Where do the ads we see on the Internet come from? Where do they go to? Do they actually convert into increased sales of the advertised products? Do they reach whom they are meant to reach?

Although these questions do not come up very often among normal web surfers, they do keep thousands of people worldwide who work in the digital advertising industry awake at night. Programmatic advertising is a complex ecosystem that provides the Internet with advertising through an automated bidding system with multiple intermediaries. When you read a newspaper article, complicated real-time bidding mechanisms and algorithms that decide within seconds what advertising will capture your attention lie behind each sidebar ad, all while third-party intermediaries connect advertisers with ad spaces. With a turnover of up to 260 billion euros in 2020, this industry is de facto the financial driving force of the Internet. However, it seems that Google will be one of the most important players in this ecosystem, putting an end to its rise.

Google has been making efforts to proactively demonstrate that it is taking the reins on privacy issues on the Internet since 2019, after the publication of the General Data Protection Regulation (GDPR) in 2016 and the constant debates generated by the future Regulation on privacy and personal data protection in the electronic communications’ industry (the e-Privacy Regulation). So, it has decided to make further changes in this area to demonstrate it.

So much so that it introduced the ‘PRIVACY SANDBOX‘ tool in August 2019, which is used to control and minimize the amount of information that advertisers can know about the users of a particular website, only revealing enough to decide whether or not they are interested in paying to advertise in that space.

The introduction and launch of this tool marked the first step in Google’s public efforts to portray itself as a friendly company both to advertisers and web surfers. The second major milestone was the following year, when it announced that it would stop supporting third-party cookies in its browser, Google Chrome as of 2022. When this measure becomes effective, it will place Chrome together with other direct competitor browsers (such as Firefox by Mozilla or Safari by Apple), which do not allow the most intrusive versions of these technologies in their cookie installation policies for some time now.

Google proposes that web surfers are divided into different groups, taking into account their interests or common characteristics based on its own measurement strategies and the information that each browser collects about the user (sites visited, products purchased, searches performed, movies watched, books read, etc.), instead of using third-party cookies to analyze user browsing and behavior on the websites. These groups would be integrated into the aforementioned ‘Privacy Sandbox‘, within a new functionality called the Federated Learning of Cohorts, yet to be implemented. Web surfers would be grouped from this application through Artificial Intelligence technologies, according to the characteristics that the Artificial Intelligence techniques themselves consider most relevant for advertisers. However, advertising would be targeted and programmed from the browser itself once these groups are created, since user interests would not be associated with individuals, but with an identifier of the Google Chrome browser itself without linking it to their identity, at least in principle.

Although these new techniques that do not involve third-party cookies have not yet been implemented, they undoubtedly arouse a lot of skepticism among Internet privacy specialists, which is inevitable in an industry as unclear as programmatic and digital advertising. However, good understanding and advice from technology law professionals provides us with confidence that online advertising will adapt to these new paradigm changes. Privacy, the adequate protection of Internet users’ personal data and the need of companies to develop their business online can coexist when their due importance is understood and adequate advice is provided.

• Estrella Arana. Data Protection Lawyer | Legal Department
• Sofía Ruiz de la Viuda. Lawyer | Legal Advice