The outcry over the revelation that Cambridge Analytica had used data collected from millions of Facebook users (most without their knowledge) shows that applications, more than tracking and collection, are driving consumer privacy concerns. Hundreds of millions of consumers have willingly shared personal details with Facebook and its peers – Amazon, Google and other internet powerhouses – for many years with little concern. Some of that may have been ignorance about just how much data these companies have on almost anyone spending time online. But more likely, since the use of that data was viewed as relatively harmless or merely annoying (i.e., targeted advertising), and integral to the workings of the product itself – improved search results, product recommendations and tighter news feeds – it was a ho-hum issue for most.
Now, however, an increasing awareness of the power of consumer data and the nefarious or even destructive uses to which it can be applied takes consumer privacy from a regulatory hurdle to an integral concern from marketers, affecting everything from selecting and implementing technology vendors, customer engagement strategies, data partnerships, and advertising campaigns. At the same time, there are cumbersome burdens being imposed on marketers and tech vendors with the imminent European General Data Privacy Regulations (GDPR). Those new regulations, particularly the requirement for companies to disclose every potential use to which they will put consumer data, will turn Europe into a test lab for what limitations consumers are comfortable with.
Now, however, an increasing awareness of the power of consumer data and the nefarious or even destructive uses to which it can be applied takes consumer privacy from a regulatory hurdle to an integral concern from marketers, affecting everything from selecting and implementing technology vendors, customer engagement strategies, data partnerships, and advertising campaigns. At the same time, there are cumbersome burdens being imposed on marketers and tech vendors with the imminent European General Data Privacy Regulations (GDPR). Those new regulations, particularly the requirement for companies to disclose every potential use to which they will put consumer data, will turn Europe into a test lab for what limitations consumers are comfortable with.
The 451 Take
The lesson from the Cambridge Analytica debacle is that consumer angst about privacy comes as much from the uses for which their data is applied as from the collection of the data itself. What does this mean for enterprises as personalized customer engagement – fueled by personal data, of course – becomes the ideal? It means that enterprises will need to gather the appropriate permissions in a truly transparent way. Cumbersome 'terms of service' and similar agreements don't meet this standard. Instead, companies should integrate gathering of permissions actively, as part of the user experience.
Impact on consumer attitude
We are witnessing a shift in the balance of power between many organizations and their customers. Price and products are no longer enough; customers value experiences. With the growing amount of digital data that can be harvested from websites, smartphones, connected TVs, game consoles, websites, point-of-sale systems and basically every digital touchpoint, it creates an abundance of opportunity to personalize the customer journey. Especially as technology becomes central to how individuals experience the world around them, businesses have focused on initiatives that cater to consumers' preferences, to provide unique engagement strategies as a critical part of a strategic value proposition and competitive differentiation.
Facebook serves as a cautionary tale of the importance of transparency, particularly in light of looming GDPR restrictions. Over the past few years, our Voice of the Connected User Landscape Data has shown a steady growth in customer willingness to share personal data for something of value. The figure below shows that age matters with our latest results from Q4 2017. It states that 36% of our respondents 18-34 are willing to share personal information for better rewards. However, that lowers to 19% for 55 and above. Additionally, 38% of respondents 18-34 want to receive personalized information (local offers, mall promotions, etc.) based on their immediate location, compared with 22% of those over 55.
Willingness to share personal data
Source: 451 Research, Voice of the Connected User Landscape, 2H 2017
The reality of delivering more personalized experiences demands that businesses use real-time intent data to create personalization strategies. Data-driven individual experiences require information that is updated constantly (e.g., transactions, events, contexts, interactions and behaviors) and tied to a unique identity for each customer in order to build a complete customer profile. Then that information and identity must be turned into prescriptive insight using machine-learning-based algorithms to identify customer opportunities and determine how to best engage with customers across multiple channels and devices.
Consumer backlash over the data that was used, even sometimes with permission, has shed light on the fact that the average consumer was blissfully unaware of the share breadth and depth of their online data profile. We fully expect that the industry will take two steps back as consumers begin to demand full transparency of exactly how, when and why businesses use personal data.
Adtech step back
Adtech vendors are among the companies that will be most vulnerable to the new regulations, as well as potential backlash from users about any perceived misuse of their data. GDPR requires collectors of data to gain explicit permission from European consumers for each and every use to which the data will be applied. This presents multiple challenges for adtech companies. First and foremost, adtech companies don't have a direct relationship with consumers that they can use to gain the necessary permissions. The challenge is less severe for those that have made inroads selling software directly to marketers. In those cases, marketers will gather the permissions. Audience data management platforms and certain media buying platforms may be able to gain some data collection rights through marketing relationships.
However, most adtech vendors work indirectly with marketers through ad agencies and have a media sales model, or have made it their business to collect and resell consumer data. Those companies are effectively playing the role of publisher – in the sense that they sell advertising – although they own no website or app in which to collect the permission they need. Adtech vendors will need to rely on publisher partners to gather these permissions, and it's not yet clear how willing publishers will be to assist in this and what incentives they may require.
Moreover, adtech is a complex ecosystem where data flows through publishers, data providers, ad exchanges, media-buying platforms, ad networks, measurement vendors and attribution providers. Since permission is required for each application of the data-collect, it is possible (although this isn't quite clear yet) that adtech companies will need to collect an enormous number of permissions in order for this chain to function properly.
Businesses must build trust through transparency
However, most adtech vendors work indirectly with marketers through ad agencies and have a media sales model, or have made it their business to collect and resell consumer data. Those companies are effectively playing the role of publisher – in the sense that they sell advertising – although they own no website or app in which to collect the permission they need. Adtech vendors will need to rely on publisher partners to gather these permissions, and it's not yet clear how willing publishers will be to assist in this and what incentives they may require.
Moreover, adtech is a complex ecosystem where data flows through publishers, data providers, ad exchanges, media-buying platforms, ad networks, measurement vendors and attribution providers. Since permission is required for each application of the data-collect, it is possible (although this isn't quite clear yet) that adtech companies will need to collect an enormous number of permissions in order for this chain to function properly.
Businesses must build trust through transparency
Businesses already embrace policies regarding opt-in consent, but many times it's littered with technical and legal jargon that the consumer doesn't understand. Many times, it is also an overarching statement that covers multiple different use cases stated by the business. For example, a common phrase that businesses state is that the use of the data is to improve customer experience.
Businesses must adopt new policies and technologies that enable them to regain customer trust through embracing more robust consent and profile management, security, and portability of personal data. Consent must be explicit and provide customers with the ability to manage specific details of data collected.
Businesses will be called upon to not only allow customers to demand the right to be forgotten, but also to modify and delete specific data. The ability to deliver on these new requirements will require businesses to invest in a single source of the truth, with a unified view of a customer profile across the entire enterprise that is designed with a privacy-first approach.
Technology vendors have already begun their path to ensure their customers are GDPR-compliant with not only readiness programs, but also adjustments to their application platforms. Examples include improved process automation to ease the ability to comply with customer requests for data, granular capabilities to manage multi-level consent, and intelligent data platforms that provide secure identity management and robust capabilities to handle vast amount of raw un-aggregated data.
Outlook
It will take time for consumers to understand the role they play in taking back control of their data. Central to their willingness will be the value the consumer receives in return. If an organization is using the data to manipulate end-user behavior, such as shifting the result of political campaigns, it will be a long and drawn-out battle to regain trust. However, if the data is used truly to deliver relevant information or measurable value exchange, the consumer willingness will eventually return.
The empowered customer is, in effect, forcing evolution of the entire technology stack to enable real-time, contextually relevant experiences. Yet many customers don't realize the data required to create it. The result elevates the need for businesses to have proper information-governance controls in place by expanding the realm of data governance to account for the explosion of unstructured data. That includes identifying and mapping personally identifiable information in structured and unstructured data, de-identifying and anonymizing customer information where necessary, and applying encryption and pseudonymization techniques to comply with data privacy requirements. The future will certainly be interesting as empowered customers take back control.
The empowered customer is, in effect, forcing evolution of the entire technology stack to enable real-time, contextually relevant experiences. Yet many customers don't realize the data required to create it. The result elevates the need for businesses to have proper information-governance controls in place by expanding the realm of data governance to account for the explosion of unstructured data. That includes identifying and mapping personally identifiable information in structured and unstructured data, de-identifying and anonymizing customer information where necessary, and applying encryption and pseudonymization techniques to comply with data privacy requirements. The future will certainly be interesting as empowered customers take back control.
Sheryl Kingstone
Research Director, Customer Experience & Commerce
Sheryl Kingstone leads 451 Research’s coverage for Customer Experience & Commerce, which covers the many aspects of how customer experience is a catalyst for digital transformation. She oversees the company’s coverage of a variety of customer experience software markets spanning ad tech, marketing, sales, commerce and service.
Scott Denne
Senior Analyst
Scott Denne is a Senior Analyst with 451 Research, where he helps direct the firm's coverage of technology mergers and acquisitions. He also contributes to 451 Research's Customer Experience & Commerce Channel with coverage of the advertising technology industry.
Matt Aslett
Research Director, Data Platforms & Analytics
Matt Aslett is Research Director for the Data Platforms & Analytics Channel at 451 Research. Matt has overall responsibility for the data platforms and analytics research coverage, which includes operational and analytic databases, Hadoop, grid/cache, stream processing, search-based data platforms, data integration, data quality, data management, analytics, machine learning and advanced analytics.