S2 #14 What keeps every CMO and digital operations team up at night?

[00:00:00] INTRO: Welcome to the Power of Digital Policy, a show that helps digital marketers, online communications directors, and others throughout the organization balance out risks and opportunities created by using digital channels. Here's your host, Kristina Podnar.

[00:00:18] KRISTINA PODNAR, host: The digital policy world is hoppy with all kinds of activity. And one of the most impactful areas at the moment is, of course, privacy. We've all gotten fluent now on GDPR speak. And, of course, you might be well into LGP. POPIA even CCPA compliance, lots of jargon there, but the question is, are you ready for CPA? Which is Colorado's data privacy act and something that's new on the books for everyone. If you're not fully up to speed, don't worry. I have you covered; my guest today is Matt Voda. He's the CEO of OptiMine Software, a consumer privacy advocate, and he's also the nationally recognized expert in marketing who advises some of the world's largest companies like Twitter, Overstock, Pandora, Verizon, and more. Matt is well versed in how to best outline your marketing and advertising strategies, including addressing all of the recent privacy changes. I'm feeling very confident that we're in great hands today. Ready to listen and learn, Matt. Big welcome.

[00:01:14] MATT VODA, guest: Thank you, Kristina. Good to be here.

[00:01:16] KRISTINA: I am so excited because obviously, we have all of these data privacy laws coming up; Colorado just became the third state to pass a data privacy regulation. We're basically looking at these new waves. What should we make of it? Can you kind of give us the primmer on the CPA as well as kind of all of these new waves of regulations that are coming at us?

[00:01:36] MATT: Yeah, sure. I think in order to understand where we are now, you have to dial the calendar back to 2018. A lot of the regulations that we're seeing here in the states really come out of the GDPR in the European Union. And that was the first landmark privacy regulation. May 2018 is when that went into effect, and it gave consumers the first rights around privacy control over their data. The rights to control whether their data could be sold. In regulations on different participants in the advertising technology, data markets, and CCPA, California's regulation was the first to hit in the US and it was modeled in large part after the GDPR. And what's happened since CCPA went live, I think about a year and a half ago. Now you're starting to see other states crop up with their own consumer regulations around data privacy. And many of them are fashioned in a very similar way to CCPA, which traces the roots back to GDPR. Colorado is the latest. But Virginia and Nevada, a few other states, have enacted similar regulations. And then there are about a dozen states in the US that have active consumer privacy regulations in their pipeline. Most notably, New York, that's the next big one in the pipeline. So it's riding up like mushrooms here in the US, and the challenge is that they're all just slightly different in terms of the regulations. There's not a uniform approach to this, and each state has its own unique wrinkles. And so it, it creates a very complicated tapestry for businesses who want to comply.

[00:03:20] KRISTINA: So, just to be clear, the sky is not falling. The law doesn't go into effect until 2023, but thinking about CPA and the fact that we do have this new tapestry as you've called it, what will be happening between now and when CPA goes into effect, and what should folks be doing?

[00:03:37] MATT: Yeah, so brands and particularly larger brands have regulatory teams, and they're going to work with their legal advisors to understand the nuances of CPA. What it will take to comply. And from a consumer-facing standpoint, what sorts kind of opt in opt out tools need to be rolled out to pace the public in order to comply with the CPA regulations. So there's, there's a lot of preparation that has to happen between now and 2023. And it feels like that's a long time from now, but if you consider, software and technology changes have to be made, have to be tested. You have to be reviewed by compliance scenes with attorneys. Many, many things in that process will take some time and it isn't too early for brands who want to be compliant on day one to start those activities now.

[00:04:27] KRISTINA: So, this is a little bit of a challenge. I've been talking with a lot of the marketing folks that I work with, and some of the things that I keep getting asked over and over again. What's fascinating is, we have a single interface for our newsletter signup; for example, if a user opt-out, do I not ever get to contact them again? Who do I have to worry about? At this point, how do marketers figure out whether or not they need to comply with CPA? Do they have to comply with CCPA? Is it sort of a subgroup of what we have to do for a GDPR? Should we just treat everybody the same and adopt the most stringent of laws, which again, doesn't necessarily work because the tapestry is slightly different in different parts of the world? What's your strategy or sort of, what's your advice.

[00:05:11] MATT: It's a challenge. It's a great question. I think that, right now in the market, there's kind of a vacuum of tools or services to deal with this. And I think there will be a market created from a technology perspective to make this easier for brands to comply, but that infrastructure doesn't exist. So you're faced with the challenge of differing compliance, regulations and, you can, so the last one, a little different, I did, the size of the company matters in California. And if you have revenues less than 25 million, you don't necessarily need to comply with that reg; different states have different limits. It also depends on where you've got a nexus and whether you're operating in a particular state, but a good conservative approach is to say, look, we have to build out a framework. We have to build out a general capability to manage consumer preferences. And then on the back end how you handle those opt-outs or opt-ins, or those requests to be forgotten other elements of the privacy kind of requests from a consumer, then you've got to build out ways to manage that data appropriately and, be able to report back if you have any inquiry from the state that you're in compliance. So, I think there are some general ways that you can create tools that face the consumer to capture that desire to opt-in out or be forgotten or to not sell their data. The backend is where it's harder because you've got to handle the data differently and then produce transparency and reporting. In the case, you've received an audit request and need to demonstrate that you've complied, but that's the backend side of this is required a lot of IT work. As I said, there aren't solutions to sitting around in the market that, that you can plug in and comply.

[00:06:54] KRISTINA: For those who might have heard about the IAB tech lab but don't know much about it, can you give everybody sort of the primer 101?

[00:07:02] MATT: Yeah, absolutely. It was filed by the ICCL, which is the Irish council for civil liberties and that's an Irish nonprofit that's dedicated to supporting civil liberties, and human rights people in Ireland and their suit was filed in Germany IAB, which is it's standards organization, organizations, a standards body for the digital advertising industry. In part of the suit that the ICCL is claiming is that there's the world's largest data breach that's been occurring around something called RTB or real-time bidding, and it's a, it's a cornerstone to digital advertising and the auction process where publishers and advertisers connect to serve digital ads, and the IAB sets the standards and the data formats and the data exchange, if you will, that's part of, of RTB. And so the ICL is claiming that the data that's used for targeting in digital advertising is part of that backbone is a breach, and the core of the complaint is twofold one, there aren't any controls over the use and access of what many would think is highly sensitive PII. And the second part of it is that there's no protection against unauthorized or unlawful use or any protection against accidental loss of this data. So, ICCL filed the complaint in Germany. The IAB doesn't have a physical presence in the EU, but it was using a contractor in Germany. And that was the door opener, if you will, for ICCL to bring the suit in the EU under the GDPR, the kind of the global EU privacy regulation. So that's, that's what's happened. But it strikes the core of the backbone for how virtually all digital advertising works. And it's aimed at the standards body that governs and manages and maintains the data taxonomy that's used in real-time bidding.

[00:09:09] KRISTINA: That's a good point because advertising has gone so far beyond collecting some basic shopping information. You just mentioned sensitive information as well as some of the PII; if you're in the US, think about it in those terms, but it seems almost unavoidable that that'll probably grow increasingly with the third-party cookies going away. Is this lawsuit going to make a difference? And if so, to whom?.

[00:09:32] MATT: Well, it's a great question. So I'll, I'll start just by speaking about the kinds of data that the IAB or the taxonomy covers. They're kind of two pieces of it. From a PII standpoint, there are about 1600 different fields or bits of data that are part of this taxonomy, meaning if you wanted to target as an advertiser women under the age of 25 that had a particular political belief or had expressed interest in a particular topic there's an enormous amount of data available as part of the auction process. And on top of that, the second piece is a content taxonomy. So if you think about contextual advertising, what kinds of content do you look at? The sites you go to but also how advertisers you can think about, where their ads will be served. There's an additional taxonomy of hundreds of different topics and related information and about 11 sensitive topics, I'm looking at the taxonomy right now, adult and explicit sexual content, hate speech, et cetera, the profanity, illegal drugs, terrorism, sensitive social issues. These are part of the content mapping. And there are primarily to protect brands for brand safety. They don't want their ads showing up on sites that have this kind of content, but it's part of the taxonomy. It's part of the bidding process and the concern, and this is highlighted by the suit, is there's all this information being traded about you as a consumer, and your consent was never obtained to use that data. And so the suit seeks to protect consumers and their privacy and, and really forced the participants in, in this data exchange. To do two things, one to put in controls to obtain consent, and that's core to the GDPR and the, and around consumer data privacy. And then the second piece is to put better controls over this data and, and what I've read. And certainly, what I see as part of the taxonomy is it's fairly easy to get any individual information across these 1600 different data points. And there really aren't very good controls around how that data is shared or controlled. So I think the suit strikes the core of GDPR and it's seeking to, protect consumers' privacy. And I think the vast majority of consumers probably aren't aware of this kind of information that's being traded in real-time to serve ads or to track that individual or target them for content or advertising.

[00:12:03] KRISTINA: And you've advised some of the best and the brightest in this area. What are your tips? What should everybody be doing right now to kind of deal with the fact that we have all of these, I guess, a tapestry of different requirements, what are the best practices? Are there best practices? What are you telling or advising your clients and your colleagues to do?

[00:12:20] MATT: We have a framework. OptiMind helps brands understand the performance or contributions of their advertising. So our lens into the privacy world is all about marketing measurement, and many brands use consumer tracking to understand advertising performance. If they know that you've seen an ad on a particular device and they can trace and track that back to a particular transaction, whether it's on a phone or a computer or in a store, they can kind of reasonably deduce the power of that ad. That's being challenged on two fronts. One we've already talked about is privacy regulations. The consumer now has a right to opt-out of that scheme and opt out of that tracking that puts pressure on a brand's ability to measure advertising. The second piece that we haven't talked about as much is the fact that Apple and Google will be next in 2023; they're putting new limits on tracking and data. Primarily because they're also worried about the regulatory side of this, but that puts an additional strain on a tracking-based measurement. So what we counsel brands on is around this notion of future-proofing measurement and to one take stock in terms of their current state and all the different places they have exposure, where will they be under increasing pressure from a privacy and tracking standpoint, what systems and even third-party vendors are involved in the sharing of PII for measurement. And it's important to understand this complex web as a part of a brand because that's where you have legal and privacy exposure. But from there, then we're coaching brands on how to take steps to find different measurement approaches that don't require PII, that don't require that the brain track a consumer across all their devices and, and really start to adopt and roll out those more advanced methodologies and data science to get out ahead of where this is going to end. Brands will have increased risk in terms of regulatory exposure and also from a measurement perspective, in many cases, the picture is going to go dark as this data starts to disappear. And so it's not too early to start taking steps to future proof at least from a marketing measurement standpoint, and get out ahead of this snowball that's starting to roll downhill.

[00:14:45] KRISTINA: And there is so much data in every organization these days. I mean, it's, everybody keeps saying things like, oh, well everybody's in the business of data, but it does seem to be true. Do you think we're at a point where every organization needs someone paying attention to data, and what should that look like? You mentioned regulatory or legal departments earlier, but as nice of folks as live in those compliance, regulatory, legal departments, they often don't understand data or how the business collects data, for what purpose. They don't understand sort of the business or marketing side. Are those the right people to be stewarding data in the organization enterprise? Or should it be somebody else?

[00:15:21] MATT: Yeah, that's a great question. I think you're right. A compliance person may not have the skills to understand the data implications or the systems knowledge to understand what to do when you've got compliance requests. So, whether that's a new market niche for the legal industry, I suspect it might be where your compliance with data into kind of a new combined skillset. That DNA may not exist within an organization. They may have to outsource to find it, but I think, in general, there is a larger momentum in the US on a state-by-state basis. This is going to grow in complexity and scope, and scale. So you may not have those resources now, you may not have found partners that can help you, but over the next 12 to 18 months, you will absolutely need to have these skills either be a outsource partner or in-house. It's only going to get more complicated, and in the absence or vacuum of federal-level regulations, we could conceivably see 30, 40, or more states with their own versions of this privacy kind of, legislation, it's going to get way worse before it gets better.

[00:16:35] KRISTINA: Right now, I'm feeling a little bit pessimistic. I have to be honest with you. It feels like quite bad news for companies and their efforts to really take advantage of data and certainly find a competitive advantage within that data. And so I'm thinking about all of the other kinds of collection of data and data points, the utilization of, machine learning, AI technologies, there's a lot of activities that seem to be progressing on the technology side, but here we are on the opposite side, really with the data privacy protection acts going on. So how do you balance that out with, is there a practical side to that? Obviously, a lot of marketing and digital teams have to rely on their internal functions to help them figure that out and think about the north star, but for anybody who's sitting in the CMO role or you're heading up a digital team and trying to figure out what their strategy ought to be, how do they balance out the opportunity that comes with all of this new technology, ML, AI, et cetera. And the fact that now are becoming more and more constricted with what we can do with the data that we're collecting or even collected in the first place?

[00:17:40] MATT: Yeah, it's a big challenge. The role for CMO was always complex, and it's gotten worse. I think there's a good dividing line to think about and brands who want to establish a first-party relationship with the consumer; that's never been more important in particular because of the data side of the picture. If I can establish a one-to-one relationship in a compliant way where the consumer ops in understands in a transparent way, what they're opting into in exchange for that they're sharing data about their interests, that's more strategically important for a brand than ever. So brands are actively investing in building out their first-party relationships because they know it's fundamentally more compliant. It's a better relationship, and there's, there's real transparency is part of the consumer relations. Where there's pressure and I think rightfully so, is on third-party data collection where it's less obvious to a consumer what is being collected about their interests and where things like Google is shutting down cookies, which for 20 years been the mechanism to kind of silently collect data about consumers interests. Third-party data has become a real problem, and the use of third-party data for targeting, personalization, for profiling, will go away. And most of these regs we'll shut down kind of that trade in that third party data as well as consumers opting out of the process, I think, the 80% opt-out rate with Apple devices shows when consumers are confronted with the choice there, they don't want to be tracked. So, CMOs, I think, need to think about that dividing line and what, in terms of their marketing value chain, relies on which part of that dividing line and, and being very proactive with their teams and their external vendor partners on the third-party side to really start thinking about how do we future-proof this, how do we think about managing these different marketing activities in a fundamentally different way? As a brand, we commit more than ever to build out first started data collection and programs to manage that. So to me, that's a really clear bifurcation. It's a point that CMOs need to be aware of because there are all sorts of plumbing, operations, activity, whether it's advertising your e-commerce experience, marketing measurement, all the things that hit that CMOs desk that fall on either side of that line. And it's an easy way to kind of think about it strategically.

[00:20:13] KRISTINA: And we've been talking a lot about the digital aspects, but it gets even more complex when we start thinking about marrying up digital and traditional markets. And the fact that everybody's moving into this omnichannel concept, how do you see that changing in terms of being able to provide value to me, Kristina, from a marketing and a sales perspective, because there are certain products and services I might be interested in. Brands do you have to now kind of give that value, but they have more channels and more complexity at a time where they can collect less data about me at least, like you said, from third parties, does that change somehow the paradigm or does that sort of just put more pressure on a brand or does that actually allow a brand to be more focused and more targeted with its resources? What does that look like?

[00:20:57] MATT: Well, it's funny at what's old is new again. When digital advertising started a few decades ago, this notion of contextual advertising was really important. So if you were going to a backpacking site, you could reasonably infer as a brand that Kristina is interested in hiking or outdoor activities. And there's a lot of discussion in the industry now around the return of context within the advertising sphere. If we no longer have precise data about that consumer, can we infer something about them based on the types of sites they're going to. The types of interests that they express with their browsing. So, that I think will make a return to the mix. It's interesting, omnichannel has in light of COVID has surfaced is more important than ever as consumer preferences and kind of the modes in which they transact with lurch so dramatically last year brands are having a hard time to understanding whether those changes are permanent and whether they will they'll persist. Or whether consumers will adjust and adapt that or modes going forward. But we're in this period of uncertainty. And so brands who say, well, look, it doesn't matter. We have to be the customer wherever they are at that particular moment in time. And, adjust our business strategy based on that this notion of cross channel effectiveness is super important because of COVID. And so, that might mean because consumers are streaming more TV than ever because of COVID that there's a return to traditional advertising, like TV. It, can we do it in a contextual way based on interests that don't mind all sorts of sensitive profile data but get us close enough where the advertising still affects. But it's just; it's been fascinating to see with the pandemic how that put a punctuation, mark, an exclamation point on the need for true cross channel effectiveness.

[00:22:54] KRISTINA: And measurement becomes critical in that context; without measurement, you really can't do much.

[00:22:59] MATT: For sure. And what we deal with, we kind of battle and misperception in the market. So, OptiMine, we provide cross channel measurement to large brands, and in large part, because of the rise of digital advertising, there are many marketers who assume that the only way you can measure advertisement effectiveness is to understand exactly who saw the ad, what device, where they were when they saw the ad and then match that to the purchase. And it's just fundamentally not true. You can measure advertising effectiveness without having to know anything about the PII or the device information in that chain. And so there are techniques that have been around for 40 or 50 years. There's one called marketing mix modeling. It's been tried and true. It was built up around consumer packaged goods companies understanding the value of television advertising to correlate; when we're running big TV campaigns, can we see a corresponding lifting in our sales with the advent of ML and AI, you can now do these things at a very high scale, and you can get better precision that you might've gotten the digital tracking without consuming or using any PII. So there's a real innovation that's happening in the measurement space. And it provides a future-proof path for brands who realize that maybe that over-reliance on consumer data isn't going to serve them as well in the future.

[00:24:22] KRISTINA: There's a lot of things that are going to change, but when you're gazing into your crystal ball and advice, CMOs or the leads of digital teams, what to do right now, so that they're in good shape in the next 18 to 24 months.

What are you telling them? What are the three things they need to be focusing on right now?

[00:24:38] MATT: Well, first is don't delay. You need to start right away. Some of these things will take longer than you may anticipate, in particular, if you don't have the skills in-house. Or those skills may be prioritized or use elsewhere. So, the earlier, the better; I think the second piece of this equation is related to understanding where do you as a brand or a marketer want to be in two to three years? What's that ideal kind of future state look like and anticipating where this is going to go. What does success look like? Because then you can rewind from there and understand where you have exposure where you've got work to do two investments to make now. And I think the third piece of this, it gets to accountability. This is not a committee-based type of thing. There has to be real accountability and ownership to drive different parts of these issues. So whether it's compliance, the data side that you raised earlier or, what do some of the kind of tried and true methods that we're using as a marketing team now need to look like and evolve to overtime, those decisions and actions require accountability. And so, it's not too realistic to start assigning roles and ownership around those different kinds of parallel swim lanes for the organization. Things won't go as quickly, won't evolve fast enough for the brand when there's not someone whose sole responsibility is to drive evolution on these fronts. Otherwise, the initiatives languish because it's work that's done off the side of everyone's desk. It's not the number one priority for a brand new one. So I think those are the big three.

[00:26:21] KRISTINA: Matt, thanks so much for joining us today and helping us get up to speed on not just CPA, but everything else that's related to that and happening in the world of marketing and digital; I appreciate your time and your insights.

[00:26:33] MATT: Thanks, Kristina. I really appreciate it.

[00:26:35] OUTRO: Thank you for joining the Power of Digital Policy. To sign up for our newsletter, get access to policy checklists, detailed information on policies, and other helpful resources, head over to the power of digital policy.com. If you get a moment, please leave a review on iTunes to help your digital colleagues find out about the podcast.

‍