP DMP
DSP DMP
DSP DMP
DSPDMP
DSPDMP
DSPDMP
DMP
DSP
DSPDSP
DSP DSP
DSP

17. The Daily Bugle
Exchange
Exchange
Exchange
Exchange
DSP DMP
DSP DMP
DSP DMP
DSP DMP
DSPDMP
DSPDMP
DSPDMP
DMP
DSP
DSPDSP
DSP DSP
DSP

18. The Daily Bugle
Exchange
Exchange
Exchange
Exchange
DSP DMP
DSP DMP
DSP DMP
DSP DMP
DSPDMP
DSPDMP
DSPDMP
DMP
DSP
DSPDSP
DSP DSP
DSP
ADVERTISEMENT

19. The Daily Bugle
ADVERTISEMENT
ExchangeExchange
Exchange
Exchange
DSP DMP
DSP DMP
DSP DMP
DSP DMP
DSPDMP
DSPDMP
DSPDMP
DMP
DSP
DMPDSP
DMP DMP
DSP
?
?
?
?
?
?
?
?

21. DATA LEAKAGE

22. Ad server SSP
Step 2.
Ad server
selects an SSP
Step 3.
SSP selects an
exchange
Step 7.
DSP serves
agency creative
Step 8.
Assets load
from CDN
Step 9.
Agency ad server
loads verification
vendor
ADVERTISERS
website.com
AD
DMP
DMP
DMP
DMP
DMP
DMP
DMP
DMP
DMP
DMP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
W
inningbid
DSP
Ad server
javascript
SSP
javascript
DMP
DMP
DMP DMP
DSP
DSP
DSP
DSP
DSP
DSP
javascript
Ad server
javascript
Step 6.
Exchange serves
winning bid
Verification
javascript
Agency
ad server
Verification
vendor
Winning DSP
Step 1.
User requests
webpage
Ad exchange
Step 4.
Exchange sends
bid requests to
hundreds of
partners
Step 5.
Exchange lets
some DMPs/
DSPs to refresh
cookie sync
CDN
Channel of data leakage
Personal data
Legend
Money
DATA LEAKAGE

23. ///
Visitor Site SSP Ad Exchange DSP DMP
serve page
request page
request bid
request segment
ad request
cookie to SSP
deliver ad
sync
deliver segment
sync
Ad request
Brand
$
store data
“Demand side”“Supply side”

24. “Controller” “Processor” “Processor” “Processor”
contract contract contract
Contracts required that determine the following:
• the nature of processing and its duration,
• the obligations of the “controller”,
• and a guarantee that the “processor” handles the data only as
dictated by documented instructions from the controller
GDPR requires a chain of accountability

25. All potentially liable!
The Courts
Multiple controllers and processors “involved in the same processing”
can each be held liable for damages awarded in a case.
A person can complain to the regulator, and at the same time go to court, and
can take the regulator to court for inaction.
Supervisory Authority ///
///
Visitor Site SSP Ad Exchange DSP DMP Brand
$

26. We would like to share your browsing
habits on our site with Brand Name and
their analytics partners, to understand
what offers may be of interest to you.
These data will be deleted
after 6 months. You can withdraw
permission at any time in My Data.
Learn more?
Pop-up Dialog
OKNo
Purpose of processing,
and notification of
profiling.
Article 13, para 1, c, and para 2, f.
Duration
Article 13, para 2, a.
Text links to tool for
withdrawing consent.
Article 7, paragraph 3.
Text links to tool to
complain to supervisory
authority, and to access,
correct, and transfer
data, etc.
Article 13, para 2, b, c, and d.
Can say no
Recital 42.
Details of recipients and
categories of recipients.
Text links to contact
details of the
controller and their
data protection officer.
Article 13, para 1, a, b, and e.
A (probably non-compliant) GDPR CONSENT REQUEST
Scenario: a website requests consent to share data with a brand for product offers

27. We would like to share your browsing
habits on our site with Brand Name and
their analytics partners, to understand
what offers may be of interest to you.
These data will be deleted
after 6 months. You can withdraw
permission at any time in My Data.
Learn more?
Pop-up Dialog
OKNo
Thinking of yourself as a visitor to websites,
what would you select if shown this message?
79%
21%

28. Please allow your browsing habits on our
sites to be shared with
We will then be able to identify offers that
are more interesting to you, and process
business transactions with our partners.
(Alternatively, we will use generic ads,
which might be less interesting to you.)
You can cancel at any time by clicking
the icon on any ad.
Learn more about your data.
Help us keep Example.com profitable
OKNo OK
6 months 12 months
Might GDPR consent requests actually look like this?
[Consortium] and its participants
duration
“Ad choices”

29. Please allow your browsing habits on our
sites to be shared with
Open ID participants
We will then be able to identify offers that
are more interesting to you, and process
business transactions with our partners.
(Alternatively, we will use generic ads,
which might be less interesting to you.)
You can cancel at any time by clicking
the icon on any ad.
Learn more about your data.
Help us keep Example.com profitable
OKNo OK
6 months 12 months
[Ad exchange]
[Ad exchange]
[DMP]
[DMP]
[DSP]
[DSP]
[Verification vendor]
i
i
i
i
i
i
i
[Consortium] and its participants
Each
controller.
and
categories of
processors.
Might GDPR consent requests actually look like this?

30. 51%
64%13%
Do you believe that users will opt-in to tracking for the
purposes of advertising?
No YesYes, if denied access to the site otherwise
1st party tracking on
a website
23%
0% 100% 200%

31. 51%
64%13%
Do you believe that users will opt-in to tracking for the
purposes of advertising?
No YesYes, if denied access to the site otherwise
1st party tracking on
a website
23%
0% 100% 200%
Can not deny access
Article 7(2) prohibits conditionality.

32. 3%46% 51%
64%13%
Do you believe that users will opt-in to tracking for the
purposes of advertising?
1st party tracking on
a website
3rd party tracking on
a website
23%
0% 100% 200%
No YesYes, if denied access to the site otherwise

33. 3%
3%32%65%
46% 51%
64%13%
Do you believe that users will opt-in to tracking for the
purposes of advertising?
No Yes, if denied access to the site otherwise Yes
1st party tracking on
a website
3rd party tracking on
a website
Tracking by any
party, anywhere on
the web
23%
0% 100% 200%

34. Needs “opt-in”
consent, but
user has little
incentive to
agree
4
Needs “opt-in”
consent, and
may get it
3
Can show an
“opt-out”
before using
data
2
Out of scope
of Regulation if
business is
modified
1
Already out of
scope of the
Regulation
0
GDPR scale (digital advertising)
5
Needs “opt-in”
consent, but is
unable to
communicate
with users

35. 5 Needs “opt-in” consent, but is unable to
communicate with users
4 Needs “opt-in” consent, but user has little
incentive to agree
• Facebook Audience Network
• WhatsApp advertising (see assumption 1)
3 Needs “opt-in” consent, and may get it
2 Can show an “opt-out” before using data
• NewsFeed ads (based only on personal data with no “special” personal data (e.g.
ethnicity, political opinion, religious or philosophical beliefs, sexual orientation),
unless marked “public” or visible to “friends of friends” (see assumptions 1 and 2)
• Instagram ads (see assumption 1)
1 Out of scope of the regulation, if business
is modified.
0 Already out of scope of the regulation.
Assumption 2. GDPR Article 6, paragraph 4, c, indicates a higher bar for “special categories of personal data” that reveal race, ethnicity, political opinion, religious or philosophical beliefs, trade union membership,
or related to a data subject’s sex life or sexual orientation. However, this does not apply if the data have been “manifestly made public by the data subject” (GDPR, Article 9, paragraph 2, (e)). This may mean that the
publicity settings that a user places on their post will prevent or enable those posts to be mined for advertising.
GDPR scale: FACEBOOK
Assumption 1. That the use of personal data to target advertising will be accepted as a “compatible” purpose with the original purpose for which personal data were shared by users, under GDPR Article 6,
paragraph 4. GDPR Recital 61 says that if the further processing is compatible then the company must alert the data subject that it is using their data for this further purpose before it starts processing. GDPR
Article 21, paragraph 2 and 3 say that the data subject must be alerted about their right to object to their data being used for direct marketing, and can do so at any time. GDPR Recital 70 says this alert should be
presented clearly and separately from any other information. However, the Article 29 Working Party’s opinion on purpose limitation notes that among the various things that the compatibility assessment must
consider are “the impact of the further processing on the data subjects”.

36. 5 Needs “opt-in” consent, but is unable to
communicate with users
4 Needs “opt-in” consent, but user has little
incentive to agree
• Most personalized AdWords ads on Google properties including Search,
Youtube, Maps, and the Google Network (including “remarketing”,“affinity
audiences” , “in-market audiences”, “demographic targeting”, "similar
audiences”, “Floodlight” cross-device tracking), “customer match”,
“remarketing” (see assumption 1)
• Gmail ads
• Programmatic services (DoubleClick)
3 Needs “opt-in” consent, and may get it
2 Can show an “opt-out” before using data • Location targeting in Maps (see assumption 2)
1 Out of scope of the regulation, if business
is modified.
• AdWords (if all personalized features are removed) on Google properties
including Search, Youtube, Maps
0 Already out of scope of the regulation. • “Placement-targeted” ads on Google properties.
Assumption 1. That the average user does not “sign in” to Google Search or Chrome. If, however, users did sign in then Google may be able to further process their data for other purposes.
GDPR scale: GOOGLE
Assumption 2. That the use of personal data to target advertising will be accepted as a “compatible” purpose with the original purpose for which personal data were shared by users, under GDPR Article 6,
paragraph 4. GDPR Recital 61 says that if the further processing is compatible then the company must alert the data subject that it is using their data for this further purpose before it starts processing. GDPR
Article 21, paragraph 2 and 3 say that the data subject must be alerted about their right to object to their data being used for direct marketing, and can do so at any time. GDPR Recital 70 says this alert should be
presented clearly and separately from any other information. However, the Article 29 Working Party’s opinion on purpose limitation notes that among the various things that the compatibility assessment must
consider are “the impact of the further processing on the data subjects”.

37. How confident are you
that the average user
will click ‘OK’ to share
data with other
companies?
0% 100% 200%
32% 32% 21% 12%
4%
Not at all To a small degree Moderately Highly Very highly

38. Not at all
How confident are you
that the average user
will click ‘OK’ to share
data with other
companies?
0% 100% 200%
To a small degree Moderately Highly Very highly
How concerned are you
about your online
behaviour being
tracked?
5% 7%
21% 35% 32%
32% 32% 21% 12%
4%

39. Consent is meaningless,
unless it is enforceable
NEED TO PREVENT RISK OF DATA LEAKAGE
//

40. 2. DIGITAL ETHICS
1. ENFORCEMENT
The Answer?
+

41. Regulatory disincentive
OLD INDUSTRY
Regulatory incentive
NEW CLEAN INDUSTRY
Ads (Ethical Data)Ads (Conventional Data)
Personal Data Non-personal
Data

42. Ads (Ethical Data)Ads (Conventional Data)
Fossil Fuel
Renewable
Energy
Personal Data Non-personal
Data
N20
C02
Regulatory disincentive
OLD INDUSTRY
Regulatory incentive
NEW CLEAN INDUSTRY

43. Ads (Ethical Data)Ads (Conventional Data)
Fossil Fuel
Fossil Fuel
powered
Classic Cars
Renewable
Energy
Personal Data
Ads (Conventional Data)
Personal Data with Consent
and Enforceable Protection
Non-personal
Data
N20
C02
HYPER PREMIUM
NICHE
//
Regulatory disincentive
OLD INDUSTRY
Regulatory incentive
NEW CLEAN INDUSTRY

44. Need to pressure
ad tech partners.
URGENCY FACTOR: PageFair has
solved this - but few adtech or
agency colleagues seem to care.

45. 1. With or without consent, personal data
are leaked and at risk in online ad system.
2. Brands are exposed.
3. Need to pressure ad tech to neutralise risk
by leveraging non-personal data.
johnny@pagefair.com
Summary
See PageFair.com/GDPR