Thread · 12 tweets · 22 Nov 2018

The @IABEurope has written up an article to try to distance their consent framework from the recent @CNIL decision finding issues with Vectaury's application of consent. I didn't expect much, but I was disappointed anyway. Read it at iabeurope.eu/policy/the-cni…, some notes follow. 👇

But first: you MUST consent.

Much of the IAB's argument is that Vectaury did not follow the framework's policies. This is disputable, but even if true it's an issue in itself: their framework has no real verification and no enforcement. It's yet another trust-everyone festival.

That is the heart of the problem: for the past two or three decades whenever a problem has appeared the ad industry has promised to self-regulate. They then made a set of wishy-washy rules with no validation and no enforcement, called it a standard, and the problem went away.

In fact, they probably sincerely believe that they're doing it right. They don't realise that no one is left to trust them. If you're outside adtech you know for a fact that the opioid cartels have better governance than the ad industry. If they stay in denial, it won't work.

According to @IABEurope "VECTAURY’s CMP also failed to meet its obligations under the TCF’s policies." Did the IAB shut them down for that? No. This *demonstrates* that the framework is a toothless cover-your-ass. Which entails it cannot be relied upon as a legal consent signal.

I won't go through every factual problem with the IAB's statement, it would take too long for a thread. I would, however, like to point to a true statement they make:

"As it is entirely unfeasible for millions of websites and apps to be individually vetted by 1000s of technology partners, we need a trusted Framework the proper implementation of which can ensure and signal that transparency & consent have been established in line w/ the GDPR."

This accurately captures just how high a bar they will need to meet for a distributed consent solution to be credibly compliant. It will be expensive to build and more expensive to maintain; and — if done correctly — very few will consent. It's a dead end.

Adtech's focus on maintaining the status quo is suicidal. If it does not get regulated out of existence it will keep pushing more people towards ad blocking. Stop patting yourselves on the back that "people actually want more relevant advertising." They do, but not at this cost.

Google and Facebook are sucking out all the profit in the data-industrial complex anyway. If you're a smaller adtech actor, you need to move out of the personal data world and do something innovative instead.

I actually believe that healthy, wholesome, organic, locally-sourced advertising is possible — and sustainably profitable. But it's going to take a hell of a lot more commitment to doing the right thing than the IAB's current reality-denial tactics. Happy Thanksgiving all!