GDPR Consent FAQ

Q: What is GDPR and what will it do?
A: The GDPR is a new EU data protection regulation coming into effect on May 25th, 2018. GDPR will change the definition of ‘personal data’. It also changes how companies need to obtain consent from people before their personal data can be used or before using cookies and other information stored on user devices under the Cookie Directive.

Q: Why does this solution matter?
A: Digital news organisations generate 80 percent of their revenues from advertising. Relevant, targeted ads are far more effective at generating revenue for brands than untargeted messages. Without a solution, the publishers, advertisers and ad technology companies that all work together to decide which ads to show to which readers would have no common language to know whether or not a consumer had given their consent for their data to be used. This would have three main side effects:
Unable to put ads in front of the right audiences, the publishers – whose business models are already under pressure – would lose access to this vital source of revenue. As a result, they’d be encouraged to put more of their content behind paywalls or make cuts to their content
Consumers would see the relevancy and quality of online advertising drop off a cliff over night, reducing the quality of their online experience
The European advertising industry, which currently contributes more than half a trillion Euros in GDP each year and employs millions of people in creative and technical roles, would be under threat

Q: What platform will the solution be built and hosted on?
A: The Industry Consent Solution is a standard agreed upon by publishers, advertiser and technology companies that provides a common language in the form of a JavaScript API that enables the passing of user consent signals. No single company will build, host or control the solution and updates to the standard will be maintained by the IAB. Any company that agrees to comply with industry policies and procedures can build their own consent solution and apply to become a Consent Management Provider. This provides publishers with choice on who to work with for their consent solution.

Q: Who will use this tool?
A: We’re encouraging any company worldwide that needs to use the personal data of EU citizens to make use of this solution, including publishers, technology companies and advertisers.

Q: Have any publishers already signed up to implement the solution?
A: Yes. There are several major publishers involved in the IAB’s GDPR working group and we will share more in the coming weeks.

Q: Have you consulted DPAs about this solution?
A: Now we have broad industry agreement on a framework for the solution, consulting with local data protection authorities is a key part of this next phase. We look forward to having a frank and open conversation with relevant authorities over the coming weeks and months and we welcome their feedback.

Q: Are you confident that this solution will be compliant with GDPR?
A: Yes. We’ve taken a conservative approach when interpreting the regulations and this solution balances the protection and control of consumers and their data while enabling them to have a positive online experience and helping the online advertising and publishing industries thrive post-GDPR.

Q: How will it be used?
A: Companies that meet the criteria and receive approval from an independent body set up to regulate the solution will be able to integrate the consent tool on their website or mobile app. When a consumer visits their site or opens their app, the solution will either recognise them as having given their consent or ask them to do so then.

Q: What if consumers don’t give their consent?
A: This is up to each service provider (e.g. publisher or advertiser) to decide. Some publishers may restrict access to their offering to users who do not share their data in exchange for more relevant advertising and content. Others may offer users alternative value propositions such as access in return for a payment. This solution does not impact what experience the publisher chooses to give to a user after the user has been presented with their consent options.

Q: What percentage of consumers do you expect to give their consent to the new solution?
A: Most internet users today are comfortable with the value exchange between sharing some information and receiving free news and entertainment online. We’re optimistic that this will be reflected in consent rates when the solution goes live. Our early tests also support this.

Q: Can you share any data from your early tests?
A: It’s still very early days so we’re not disclosing anything at this stage. Stay tuned.

Q: When will it be available?
A: We plan on making this widely available in February 2018.

Q: How will they access it?
A:

Q: How much will it cost?
A: This is an ‘open-source’ solution, which means it’s being developed and given to the industry for free. In some cases where publishers are accessing the solution through technology companies, those companies may charge a fee.

Q: Who will regulate and host the solution?
A: A neutral industry body will be set up that will be governed by key stakeholder organisations to administer and host the solution. We will be sharing more information in the coming weeks. Stay tuned.

Q: Why are you making it ‘open-source’?
A: The IAB and its member companies believe in free access to news and information for consumers, and the benefits that a thriving digital advertising industry brings to the global economy. By making this solution open-source, we’re making it easy for publishers, advertisers and technology providers to implement and meet the requirements of the GDPR in advance of its coming into effect.

Q: Who built it?
A: The solution is the result of a cross-industry project as part of the IAB Europe’s GDPR Implementation Group. The bulk of the development of the work on the solution is being done by Quantcast but many companies have been participating and contributing.

Q: Who’s been involved in the process?
A: The IAB GDPR Implementation Group includes a cross-section of the industry, including brands, publishers and advertising technology companies. This includes organisations MediaMath, AppNexus and Quantcast.

Q: How long has this consent solution been in development?
A: Since the beginning of 2017.

Q: Does the IAB Europe agree with the GDPR?
A: The IAB Europe and its member organisations believe in consumer choice over how their data is gathered and used, and we support the principles the GDPR seeks to reinforce. However, there are unintended consequences of any new regulation and this solution seeks to ensure that publishers and the global digital advertising and creative industries can continue to thrive in line with GDPR.

Q: Will this new tool be compliant with ePR?
A: The ePrivacy regulation is still under discussion, but the ePR relies on the GDPR’s definition of consent. Therefore we expect the two will be compatible and the solution will be compliant with both..

Q: Has there been any testing of this new standard? Or are there plans to before February?
A: Yes, we’re already in the early stages of testing and initial results have been positive.

Q: GDPR has been a known issue for some time. Why is the IAB only presenting an issue now?
A: The new regulation presents a complex challenge to an interconnected network of organisations. It naturally takes time to arrive on a workable solution. The lack of guidance on how the regulation will be interpreted has added complexity.

Q: Is it premature to announce something now with new guidelines expected in a few weeks?
A: Publishers need certainty that a workable solution is on the way. Even a few weeks advance notice will allow publishers to better plan and prepare to adopt the solution, so as to be prepared ahead of GDPR coming into effect.

Q: Who within publisher organisations should be responsible to implementing this? Where are there skills gaps today?
A: Implementing the consent solution will be similar to implementing an “out-of-the-box” analytics tool such as google analytics or quantcast. It will require simply placing javascript code on every page (within the webpage head) of a publisher’s site.

Q: Is this solution only for European companies, or will it be open to international organisations?
A: It will be available to any company that wants to participate, including those outside of Europe.