Media
Media
Why data clean rooms are becoming central to advanced advertising
- "Data clean rooms" provide a way for advertisers, publishers and others to get the most out of existing first-party data sets, without relying on third-party cookies and tracking tools that are under increased regulatory scrutiny
- They allow companies to collaborate and gain better insights about their mutual customers or users to help shape advertising strategies
- They are typically marketed as a privacy-friendly way to share the benefit of data without directly sharing it with a partner, although privacy considerations still need to be kept in mind
The digital advertising ecosystem is in a state of flux. Cookie consent mechanisms – relied on for legitimising the use of advertising cookies – have been criticised by European data regulators. Germany has introduced new rules on the use of cookies, following increased enforcement activity in France and Austria.
Meanwhile, Google's planned phase-out of third-party cookies for Chrome users by the end of 2024 is likely to lead to waning reliance on third-party cookies and tracking technologies.
In this environment, advertisers and publishers are increasingly looking for ways to maximise the utility of their first-party data sets: enter "data clean rooms".
What are data clean rooms?
A data clean room (DCR) is a secure environment in which two or more participants collaborate to leverage data assets for mutually agreed uses. A DCR allows data holders to enrich their own data sets by gaining insights from other data sets provided by another participant (or, in some cases, a third party brought to the table by the DCR provider).
The participants each provide their customer or user insights to the DCR provider, who will facilitate a matching process to establish which individuals are included in both participants' data sets. The participants can then access information and insights about individuals identified on both data sets.
How can customer data be secured?
DCR providers market their services as a privacy-friendly way of understanding existing customer bases. While the specific features may vary from provider to provider, typically DCRs implement a range of data protection measures.
They can ensure that participants segregate their data from one another, so that one participant cannot directly access another participant's raw data set in an identifiable form and can instead only gain insights about individuals already known to it. DCRs can also use privacy enhancing technologies, such as "hashing" and, where necessary, encryption when the matching process is carried out.
DCRS can implement controls that allow oversight of who can view data, for how long and for what specific purpose. The aim is to ensure that participants retain control over how their data is used or presented to other participants within the DCR. Often a participant can set a time limit for data access, restrict the reuse of data with further participants and limit the amount of queries that another participant can raise against a data set.
How is digital advertising changing?
DCRs are a relatively new phenomenon and only just gaining traction in the digital advertising ecosystem. This is partly because advertising intermediaries have, to date, focused their efforts on solutions that make use of third-party cookies. However, that looks set to change.
Using the secure environment of a DCR, brands will be able to better understand their customers and gear their advertising campaigns accordingly. For instance, a brand selling a product in its own stores – whether physical or online – may decide to partner with a department store where its products are also sold to establish which existing customers made purchases there. If the department store has other information on an individual, such as their demographic, interests or location, this can also be shared to improve their understanding of customers.
DCRs will be increasingly important in allowing smaller entities to maximise the impact of their first-party data sets. It gives scope for participants to conduct in-depth data analysis and modelling across a range of data points to inform marketing strategies.
These were activities once reserved for the bigger participants in the digital advertising industry with their own vast data sets. However, the benefits a participant would receive using a DCR would still depend on whether it has the expertise of knowledgeable marketing personnel and data scientists to draw out the most relevant advertising and behavioural insights from the shared data.
Do DCRs raise regulatory concerns?
At present, DCRs have avoided heavy regulatory scrutiny. However, in Italy, there has been a public consultation on them, but with no firm indication as to whether they raise regulatory issues.
Nevertheless, considerations around the General Data Protection Regulation (GDPR) and the UK GDPR still apply. Despite what some providers may claim, the use of DCRs involves the processing of personal data. A party's first-party data must be shared with the DCR provider before it can be hashed and matched with the partner's data set.
Furthermore, any additional insights gained by a participant will relate to one of its customers. DCR users will still need to consider whether they have met relevant GDPR obligations. These include being suitably transparent to data subjects and establishing a lawful basis for any processing.
For the most part, DCRs appear to match participant data on a "deterministic" basis, using hard identifiers such as name and email address to establish a match. However, if any providers match on a "probabilistic" basis, using other identifiers to reach a threshold of certainty that two data points relate to the same person, there could be data protection issues in the event that the match is inaccurate.
While DCRs may allow data sharing in a way that is more aligned with privacy principles than simply selling wholesale data sets, advertisers, publishers and other parties seeking to collaborate in DCRs should still ensure that data protection compliance remains a central concern.
Further Osborne Clarke Insights
Authors
Ben Dunham Partner, UK ben.dunham@osborneclarke.com
Claire Bouchenard Partner, France claire.bouchenard@osborneclarke.com
Marialaura Boni Counsel, Italy marialaura.boni@osborneclarke.com
Dr Martin Soppe Partner, Germany martin.soppe@osborneclarke.com