If you missed ADMA’s recent member-only webinar ‘Privacy Performance Protection in Advertising’ you are behind the curve. Fortunately for you, we’ve put together this cheat sheet of some of the biggest need-to-know developments from the likes of Meta and Google.

Privacy is undoubtedly a hot topic, with the Federal Government tabling updates to the Privacy Act and data protection in the news following some high profile data breaches from Australian companies in recent weeks. 

But while privacy may seem like an anchor for marketers in terms of how they are able to use their data, there are many well-developed tools which are privacy compliant and allow businesses to analyse their datasets securely and anonymously. 

Many of these are known as Privacy Enhancing Technologies (PETs).

What’s already happening with PETs?

Tim Scott, Director of Privacy Enhancing Technology for Deloitte, explains a few of these areas.

Trusted Execution enclaves

“Think about these as a physical way of actually achieving a level of privacy. Most core cloud providers and organisations have been developing capabilities where you do an isolation enclave from a hardware perspective. Then, the data and algorithm are both ingested, the query runs in an encrypted environment, and the results are sent back to the party that wanted the queries.” 

Synthetic data

“This has been around for quite some time. What’s really interesting is that it gives you the ability to take a dataset, run a particular algorithm over the top and create an entirely new dataset. This dataset would be statistically relevant to the first one, but has no resemblance from a privacy perspective to that original data. We see this being used a lot in machine learning.”

Encryption in use

“We’ve always had data encrypted at rest and in transit, but to do anything with it we've had to rely on decryption and then do the analysis. Encryption in use completely changes that paradigm. We can keep data encrypted at rest, in transit and in use, and we can actually start to do complex computations on top of that encrypted data. This is already being used in Microsoft Edge or Google Chrome when they ask you to store your password - that’s what’s called homomorphic encryption.”

Scott says when considering what systems are best for you, there are three key questions to think about: 

• What issue are you really trying to address? 

• How do you take your legal and privacy teams along for the journey?

• What are the technical implications for your business, and any business you need to partner with?

What solutions are being worked on for the future?

Meta software developer Ben Savage is leading the company’s charge into new PET-enabled areas. He is partnering with different industry groups to help develop privacy-centric solutions which work for users and advertisers alike.

Measurement is the first area of interest, and creating a solution which runs through a ‘minimally trusted’ third party. But what does minimally trusted mean? 

“These are partners who I work with as a business, but I don't want to expose them to my confidential business data if I can help it. Why is this important? It’s what Apple calls the ‘Three Cs’: curious, compromised or compelled,” explains Savage.

“For example, this could be if the operator of the system was curious and decided to spy on somebody, or compromised by an attacker, or compelled by a government to hand over data. In any of those situations, we want user privacy to be preserved. That's a really high bar.”

To this end, Savage is working Mozilla and the World Wide Web Consortium (W3C) to create a new Private Attribution API which will work natively across the internet. Theirs is called IPA (Interoperable Private Attribution), while Google and Apple have also created their own proposals. Savage believes the final output will be an amalgam of the three. 

He points to the main differences in the proposals as being where the computation happens. For Apple and Google it will be on the device, which gives businesses controlling the operating systems control on what can be looked at and measured. The API system uses the Cloud, which will take that control away and potentially allow for better cross device attribution. This puts more power in the hands of advertisers to decide how attribution works.

The aim is to have the final API “on by default”, getting rid of the need for users to opt in across different apps and websites. Savage says: “Our goal is to provide strong technical privacy guarantees, even in the face of extremely motivated attackers, and we think such an API offers a really good balance of minimal risks and high utility.”

How is the cookie being replaced safely?

Google’s decision to deprecate third party cookies in 2024 (two years later than first mooted) has been a driver for many industry discussions. So it is interesting to get the view from the company on what it is doing to develop the next generation of more PET compliant solutions.

Madeleine Oldfield, Head of Privacy, Chrome and Web Partnerships for Google, explained the Privacy Sandbox: “It’s a virtual space that's been created for the industry and the ecosystem to collaborate and build replacement solutions for third party cookie functionality, preparing us for the cookieless world. The technologies that are in development actually cover a range of use cases.”

For advertisers, Oldfield outlined three main APIs which are set to have an impact.

Topics

“At a very high level, it enables interest based advertising. The browser converts a user's site history into high level topics of interest like fitness or travel, which can be shared with advertisers and marketers and replace the cookie-based web tracking that happens today.”

Fledged

“This is a privacy sandbox proposal to solve for the remarketing and custom audience use cases. It's designed in such a way that it can't be used by third parties to track user browsing behaviour across sites. Instead, the API enables the on-device options by the browser to choose relevant ads from websites the user has previously visited.”

Attribution reporting

“This is Chrome's proposal for privacy, preserving campaign management and measurement, which is around providing anonymised performance reports on view through and clicks and conversions.”

To keep abreast of what is happening in this rapidly developing space make sure you attend the next ADMA IQ Privacy & Marketing Compliance Course (instructor-led or self-paced) and stay subscribed to ADMA news to stay up to date!