24th January 2024 Update:
The IAB Europe DSA Taskforce that was established to evaluate industry needs for standardisation in support of compliance with ads transparency requirements outlined in the DSA, with an initial focus on Art. 26. has produced new Implementation Guidelines to support implementation of a standardised approach to collect, compile, and transport the required data, ensuring compliance with the DSA transparency requirements. Read more information on the IAB Europe website.
14th December 2023 Original Post: Whilst the DSA (Digital Services Act) is an EU regulation, we expect Australian regulators will keep a close eye on how the related obligations are adopted, managed and enforced. As many of the businesses impacted are large omnipresent entities with globally consistent approaches, one would also expect that the knock-on effect of these stricter privacy and transparency regulations to ultimately have an impact on how all buyers, publishers and ad tech intermediaries conduct business moving forwards.
Hence we felt it useful to our members to explain what the DSA is, why it’s potentially so significant for digital advertising businesses throughout the ecosystem and what both the IAB Tech Lab and IAB Europe are proposing as guidance to support industry to meet the requirements.
The three reasons we think this regulation and the proposed solutions are potentially significant for the Australian digital advertising industry are:
Unprecedented Transparency Obligations – for some time now we’ve been working hard as an industry to enable better transparency with ads across the open web, particularly programmatic. A set of voluntary IAB Tech Lab standards exist that can enable this across both the sell-side and buy-side. However, the DSA will now enforce this at an unprecedented level by obligating full transparency into the identity of the advertiser, the transactional buyer of that ad (if different) and exactly what data has contributed to creating the targeting attributes utilised to target the ad to a user. This is a really significant step up.
Consumer Controls & Experiences – as an industry we are awaiting local legislation here on what the requirements will be following the privacy review, and are also planning ahead for third party cookie deprecation and any resulting signal loss. There is an obligation for industry to competently manage and dramatically improve the consumer experience as a key part of this. Providing consumers with better awareness and greater autonomy over their personal information and how it is used for advertising, should both build trust and enable a genuine value exchange whilst also meeting the needs of any future legislation once it comes into force. Being able to review the progress and success of the consumer facing requirements of the DSA should give us meaningful insights and also a draft framework of how to potentially approach this here that can meet our local needs whilst remaining consistent globally from a technical perspective.
Collaborative Pan-Industry Solutions – due to the nature of the DSA obligations (particularly Article 26) the most effective resolution for the online platforms is to be more fully collaborative with the buy-side but also ad tech vendors (defined by the DSA as ‘intermediaries’). This fully aligns with the conventions and approach of the open web, where publishers rely upon a range of ad tech vendors for different solutions and through voluntary industry standards and guidelines can provide full transparency to buyers. Now the walled gardens may have to build towards a very similar approach with even greater demands on transparency through the buy-side demand chain. This could resolve two critical challenges for pan-industry collaboration on transparency. Firstly, the lack of alignment between the open web and walled gardens in terms of both transparency obligations but also conventions. Secondly, the unwillingness from the buy-side to adopt the buy-side IAB Tech Lab transparency standards and provide the same level of transparency that has been demanded for so long from the sell-side supply chain.
image source: IAB Europe
What is the DSA (Digital Services Act)?
The Digital Services Act (DSA) is a regulation in EU law that aims to update the Electronic Commerce Directive 2000 in relation to improving consumer experiences in relation to illegal content, transparent advertising, and disinformation.
The DSA will apply from 17th February 2024 to all Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSE) across all of the EU Member States.
image source: European Commission
The DSA aims to create a safer and more transparent online environment for users – and is the world’s first comprehensive law to hold online platforms and services accountable for the content posted on their platforms, and introduces a range of new obligations for online intermediaries, including:
- Prohibiting the targeting of any online ads to minors.
- Prohibiting the targeting of any online ads based on sensitive personal data (as defined by GDPR) such as racial or ethnic group origins, political opinions, sexual preferences, or religious and philosophical beliefs.
- Enabling full transparency on ads by providing users with insights into the ads they are seeing on online platforms, as well as if and why any ad is targeting them specifically.
- Prohibiting the use of so-called ‘dark patterns’ on the interface of online platforms, referring to misleading tricks that manipulate users into choices they do not intend to make.
- Obligating online platforms to remove illegal content and take reasonable steps to prevent its dissemination.
- Providing users with clear and accessible information about how content moderation decisions are made.
- Giving users the ability to appeal content removal decisions.
- Conducting annual risk assessments and implementing risk mitigation measures.
From a digital advertising perspective, here are some of the key features of the DSA:
Scope: The DSA applies to a wide range of online intermediaries, including social media platforms, marketplaces, content-sharing platforms, app stores, and online travel and accommodation platforms. The act takes a risk-based approach, with different obligations applying to different types of platforms. However it is the VLOPs (Very Large Online Platforms, such as Facebook, Twitter, and Instagram) which will be subject to the most stringent obligations. The current full list of VLOPs, as designated by the EU, is below:
AliExpress; Amazon Store; Apple AppStore; Booking.com; Facebook; Google Play; Google Maps; Google Shopping; Instagram; LinkedIn; Pinterest; Pornhub; Snapchat; Stripchat; TikTok; Twitter; Wikipedia; XVideos; YouTube; Zalando.
Ad Transparency: There is an obligation to provide greater visibility as to exactly who is placing ads, who is paying for the ads and which targeting criteria were used to target users. Providers of all online platforms will be required to prove where the information has came from and must showcase their targeting methods used for delivering any ads to users. VLOPs also have additional transparency requirements, including a mandate to maintain a public library of ads historically delivered.
Content Moderation: The DSA requires online platforms to be more transparent about their content moderation practices, with clear and accessible information to be made available about how content moderation decisions are made.
Accountability: The DSA introduces a number of new accountability mechanisms, including the power for national authorities to impose and enforce fines on any platforms that fail to comply with the rules.
From an advertising perspective this surfaces greater transparency obligations on the walled gardens which we have come to expect from participants across the open internet.
Additionally, publishers and ad tech intermediaries will have to update their business models and technical processes in order to enable the greater transparency obligations throughout the advertising process.
Meanwhile, the buy-side will now have to be more operationally transparent and openly disclose how they collect user data and any algorithms used, which could be considered commercially sensitive.
What is the Digital Markets Act?
Another recent EU regulation not to be confused with the DSA is the DMA, which aims to make the digital economy fairer and more competitive. The DMA prohibits the largest global platforms that provide online services across the EU from combining data sources without explicit opt-ins, and also restricts them from preferencing their own products and services.
Under the DMA, so called ‘gatekeeper’ services will have to gain explicit consent before tracking a user for advertising purposes and any consumers using these services are also empowered to request any data collected in relation to ad campaigns. Hence, they can no longer combine data from across different services to show targeted ads without consent, or use any data from third-party sellers to inform their own retail offerings.
A total 22 services across 6 global companies (Alphabet, Amazon, Apple, ByteDance, Meta & Microsoft) were named as gatekeepers by the EU in September 2023 – and they have until 6th March 2024 to comply with all of the DMA provisions. The ‘gatekeepers’ were defined as those companies with both a market capitalisation of over €75bn and more than 45m monthly active EU users.
IAB Europe & IAB Tech Lab
Just a quick reminder about both IAB Tech Lab and IAB Europe, as they have both have now provided industry guidance on navigating the DSA and are working closely together to provide viable pan-industry solutions and ongoing support.
IAB Tech Lab develops, oversees and updates critical global technical standards and solutions – designed to enable and support a healthy and sustainable digital media and advertising industry. Key areas of focus are transparency, fraud, identity, data, consumer privacy, ad experiences & measurement, and programmatic effectiveness.
Meanwhile, IAB Europe is the European-level association for the digital marketing and advertising ecosystem. Through its membership of national IABs and media, technology and marketing companies, its mission is to lead political representation and promote industry collaboration to deliver frameworks, standards and industry programmes that enable business to thrive in the European market.
What is the IAB Europe Guidance?
The IAB Europe DSA Transparency Taskforce was launched in July 2022 and has taken the approach of seeking interoperability and communication between partners by defining a supplement to existing industry information exchange mechanisms (such as OpenRTB) in order to support the ad related obligations.
These ad-related requirements can specifically be found within Article 26 of the DSA legislation, and the core demands on platforms are designed to enable consumer transparency in terms of:
● Verifying that the ad is indeed an ad.
● The identity of the advertiser.
● The identity of the party that financed the ad (if different from the advertiser, e.g. a media agency).
● Information about the main parameters used to determine the recipient of the ad.
● Where applicable, information about how a user might change those main parameters.
Although the legal obligation to provide the user-facing information disclosures applies to VLOPs, it is clear that in many advertising scenarios those platforms will need to rely on ad tech vendors for the data that will be required to populate the disclosures. As a result, ad tech intermediaries could come to play crucial roles in aiding online platforms in meeting their compliance obligations in relation to advertising.
To ensure that these third parties are equipped to provide this support, IAB Europe has set out to standardise a protocol for compiling and delivering the required information through the ad supply chain such that it could be received by the online platform, or another party acting on its behalf, to make the disclosures to users. For instance, for the Advertiser Transparency requirements – see below as the proposed solution for the transfer of the necessary transparency information:
image source: IAB Europe
For the user related transparency requirements a list and definitions of user parameters’ are provided with three core values:
- Profiling – Information about the user, collected and used across contexts, that is about the user’s activity, interests, demographic information, or other characteristics.
- Basic advertising – Use of real-time information about the context in which the ad will be shown, to show the ad, including information about the content and the device, such as: device type and capabilities, user agent, URL, IP address, non-precise geolocation data. Additionally, use of basic cross-context information not based on user behavior or user characteristics, for uses such as frequency capping, sequencing, brand safety, anti-fraud.
- Precise geolocation – The precise real-time geolocation of the user (i.e. GPS coordinates within a 500 meter radius).
There is also individual guidance for DSPs, Platforms and other intermediaries in terms of implementation, with an example of a potential scenario as per the below:
image source: IAB Europe
From a consumer perspective, it’s worth noting that the current European industry proposal is to use the consumer-facing AdChoices Icon, as the persistent symbol to be found on all online ads across the EU. This is part of the obligation of the European Interactive Digital Advertising Alliance (EDAA) who are working to provide the consumer choice portal and adhere with the proposed technical standards from both the IAB Europe and IAB Tech Lab.
The required information including the identity of the advertiser and the main parameters behind the ad delivery (and, where applicable, how to change them), will be disclosed to all EU consumers from this icon.
image source: EDAA
Additionally any proposed solution from both IAB Europe and IAB Tech Lab has to be adaptable across all of the most relevant use cases including programmatic and non-programmatic media buys, desktop web, mobile (both web & in-app), video, audio and CTV.
What about the more recent IAB Tech Lab Proposals?
In December 2023 IAB Tech Lab released draft specifications to further enable IAB Europe’s proposals with some OpenRTB protocol extensions that can provide additional and meaningful attributes for both the bid request and the bid response. As per the IAB Europe approach, the intention is to continue leveraging established IAB standards (such as OpenRTB and VAST), for the transfer of any necessary transparency information.
Extension in Object:Regs – allows publishers to indicate that a transaction is subject to DSA and whether they will render the required transparency information themselves. Key attributes include:
- dsainfo – Integer flag, with various options, to indicate if DSA information should be made available. This will signal if the bid request belongs to an Online Platform/VLOP, such that a buyer should respond with DSA Transparency information based on the pubrender value.
- pubrender – Integer flag, with various options, to indicate if the publisher will render the DSA Transparency info. This will signal if the publisher is able to and intends to render the icon and display the DSA transparency info to the end user.
- datatopub – Independent of pubrender, the publisher may need the transparency data for audit purposes. Also an integer flag with various options.
Extension in Object:Bid – allows DSPs to provide publishers with the requested transparency information and indicate whether they will render the required transparency information. Key attributes include:
- behalf – Advertiser Transparency: Free UNICODE text string with a name of whose behalf the ad is displayed.
- paid – Advertiser Transparency: Free UNICODE text string of who paid for the ad. Must always be included even if it’s the same as what is listed in the behalf attribute.
- transparency – Array of objects of the entities that applied user parameters and the parameters they applied.
- adrender – Integer flag, with various options, to indicate that buyer/advertiser will render their own DSA transparency information inside the creative.
Sample OpenRTB 2.6 Bid Request with DSA transparency:
Sample OpenRTB 2.6 Bid Response with DSA transparency:
URL Parameters & Macros
There is also URL based guidance for any ad systems that depend upon URLs to communicate information – with dedicated parameters and macros that can carry relevant DSA information in this manner if required.
To view a very informative webinar with speakers from IAB Tech Lab, IAB Europe and the EDAA simply click here
