Abstract image of a woman sitting on books and studying on a laptop

Presentation at CPDP

Johnny Ryan, profile picture
Johnny Ryan

This document outlines the real-time bidding (RTB) process used for online behavioral advertising. It shows how a user's personal data is broadcast to hundreds of companies through each step, from the ad server and supply-side platform (SSP) to the ad exchange and demand-side platforms (DSPs). This allows vast amounts of personal data to be leaked daily, in potential violation of GDPR requirements for appropriate security and purpose limitation of personal data processing.

Business
1 of 69
Downloaded 19 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
Presentation at CPDP
RTB
The Daily Bugle
The Daily Bugle ExchangeExchange Exchange Exchange
The Daily Bugle ExchangeExchange Exchange Exchange DSP DSP DSP DSP DSP DSP DSP DSP DSPDSP DSP DSP DSP
The Daily Bugle ExchangeExchange Exchange Exchange DSP DSP DSP DSP DSP DSP DSP DSP DSPDSP DSP DSP DSP ADVERTISEMENT
? ? The Daily Bugle ExchangeExchange Exchange Exchange DSP DSP DSP DSP DSP DSP DSP DSP DSPDSP DSP DSP DSP ? ? ? ? ADVERTISEMENT ?
? ? The Daily Bugle ExchangeExchange Exchange Exchange DSP DSP DSP DSP DSP DSP DSP DSP DSPDSP DSP DSP DSP ? ? ? ? ADVERTISEMENT ?
CNIL regulator caught it with 68 million illegal RTB records. Example Vectaury: a small DSP/DMP/ trading desk in France. €3.5M annual turnover in 2017 (though subsequently won a €20M investment). DSP
Presentation at CPDP
Presentation at CPDP
Is 68 million just 30%? Then this small company was sent personal data ¼ BILLION times via RTB (in just one year)
website.com This is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
Ad server website.com Ad server javascript Step 1. User requests webpageThis is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
Ad server SSP Step 2. Ad server selects an SSP website.com Ad server javascript SSP javascript Step 1. User requests webpageThis is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange website.com Ad server javascript SSP javascript Step 1. User requests webpage Ad exchange This is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange MARKETERS website.com DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP Ad server javascript SSP javascript Step 1. User requests webpage Ad exchange Step 4. Exchange sends bid requests to hundreds of partners This is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange MARKETERS website.com Winningbid Ad server javascript SSP javascript Step 1. User requests webpage Ad exchange Step 4. Exchange sends bid requests to hundreds of partners DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP This is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange MARKETERS website.com Winningbid Ad server javascript SSP javascript DMP DMP DMP DMP DSP DSP DSP DSP DSP Step 1. User requests webpage Ad exchange Step 4. Exchange sends bid requests to hundreds of partners Step 5. Exchange lets some DMPs/ DSPs to refresh cookie sync DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP This is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange MARKETERS website.com Winningbid Ad server javascript SSP javascript DMP DMP DMP DMP DSP DSP DSP DSP DSP DSP javascript Step 6. Exchange serves winning bid Winning DSP Step 1. User requests webpage Ad exchange Step 4. Exchange sends bid requests to hundreds of partners Step 5. Exchange lets some DMPs/ DSPs to refresh cookie sync DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP This is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange Step 7. DSP serves agency creative MARKETERS website.com Winningbid Ad server javascript SSP javascript DMP DMP DMP DMP DSP DSP DSP DSP DSP DSP javascript Ad server javascript Step 6. Exchange serves winning bid Agency ad server Winning DSP Step 1. User requests webpage Ad exchange Step 4. Exchange sends bid requests to hundreds of partners Step 5. Exchange lets some DMPs/ DSPs to refresh cookie sync DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP This is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange Step 7. DSP serves agency creative Step 8. Assets load from CDN MARKETERS website.com AD Winningbid Ad server javascript SSP javascript DMP DMP DMP DMP DSP DSP DSP DSP DSP DSP javascript Ad server javascript Step 6. Exchange serves winning bid Agency ad server Winning DSP Step 1. User requests webpage Ad exchange Step 4. Exchange sends bid requests to hundreds of partners Step 5. Exchange lets some DMPs/ DSPs to refresh cookie sync CDN DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP This is the current process of real-time bidding that is used in online behavioural advertising. DATA LEAKAGE IN ONLINE ADVERTISING Channel of data leakage Legend Money
Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange Step 7. DSP serves agency creative Step 8. Assets load from CDN Step 9. Agency ad server loads verification vendor MARKETERS website.com AD Winningbid Ad server javascript SSP javascript DMP DMP DMP DMP DSP DSP DSP DSP DSP DSP javascript Ad server javascript Step 6. Exchange serves winning bid Verification javascript Agency ad server Verification vendor Winning DSP Step 1. User requests webpage Ad exchange Step 4. Exchange sends bid requests to hundreds of partners Step 5. Exchange lets some DMPs/ DSPs to refresh cookie sync CDN DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP This is the current process of real-time bidding that is used in online behavioural advertising. DATA LEAKAGE IN ONLINE ADVERTISING Channel of data leakage Legend Money
What’s in a bid request?
IAB OpenRTB Google Authorized Buyers
Presentation at CPDP
595 different data types. Here’s a (tiny) example, from IAB technical docs…
Presentation at CPDP
The website this specific person is currently viewing
The website this specific person is currently viewing Various ID codes that identify this specific person, and can tie them to existing profiles
The website this specific person is currently viewing Various ID codes that identify this specific person, and can tie them to existing profiles Distinctive characteristics of this specific person
The website this specific person is currently viewing Various ID codes that identify this specific person, and can tie them to existing profiles Distinctive characteristics of this specific person Distinctive information about this specific person’s device
The website this specific person is currently viewing Various ID codes that identify this specific person, and can tie them to existing profiles Distinctive characteristics of this specific person This specific person’s IP address Distinctive information about this specific person’s device
The website this specific person is currently viewing Various ID codes that identify this specific person, and can tie them to existing profiles Distinctive characteristics of this specific person This specific person’s IP address Distinctive information about this specific person’s device Distinctive information about this specific person’s device
The website this specific person is currently viewing Various ID codes that identify this specific person, and can tie them to existing profiles Distinctive characteristics of this specific person This specific person’s IP address Distinctive information about this specific person’s device Distinctive information about this specific person’s device This young woman’s GPS coordinates!
What’s the scale?
50 billion Real-time bidding bid requests per day Index Exchange
Index Exchange 50 billion 1. “Tour IX’s Amsterdam and Frankfurt Data Centers”, Index Exchange, 2 July 2018 (URL: https://www.indexexchange.com/tour-ix-amsterdam-frankfurt-data-centers/). 2. "OpenX Ad Exchange", OpenX (URL: https://www.openx.com/uk_en/products/ad-exchange/). 3. “Buyers”, Rubicon Project (URL: https://rubiconproject.com/buyers/). 4. "How PubMatic Is Learning Machine Learning", PubMatic, 25 January 2019 (URL: https://pubmatic.com/blog/learning-machine-learning/) 5. "Maximize yield with Oath's publisher offerings", Oath, 3 April 2018 (URL: https://www.oath.com/insights/maximize-yield-with-oath-s-publisher-offerings/) 6. 500 Billion / 29.6 = 18.6 billion impressions per day. Using AppNexus 1:11.5 ratio, this is 214 auctions per day. 500+ impressions figure cited in “Optimize your mobile strategy”, Smaato (URL: https://www.smaato.com/). 7. “Transacting at a peak of 11.4 billion daily impressions, our marketplace handles more traffic each day than Visa, Nasdaq, and the NYSE combined” at https:// www.appnexus.com/sell. Note that in 2017, AppNexus said in “AppNexus Scales with DriveScale”, 2017 (URL: http://go.drivescale.com/rs/451-ESR-800/images/ DRV_Case_Study_AppNexus-final.v1.pdf) that 10.7 billion "impressions transacted" came as a result of running 123 billion auctions. The impressions transacted to auctions ratio appears to be roughly 1:11.5. Therefore, the 11.4 daily impressions reported in 2018 equates to 131 billion auctions per day. 8. DoubleClick.Net Usage Statistics (URL: https://trends.builtwith.com/ads/DoubleClick.Net). Real-time bidding bid requests per day OpenX 60 billion2 Rubicon Project Unknown, 1 billion people’s devices3 PubMatic 70 billion4 Oath/AOL 90 billion5 AppNexus 131 billion6 Smaato 214 billion7 Google Unknown, live on 8.4 million websites8 1 Index Exchange 50 billion The biggest
Hundreds of billions of data leaks a day. (The biggest data breach yet recorded)
Everybody you have ever known
OK
Presentation at CPDP
SECURITY
Surfacing thousands of vendors with broad rights to use data w/out tailoring those rights may be too many vendors/permissions “ ” thousands of vendors “pubvendors.json v1.0: Transparency & Consent Framework”, IAB, May 2018
Publishers recognize there is no technical way to limit the way data is used after the data is received by a vendor for decisioning/ bidding on/after delivery of an ad… “ ” there is no technical way to limit the way data is used after Surfacing thousands of vendors with broad rights to use data w/out tailoring those rights may be too many vendors/permissions “ ” thousands of vendors “pubvendors.json v1.0: Transparency & Consent Framework”, IAB, May 2018
The MO may adopt procedures for periodically reviewing and verifying a Vendor’s compliance with the Policies. “Transparency & Consent Framework Policies, 2019-08-21.3” IAB, August 2019 “ ” may adopt Management Organisation (the IAB)
IAB UK and IAB Europe have initiated a joint workstream (subject to TCF governance processes) to develop additional commitments in relation to data security for future integration into the TCF policies. “IAB UK response to the ICO’s ‘Update report into adtech and real time bidding’” IAB UK, December 2019 “ ” joint streamwork
“Authorized Buyers Programme Guidelines”, Google, August 2018 “ ” must not: (i) use callout data ... to create user lists or profile users; (ii) associate callout data ... with third party data...
Buyer will regularly monitor your compliance with this obligation, and immediately notify Google in writing if Buyer can no longer meet … this obligation... “ ” “ ” must not: (i) use callout data ... to create user lists or profile users; (ii) associate callout data ... with third party data... Buyer will “Authorized Buyers Programme Guidelines”, Google, August 2018 DSP
GDPR, Article 5 (1) (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
“broadcast” Broadcast
RTB broadcast, among thousands of companies Cause: Failure to enforce Article 5(1)f SECURITY
RTB broadcast, among thousands of companies Data free-for-all inside Google, a single company Cause: Failure to enforce Article 5(1)f Cause: Failure to enforce Article 5(1)b (“purpose limitation”) and also Article 9(2) requirement for “explicit consent” for special category data, and Article 7(3) “ease of withdrawal” External Internal SECURITY PURPOSE LIMITATION, BUNDLING, OFFENSIVE LEVERAGING & SELF-DEALING
The Future Market?
Presentation at CPDP
N20 C02
N20 C02 Regulatory incentive CLEAN INDUSTRY Regulatory disincentive DIRTY INDUSTRY
+ N20 C02 Regulatory incentive CLEAN INDUSTRY Regulatory disincentive DIRTY INDUSTRY
Ads (Personal Data) + Regulatory incentive CLEAN INDUSTRY Regulatory disincentive DIRTY INDUSTRY N20 C02 Ads (Data) + Ads (Personal Data) // The Daily Bugle
Models
Conventional “Broadcast” Behavioral
Conventional “Broadcast” Behavioral Reduced data “Broadcast” Behavioral?
• What you are reading, or watching, or listening to. • Categories of the content. • Unique pseudonymous ID. • Unique ID matched to ad buyer’s existing profile of you. • Your location (can be your exact latitude and longitude). • Granular description of your device. • Unique tracking IDs / cookie match. • Highly specific timestamp. • Your IP address.* • Data broker segment ID* when available. *Depending on the version of “real time bidding” system Conventional “Broadcast” Behavioral
• What you are reading, or watching, or listening to. • Categories of the content. • Your approximate location. • General description of your device. • Your approximate IP address. • Approximate time stamp. Person in Dublin (South Dublin) is reading an article about data law on IrishTimes.com. Using Safari on an iPhone X or higher. Reduced data “Broadcast” Behavioral?
Conventional “Broadcast” Behavioral Reduced data “Broadcast” Behavioral?
Conventional “Broadcast” Behavioral Reduced data “Broadcast” Behavioral? 1 2 “Local” Behavioral 3 OFF
Conventional “Broadcast” Behavioral “Local” Behavioral Reduced data “Broadcast” Behavioral? /// 1 2 3 ON
Google display Facebook display Brave .46% .9% 12% "Brave reaches 8 million monthly active users and delivers nearly 400 privacy-preserving ad campaigns", Brave, 16 October 2019 (URL: https://brave.com/brave-reaches-8-million-monthly-active-users-and-delivers-nearly-400-privacy-preserving-ad-campaigns/); "Average display advertising clickthrough rates", Smart Insights, 10 September 2019 (URL: https://www.smartinsights.com/internet-advertising/internet-advertising-analytics/display-advertising-clickthrough-rates/); "Average click-through rate: average CTR calculator", WordStream (URL: https://www.wordstream.com/average-ctr); "Facebook Ad Benchmarks for your industry", WordStream, 27 August 2019 (URL: https://www.wordstream.com/blog/ws/2017/02/28/facebook-advertising-benchmarks). Google search 1.91% ough RateAverage Click Thr
1. RTB broadcasts personal data widely. 
 2. There is no security. It is a huge and continuous data breach. 3. ‘Purpose limitation’ is Google kryptonite. Enforce the internal & external to allow a functioning market. 4. 16 months on, time to enforce.

More Related Content

PDF
Presentation at UK Direct Marketing Association Data Protection Conference 2019
Johnny Ryan
 
PDF
Presentation to European Political Strategy Centre at the European Commission
Johnny Ryan
 
PDF
See updated slidedeck at https://www.slideshare.net/JohnnyRyan/brief-for-worl...
Johnny Ryan
 
PDF
Presentation to ANFO, Norwegian Advertisers Association
Johnny Ryan
 
PDF
The Adtech Crisis and Disinformation
Johnny Ryan
 
PDF
Quick 10 minute overview of RTB problems to be fixed at ICO stakeholders' ses...
Johnny Ryan
 
PDF
Discussion starter at Future of Privacy Forum in Washington, DC.
Johnny Ryan
 
PDF
Briefing on adtech, RTB, and the GDPR at dmexco Brave event.
Johnny Ryan
 
Presentation at UK Direct Marketing Association Data Protection Conference 2019
Johnny Ryan
 
Presentation to European Political Strategy Centre at the European Commission
Johnny Ryan
 
See updated slidedeck at https://www.slideshare.net/JohnnyRyan/brief-for-worl...
Johnny Ryan
 
Presentation to ANFO, Norwegian Advertisers Association
Johnny Ryan
 
The Adtech Crisis and Disinformation
Johnny Ryan
 
Quick 10 minute overview of RTB problems to be fixed at ICO stakeholders' ses...
Johnny Ryan
 
Discussion starter at Future of Privacy Forum in Washington, DC.
Johnny Ryan
 
Briefing on adtech, RTB, and the GDPR at dmexco Brave event.
Johnny Ryan
 

Similar to Presentation at CPDP (20)

PDF
Johnny Ryan, Presentation at Data Protection Leadership Day, Arthur Cox Solic...
Johnny Ryan
 
PDF
Presentation to FTC technology taskforce
Johnny Ryan
 
PDF
Brief for World Federation of Advertisers Digital Executive Group, December 2018
Johnny Ryan
 
PDF
Judiciary Committee Senate staffer briefing 8 September 2019
Johnny Ryan
 
PDF
Ofcom briefing
Johnny Ryan
 
PDF
Briefing for World Federation of Advertisers Media Buyers
Johnny Ryan
 
PDF
Ethical digital marketing (Trinity College Dublin)
Johnny Ryan
 
PDF
ANTS Programmatic Agency - Credential
ANTS
 
PPTX
Big Data in Advertising Industry — Oleksandr Fedirko, Danylo Stepanchuk
GlobalLogic Ukraine
 
PDF
Welcome DSPs and RTB!
Conversion Thursday
 
PDF
Nuviad Success on AWS - Part of Big Data Month
Idan Tohami
 
PPTX
An introduction to RTB in the UK
Royal Holloway, University of London
 
PPTX
Progmmatic Buying
Centre for Digital Marketing & Communication
 
PPTX
Overview RTB ecosystem
Digital Training Courses in Noida
 
PPTX
Overview RTB ecosystem
Dheeraj Agrawal
 
PDF
Bmm aformationdigitale2014
BMMA - Belgian Management and Marketing Association
 
PDF
MadNet Performance Marketing
Nikolay Khokhlov
 
PDF
Deconstructing the In-App Bidding Landscape [White Paper]
PubNative
 
PPTX
All about Programmatic buying(RTB), DSP,SSP, DMP & DCT - A complete digital ...
Karunakar Ravirala
 
PDF
Deck at GDPR Summit at Croke Park.
Johnny Ryan
 
Johnny Ryan, Presentation at Data Protection Leadership Day, Arthur Cox Solic...
Johnny Ryan
 
Presentation to FTC technology taskforce
Johnny Ryan
 
Brief for World Federation of Advertisers Digital Executive Group, December 2018
Johnny Ryan
 
Judiciary Committee Senate staffer briefing 8 September 2019
Johnny Ryan
 
Ofcom briefing
Johnny Ryan
 
Briefing for World Federation of Advertisers Media Buyers
Johnny Ryan
 
Ethical digital marketing (Trinity College Dublin)
Johnny Ryan
 
ANTS Programmatic Agency - Credential
ANTS
 
Big Data in Advertising Industry — Oleksandr Fedirko, Danylo Stepanchuk
GlobalLogic Ukraine
 
Welcome DSPs and RTB!
Conversion Thursday
 
Nuviad Success on AWS - Part of Big Data Month
Idan Tohami
 
An introduction to RTB in the UK
Royal Holloway, University of London
 
Progmmatic Buying
Centre for Digital Marketing & Communication
 
Overview RTB ecosystem
Digital Training Courses in Noida
 
Overview RTB ecosystem
Dheeraj Agrawal
 
Bmm aformationdigitale2014
BMMA - Belgian Management and Marketing Association
 
MadNet Performance Marketing
Nikolay Khokhlov
 
Deconstructing the In-App Bidding Landscape [White Paper]
PubNative
 
All about Programmatic buying(RTB), DSP,SSP, DMP & DCT - A complete digital ...
Karunakar Ravirala
 
Deck at GDPR Summit at Croke Park.
Johnny Ryan
 
Ad

More from Johnny Ryan (14)

PDF
CPDP 2022
Johnny Ryan
 
PDF
Brief presentation to UCD 17 December 2020
Johnny Ryan
 
PDF
Presentation to world news publishers, November 2020
Johnny Ryan
 
PDF
Kryptonite, neglected
Johnny Ryan
 
PDF
Brave2020報告書：データ保護当局の執行能力
Johnny Ryan
 
PDF
Talk at IAPP London May 2020: Competition, and why the GDPR is failing
Johnny Ryan
 
PDF
Purpose limitation in data protection law as a protection against "cascading ...
Johnny Ryan
 
PDF
IVIR summer school slides
Johnny Ryan
 
PDF
Brendan Eich's letter to Senator Thune and Senator Nelson, Senate Committee o...
Johnny Ryan
 
PDF
Talk to Norwegian CMOs about the folly of adtech
Johnny Ryan
 
PDF
Tech stole your audience. Take it back.
Johnny Ryan
 
PDF
Johnny Ryan PageFair slide deck from SIINDA (search industry trade body) conf...
Johnny Ryan
 
PDF
GDPR solution for websites and apps. Digital Content Next (DCN) webinar, Apri...
Johnny Ryan
 
PDF
Slides from PageFair presentation in Athens, GDPR for Marketers Conference, 1...
Johnny Ryan
 
CPDP 2022
Johnny Ryan
 
Brief presentation to UCD 17 December 2020
Johnny Ryan
 
Presentation to world news publishers, November 2020
Johnny Ryan
 
Kryptonite, neglected
Johnny Ryan
 
Brave2020報告書：データ保護当局の執行能力
Johnny Ryan
 
Talk at IAPP London May 2020: Competition, and why the GDPR is failing
Johnny Ryan
 
Purpose limitation in data protection law as a protection against "cascading ...
Johnny Ryan
 
IVIR summer school slides
Johnny Ryan
 
Brendan Eich's letter to Senator Thune and Senator Nelson, Senate Committee o...
Johnny Ryan
 
Talk to Norwegian CMOs about the folly of adtech
Johnny Ryan
 
Tech stole your audience. Take it back.
Johnny Ryan
 
Johnny Ryan PageFair slide deck from SIINDA (search industry trade body) conf...
Johnny Ryan
 
GDPR solution for websites and apps. Digital Content Next (DCN) webinar, Apri...
Johnny Ryan
 
Slides from PageFair presentation in Athens, GDPR for Marketers Conference, 1...
Johnny Ryan
 
Ad

Recently uploaded (20)

PDF
Satish NS: Fostering Innovation and Sustainability: Haier India’s Customer-Ce...
red402426
 
PPTX
Understanding Procurement Strategies.pptx Your score increases as you pick a ...
ssuser886aa1
 
PDF
Second Hand Fashion Call to Action March 2025
agatadrynko
 
PPTX
CTG - Business Update 2Q2025 & 6M2025.pptx
HcTrSoros
 
PDF
Stacey L Stevens - Canada's Most Influential Women Lawyers Revolutionizing Th...
insightssuccess2
 
PPTX
Market and Demand Analysis.pptx for Management students
DrKavitaRani2
 
PDF
Susan Semmelmann: Enriching the Lives of others through her Talents and Bless...
CIO WOMEN MAGAIZNE CIO WOMEN MAGAIZNE
 
PPTX
chapter 2 entrepreneurship full lecture ppt
annejo20
 
PDF
Highest-Paid CEO in 2025_ You Won’t Believe Who Tops the List.pdf
Visionary CIOs
 
PPTX
Chapter 2 strategic Presentation (6).pptx
5624212u
 
PDF
Robin Fischer: A Visionary Leader Making a Difference in Healthcare, One Day ...
The lifescience magaizne
 
PPTX
df0ee68f89e1a869be4bff9b80a7 business 79f0.pptx
diksha27bhardwaj
 
DOCX
Center Enamel Powering Innovation and Resilience in the Italian Chemical Indu...
cecvessels
 
DOCX
Hand book of Entrepreneurship 4 Chapters.docx
DrSubinKMohan
 
PDF
income tax laws notes important pakistan
VrindaTayade1
 
PDF
Chapter 2 - AI chatbots and prompt engineering.pdf
Quan Risk
 
PDF
Vinod Bhatt - Most Inspiring Supply Chain Leader in India 2025.pdf
insightssuccess2
 
DOCX
Handbook of entrepreneurship- Chapter 7- Types of business organisations
DrSubinKMohan
 
PDF
Middle East's Most Impactful Business Leaders to Follow in 2025
thearabbusiness
 
PDF
Engaging Stakeholders in Policy Discussions: A Legal Framework (www.kiu.ac.ug)
publication11
 
Satish NS: Fostering Innovation and Sustainability: Haier India’s Customer-Ce...
red402426
 
Understanding Procurement Strategies.pptx Your score increases as you pick a ...
ssuser886aa1
 
Second Hand Fashion Call to Action March 2025
agatadrynko
 
CTG - Business Update 2Q2025 & 6M2025.pptx
HcTrSoros
 
Stacey L Stevens - Canada's Most Influential Women Lawyers Revolutionizing Th...
insightssuccess2
 
Market and Demand Analysis.pptx for Management students
DrKavitaRani2
 
Susan Semmelmann: Enriching the Lives of others through her Talents and Bless...
CIO WOMEN MAGAIZNE CIO WOMEN MAGAIZNE
 
chapter 2 entrepreneurship full lecture ppt
annejo20
 
Highest-Paid CEO in 2025_ You Won’t Believe Who Tops the List.pdf
Visionary CIOs
 
Chapter 2 strategic Presentation (6).pptx
5624212u
 
Robin Fischer: A Visionary Leader Making a Difference in Healthcare, One Day ...
The lifescience magaizne
 
df0ee68f89e1a869be4bff9b80a7 business 79f0.pptx
diksha27bhardwaj
 
Center Enamel Powering Innovation and Resilience in the Italian Chemical Indu...
cecvessels
 
Hand book of Entrepreneurship 4 Chapters.docx
DrSubinKMohan
 
income tax laws notes important pakistan
VrindaTayade1
 
Chapter 2 - AI chatbots and prompt engineering.pdf
Quan Risk
 
Vinod Bhatt - Most Inspiring Supply Chain Leader in India 2025.pdf
insightssuccess2
 
Handbook of entrepreneurship- Chapter 7- Types of business organisations
DrSubinKMohan
 
Middle East's Most Impactful Business Leaders to Follow in 2025
thearabbusiness
 
Engaging Stakeholders in Policy Discussions: A Legal Framework (www.kiu.ac.ug)
publication11
 

Presentation at CPDP

  • 2. RTB
  • 9. CNIL regulator caught it with 68 million illegal RTB records. Example Vectaury: a small DSP/DMP/ trading desk in France. €3.5M annual turnover in 2017 (though subsequently won a €20M investment). DSP
  • 12. Is 68 million just 30%? Then this small company was sent personal data ¼ BILLION times via RTB (in just one year)
  • 13. website.com This is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
  • 14. Ad server website.com Ad server javascript Step 1. User requests webpageThis is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
  • 15. Ad server SSP Step 2. Ad server selects an SSP website.com Ad server javascript SSP javascript Step 1. User requests webpageThis is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
  • 16. Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange website.com Ad server javascript SSP javascript Step 1. User requests webpage Ad exchange This is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
  • 17. Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange MARKETERS website.com DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP Ad server javascript SSP javascript Step 1. User requests webpage Ad exchange Step 4. Exchange sends bid requests to hundreds of partners This is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
  • 18. Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange MARKETERS website.com Winningbid Ad server javascript SSP javascript Step 1. User requests webpage Ad exchange Step 4. Exchange sends bid requests to hundreds of partners DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP This is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
  • 19. Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange MARKETERS website.com Winningbid Ad server javascript SSP javascript DMP DMP DMP DMP DSP DSP DSP DSP DSP Step 1. User requests webpage Ad exchange Step 4. Exchange sends bid requests to hundreds of partners Step 5. Exchange lets some DMPs/ DSPs to refresh cookie sync DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP This is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
  • 20. Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange MARKETERS website.com Winningbid Ad server javascript SSP javascript DMP DMP DMP DMP DSP DSP DSP DSP DSP DSP javascript Step 6. Exchange serves winning bid Winning DSP Step 1. User requests webpage Ad exchange Step 4. Exchange sends bid requests to hundreds of partners Step 5. Exchange lets some DMPs/ DSPs to refresh cookie sync DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP This is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
  • 21. Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange Step 7. DSP serves agency creative MARKETERS website.com Winningbid Ad server javascript SSP javascript DMP DMP DMP DMP DSP DSP DSP DSP DSP DSP javascript Ad server javascript Step 6. Exchange serves winning bid Agency ad server Winning DSP Step 1. User requests webpage Ad exchange Step 4. Exchange sends bid requests to hundreds of partners Step 5. Exchange lets some DMPs/ DSPs to refresh cookie sync DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP This is the current process of real-time bidding that is used in online behavioural advertising. Channel of data leakage Legend Money DATA LEAKAGE IN ONLINE ADVERTISING
  • 22. Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange Step 7. DSP serves agency creative Step 8. Assets load from CDN MARKETERS website.com AD Winningbid Ad server javascript SSP javascript DMP DMP DMP DMP DSP DSP DSP DSP DSP DSP javascript Ad server javascript Step 6. Exchange serves winning bid Agency ad server Winning DSP Step 1. User requests webpage Ad exchange Step 4. Exchange sends bid requests to hundreds of partners Step 5. Exchange lets some DMPs/ DSPs to refresh cookie sync CDN DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP This is the current process of real-time bidding that is used in online behavioural advertising. DATA LEAKAGE IN ONLINE ADVERTISING Channel of data leakage Legend Money
  • 23. Ad server SSP Step 2. Ad server selects an SSP Step 3. SSP selects an exchange Step 7. DSP serves agency creative Step 8. Assets load from CDN Step 9. Agency ad server loads verification vendor MARKETERS website.com AD Winningbid Ad server javascript SSP javascript DMP DMP DMP DMP DSP DSP DSP DSP DSP DSP javascript Ad server javascript Step 6. Exchange serves winning bid Verification javascript Agency ad server Verification vendor Winning DSP Step 1. User requests webpage Ad exchange Step 4. Exchange sends bid requests to hundreds of partners Step 5. Exchange lets some DMPs/ DSPs to refresh cookie sync CDN DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP This is the current process of real-time bidding that is used in online behavioural advertising. DATA LEAKAGE IN ONLINE ADVERTISING Channel of data leakage Legend Money
  • 24. What’s in a bid request?
  • 25. IAB OpenRTB Google Authorized Buyers
  • 27. 595 different data types. Here’s a (tiny) example, from IAB technical docs…
  • 29. The website this specific person is currently viewing
  • 30. The website this specific person is currently viewing Various ID codes that identify this specific person, and can tie them to existing profiles
  • 31. The website this specific person is currently viewing Various ID codes that identify this specific person, and can tie them to existing profiles Distinctive characteristics of this specific person
  • 32. The website this specific person is currently viewing Various ID codes that identify this specific person, and can tie them to existing profiles Distinctive characteristics of this specific person Distinctive information about this specific person’s device
  • 33. The website this specific person is currently viewing Various ID codes that identify this specific person, and can tie them to existing profiles Distinctive characteristics of this specific person This specific person’s IP address Distinctive information about this specific person’s device
  • 34. The website this specific person is currently viewing Various ID codes that identify this specific person, and can tie them to existing profiles Distinctive characteristics of this specific person This specific person’s IP address Distinctive information about this specific person’s device Distinctive information about this specific person’s device
  • 35. The website this specific person is currently viewing Various ID codes that identify this specific person, and can tie them to existing profiles Distinctive characteristics of this specific person This specific person’s IP address Distinctive information about this specific person’s device Distinctive information about this specific person’s device This young woman’s GPS coordinates!
  • 37. 50 billion Real-time bidding bid requests per day Index Exchange
  • 38. Index Exchange 50 billion 1. “Tour IX’s Amsterdam and Frankfurt Data Centers”, Index Exchange, 2 July 2018 (URL: https://www.indexexchange.com/tour-ix-amsterdam-frankfurt-data-centers/). 2. "OpenX Ad Exchange", OpenX (URL: https://www.openx.com/uk_en/products/ad-exchange/). 3. “Buyers”, Rubicon Project (URL: https://rubiconproject.com/buyers/). 4. "How PubMatic Is Learning Machine Learning", PubMatic, 25 January 2019 (URL: https://pubmatic.com/blog/learning-machine-learning/) 5. "Maximize yield with Oath's publisher offerings", Oath, 3 April 2018 (URL: https://www.oath.com/insights/maximize-yield-with-oath-s-publisher-offerings/) 6. 500 Billion / 29.6 = 18.6 billion impressions per day. Using AppNexus 1:11.5 ratio, this is 214 auctions per day. 500+ impressions figure cited in “Optimize your mobile strategy”, Smaato (URL: https://www.smaato.com/). 7. “Transacting at a peak of 11.4 billion daily impressions, our marketplace handles more traffic each day than Visa, Nasdaq, and the NYSE combined” at https:// www.appnexus.com/sell. Note that in 2017, AppNexus said in “AppNexus Scales with DriveScale”, 2017 (URL: http://go.drivescale.com/rs/451-ESR-800/images/ DRV_Case_Study_AppNexus-final.v1.pdf) that 10.7 billion "impressions transacted" came as a result of running 123 billion auctions. The impressions transacted to auctions ratio appears to be roughly 1:11.5. Therefore, the 11.4 daily impressions reported in 2018 equates to 131 billion auctions per day. 8. DoubleClick.Net Usage Statistics (URL: https://trends.builtwith.com/ads/DoubleClick.Net). Real-time bidding bid requests per day OpenX 60 billion2 Rubicon Project Unknown, 1 billion people’s devices3 PubMatic 70 billion4 Oath/AOL 90 billion5 AppNexus 131 billion6 Smaato 214 billion7 Google Unknown, live on 8.4 million websites8 1 Index Exchange 50 billion The biggest
  • 39. Hundreds of billions of data leaks a day. (The biggest data breach yet recorded)
  • 41. OK
  • 44. Surfacing thousands of vendors with broad rights to use data w/out tailoring those rights may be too many vendors/permissions “ ” thousands of vendors “pubvendors.json v1.0: Transparency & Consent Framework”, IAB, May 2018
  • 45. Publishers recognize there is no technical way to limit the way data is used after the data is received by a vendor for decisioning/ bidding on/after delivery of an ad… “ ” there is no technical way to limit the way data is used after Surfacing thousands of vendors with broad rights to use data w/out tailoring those rights may be too many vendors/permissions “ ” thousands of vendors “pubvendors.json v1.0: Transparency & Consent Framework”, IAB, May 2018
  • 46. The MO may adopt procedures for periodically reviewing and verifying a Vendor’s compliance with the Policies. “Transparency & Consent Framework Policies, 2019-08-21.3” IAB, August 2019 “ ” may adopt Management Organisation (the IAB)
  • 47. IAB UK and IAB Europe have initiated a joint workstream (subject to TCF governance processes) to develop additional commitments in relation to data security for future integration into the TCF policies. “IAB UK response to the ICO’s ‘Update report into adtech and real time bidding’” IAB UK, December 2019 “ ” joint streamwork
  • 48. “Authorized Buyers Programme Guidelines”, Google, August 2018 “ ” must not: (i) use callout data ... to create user lists or profile users; (ii) associate callout data ... with third party data...
  • 49. Buyer will regularly monitor your compliance with this obligation, and immediately notify Google in writing if Buyer can no longer meet … this obligation... “ ” “ ” must not: (i) use callout data ... to create user lists or profile users; (ii) associate callout data ... with third party data... Buyer will “Authorized Buyers Programme Guidelines”, Google, August 2018 DSP
  • 50. GDPR, Article 5 (1) (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
  • 52. RTB broadcast, among thousands of companies Cause: Failure to enforce Article 5(1)f SECURITY
  • 53. RTB broadcast, among thousands of companies Data free-for-all inside Google, a single company Cause: Failure to enforce Article 5(1)f Cause: Failure to enforce Article 5(1)b (“purpose limitation”) and also Article 9(2) requirement for “explicit consent” for special category data, and Article 7(3) “ease of withdrawal” External Internal SECURITY PURPOSE LIMITATION, BUNDLING, OFFENSIVE LEVERAGING & SELF-DEALING
  • 59. Ads (Personal Data) + Regulatory incentive CLEAN INDUSTRY Regulatory disincentive DIRTY INDUSTRY N20 C02 Ads (Data) + Ads (Personal Data) // The Daily Bugle
  • 63. • What you are reading, or watching, or listening to. • Categories of the content. • Unique pseudonymous ID. • Unique ID matched to ad buyer’s existing profile of you. • Your location (can be your exact latitude and longitude). • Granular description of your device. • Unique tracking IDs / cookie match. • Highly specific timestamp. • Your IP address.* • Data broker segment ID* when available. *Depending on the version of “real time bidding” system Conventional “Broadcast” Behavioral
  • 64. • What you are reading, or watching, or listening to. • Categories of the content. • Your approximate location. • General description of your device. • Your approximate IP address. • Approximate time stamp. Person in Dublin (South Dublin) is reading an article about data law on IrishTimes.com. Using Safari on an iPhone X or higher. Reduced data “Broadcast” Behavioral?
  • 66. Conventional “Broadcast” Behavioral Reduced data “Broadcast” Behavioral? 1 2 “Local” Behavioral 3 OFF
  • 67. Conventional “Broadcast” Behavioral “Local” Behavioral Reduced data “Broadcast” Behavioral? /// 1 2 3 ON
  • 68. Google display Facebook display Brave .46% .9% 12% "Brave reaches 8 million monthly active users and delivers nearly 400 privacy-preserving ad campaigns", Brave, 16 October 2019 (URL: https://brave.com/brave-reaches-8-million-monthly-active-users-and-delivers-nearly-400-privacy-preserving-ad-campaigns/); "Average display advertising clickthrough rates", Smart Insights, 10 September 2019 (URL: https://www.smartinsights.com/internet-advertising/internet-advertising-analytics/display-advertising-clickthrough-rates/); "Average click-through rate: average CTR calculator", WordStream (URL: https://www.wordstream.com/average-ctr); "Facebook Ad Benchmarks for your industry", WordStream, 27 August 2019 (URL: https://www.wordstream.com/blog/ws/2017/02/28/facebook-advertising-benchmarks). Google search 1.91% ough RateAverage Click Thr
  • 69. 1. RTB broadcasts personal data widely. 
 2. There is no security. It is a huge and continuous data breach. 3. ‘Purpose limitation’ is Google kryptonite. Enforce the internal & external to allow a functioning market. 4. 16 months on, time to enforce.