When it comes to privacy compliance, who you work with matters.
Advertisers that fail to do privacy-focused due diligence on their media and data partners could easily find themselves at the center of a PR crisis (no bueno) or looking down the barrel of a lawsuit (realmente no bueno).
And as privacy laws come into effect across different states, the latter is no longer a hypothetical.
On Wednesday, Neutronian, a startup that independently verifies data providers for quality and compliance, released a new score for ranking whether publisher networks, ad tech platforms, retail media platforms, data providers and brands have a kosher approach to data privacy. It’s scored more than 3,000 domains so far.
The idea, said Timur Yarnall, CEO and co-founder of Neutronian, is for ad buyers to use the privacy score as a tool for vetting and benchmarking their partners.
“There has to be a standardized way to compare and talk about these things,” said Yarnall, who founded Neutronian in 2019. Before this venture, he sold his bot detection startup, MdotLabs, to Comscore in 2014 and served as the interim CEO and president of Hitwise (before its parent company, Connexity, shut down that business in early 2020).
“We need more of a public discourse about data privacy,” Yarnall said, “and we need a framework that allows us to talk about where the ecosystem is doing well and where it needs to improve.”
Common privacy problems
One definite area of improvement is privacy policy.
Most companies either have very confusing privacy policies or are missing privacy policies altogether. In many cases, publisher networks link out to generic umbrella corporate privacy policies that make opting out of data collection nearly impossible.
“Even a subject matter expert would have a hard time deciphering some of these policies,” Yarnall said.
Another common issue is the lack of data minimization, a concept that’s been core to European privacy regulations but is just making its way to the US. The California Privacy Protection Act, which came into effect on January 1, includes a new requirement for businesses to limit the amount of data they collect to what’s necessary and directly relevant to fulfill a specific purpose.
“When you collect more than you need,” Yarnall said, “you create risk for everyone: the consumer, the brand and the publisher.”
Easy there, Trigger
But hype around a new category can also be a vector for privacy missteps.
For example, in their excitement to monetize their first-party data, including purchase-related information, some retailers are glossing over privacy considerations.
As part of its scoring system, Neutronian measures how easy – or difficult – it is for consumers to opt out of a retailer’s loyalty program, which is a key data source for companies rushing into the nascent and buzzy retail media network category.
Some retailers really make you dig to find the opt-out.
“That, to me, feels questionable from a compliance standpoint,” Yarnall said.
On average, Neutronian found that retail media networks scored 16% lower than “standard” third-party data providers on its privacy ranking, which is less surprising than it sounds.
“What you might call traditional third-party data providers have been criticized and kicked around so much, they’ve actually become very focused on privacy,” Yarnall said, “whereas that isn’t necessarily happening in other cases.”
But the purpose of the privacy score is less about the “gotcha” and more about providing transparency to buyers and giving vendors and sellers an opportunity to improve, said Arielle Garcia, chief privacy officer at UM Worldwide, which is in talks with Neutronian to use its privacy scores.
“It’s like a road map to help companies do better, including an emerging category, like retail media networks,” Garcia said. “As third-party cookie deprecation draws near, publisher data is top of mind for us, but we can’t rely on self-reported information and our own outreach – we need a way to be able to dig deeper with partners and to do it at scale.”
Know the score
Neutronian defines data privacy as the ability for individuals to control access to their personal information based on consumer expectations and any applicable laws, whether that be CPRA or GDPR.
To determine whether a company meets this threshold, Neutronian uses a mixture of human review and automated crawler tools, not dissimilar to how a brand safety vendor crawls a page for context.
The crawler gathers data directly from the domain or app, including whether there’s a functioning opt-out mechanism and whether a privacy policy and the appropriate data disclosures are in place. Human auditors then verify the data collected by Neutronian’s crawlers, which in turn helps train the automated models.
Neutronian also considers publicly available information, such as checking the backgrounds of a company’s executive team and seeing whether that information is consistent with what’s posted on Crunchbase and LinkedIn.
Even whether a business accurately lists its office locations and has a clearly marked “contact us” form on its site is relevant.
“All of this information plays into whether a company is a security risk,” Yarnall said.
Neutronian doesn’t need a direct relationship with a company to crawl that company’s domain, although it does have official partnerships with survey platform Dynata, retail advertising and analytics company IRI, programmatic platform Causal IQ and digital performance agency Labelium.
Privacy = performance
Labelium plans to use the privacy ratings as a litmus test for whether to work with a certain data provider or publisher. As in, you’ve got to be this tall to ride.
Eventually, though, Labelium’s goal is to evaluate partners based on whether their privacy score correlates to better campaign performance, said Clayton McLaughlin, the agency’s EVP and head of media.
“We believe that improved privacy should ultimately lead to better performance,” McLaughlin said, “whether that’s brand lift or more direct results.”
And there is already early evidence that prioritizing privacy can be good for performance. Companies with responsible data practices typically see a 23% increase in purchase intent, according to research released last year by Magna and data governance platform Ketch.
“Brands are starting to think about the impact of privacy, whether that’s an attributable impact on media performance, the long-term impact on their brand, avoiding negative PR or simply aligning to the values they say they have,” McLaughlin said. “There are a lot of different ways to think about what privacy can bring to the table.”
Neutronian will update its privacy scores quarterly, with plans to eventually scan domains on a monthly basis.
