Google updates user consent policies for publishers ahead of GDPR

Dive Brief:

On Thursday, Google updated its ad policies for advertisers and publishers in preparation for GDPR, refining the user consent requirements for parties using its advertising services. Google will work with IAB Europe and other industry groups on consent solutions and plans to roll out a tool for web publishers to put out non-personalized ads for users who object to their personal data being used for ad-targeting.
For its own platforms, such as Google.com, Gmail and YouTube, Google will get direct consent from users, reports The Wall Street Journal. Third parties and applications using Google's ad tech will have to acquire consent themselves. The internet company is making publishers maintain consent records and offer users clear paths to revoking consent to use personal data.
There is still some uncertainty on which companies will have to get consent directly from end users and if publishers will run into difficulty dealing with different procedures between ad-tech partners, according to the report. Google, however, is trying to be a "co-controller" of publishers' user data.

Dive Insight:

As one of the biggest data processors and controllers in the world, Google's GDPR compliance journey is especially important, and its decisions will reverberate through industries that use its platform. And with 4% of global annual turnover on the line, Google needs to get it right the first time.

GDPR requires data processors and controllers to provide consent in clear and understandable terms so users know how their data is being used. It also extends significant contractual pressures between organizations, because a company cannot use the excuse of not knowing that a partner wasn't up to par with GDPR mandates. With its announcement, Google is making clear the responsibilities of partners and advertisers using its platform.

With skepticism of large technology firms on the rise, especially among U.S. and international lawmakers, Google and its peers would be easy targets to make an example when the deadline hits. But noncompliance costs aside, GDPR could take a toll on the internet company already. If one-third of European users opt out of data sharing, it could translate to a 2% hit on ad revenue, its most profitable segment.

Technology peers such as Microsoft and AWS have expressed commitment to the May 25 deadline, although when it comes to GDPR they occupy a different niche than Google or social media companies, whose bread and butter is consumers' PII.