The GDPR (or General Data Protection Regulation), Europe’s new data privacy regulation, applies to all organizations — including publishers — doing business with residents of the EU and takes effect on May 25. To learn more about the regulation, please have a look at this post or listen to our May 2017 podcast, “Countdown To GDPR.”

The purpose of the new regulations is to give EU citizens and residents greater control over the use of their personal data, and that’s good, even if it makes doing business harder. Under the new regulations, publishers — who use first-party data to build and maintain audiences; inform product development; deliver personalized, relevant content; and sell advertising — probably have to update their privacy policies to explicitly detail their collection and use of personal information, including with what partners the data will be shared. But there’s a lot of fear-mongering about GDPR that I want to debunk. For example, publishers can still:

  • Continue to use data that is aggregated and anonymized for everything from analytics to ad targeting.
  • Continue to conduct their own marketing activities — a legitimate interest under GDPR — as long as they give users an easy way to opt out.
  • Continue to collect data for other purposes such as ensuring that readers are subscribers (which doesn’t necessarily mean customers) and to craft and deliver relevant content to their users.

That said, publishers must stop the freewheeling sharing of personal information with any entity that asks for it, like advertisers. And they have to obtain consent for behavioral tracking that doesn’t have any other legal basis or for purposes that users would not reasonably expect — device graphs and audio beacons would fall into this category, for example.

It’s the process of selling advertising where the new rules become problematic. On March 22, just two months before GDPR was scheduled to take effect, Google announced the measures it planned to take to comply with the new regulations. It positioned itself as a data controller (meaning that it regularly makes data-based decisions to sell advertising on publisher sites) rather than as a data processor, simply carrying out instructions provided by publishers. As a controller, Google has said that it requires publishers to obtain consent on its behalf, and therein lies the rub for publishers: Google, in order to protect itself, is dictating the terms of the consent that publishers must obtain . . .

. . . which leads to the question of liability. Most publishers that work with Google to monetize their sites have contracts in place with the platform indemnifying Google from liability, which made sense when publishers were in control of the data. But under Google’s announced implementation of GDPR rules, publishers assume all liability for obtaining explicit consumer consent but cede control over its use in the Google platform. And that doesn’t make sense.

Google is a platform partner for the vast majority of publishers. While solid numbers are elusive, largely because Google doesn’t want its market dominance to be quantified (does the word “monopoly” resonate?), it is safe to say that at least 75% of all US-based publishers work with Google; the situation in Europe is less extreme, by all reports. There are other platforms with which to work, but there is no guarantee that those Google alternatives won’t dictate even more onerous terms.

Must publishers comply with Google’s terms, or do they have a choice? It’s a safe bet that, even with Google, they’re going to experience a major revenue hit because advertisers — forced to comply with GDPR, too — are likely to reduce their budgets and take a wait-and-see approach.

So, faced with a lose/lose situation, now is a perfect time for a grand experiment. For over 10 years, marketers have spent up to 70% (some say it might be more) of their marketing dollars seeking the ever-elusive Holy Grail: data and technology that will finally deliver cheap, measurable, and successful advertising. And, according to most big marketers, none of it has really worked. What would happen, though, if everyone went back to doing things the old-fashioned way: brand marketers aligning with trusted publishers, eliminating the myriad middlemen that suck up all their marketing money, and using context as a proxy for audience to achieve mutually beneficial ends? It’s the way advertising was conducted back in the day when businesses were growing. It’s the way television still works today.

Publishers: Now is the time to go back to the future. Reach out to your best partners, and together, move past Google.