Developments in Data Privacy for 2018/2019 (2/2)
In my first blogpost on recent privacy developments, I discussed the looming EU regulation on the handling of the personal data, GDPR and a new browser called Brave, that aims to be a platform of online value exchange, complete with its very own cryptocurrency.
In this second post, I highlight a Dutch startup that wants to take personal data out of the hands of individual organizations and instead have people manage it themselves. For this I interviewed one of its founders, Anke Kuik, so my gratitude goes out to her!
Decentralized Identity Management: Faktor
As mentioned in the first part of this blog post series, one of the issues with the way that online behavioral and personal data is currently gathered, stored and managed, is that the bulk of it is in the hands of a small number of for-profit companies.
The problem is not so much that the data would not be safe - in fact these companies are able to hire the best engineers in the industry to keep it out of the hands of malicious organizations. The issue is that this is potentially sensitive data, that you don’t want any one (or five or ten) companies to bear responsibility for.
So what if it were possible to store this sensitive data decentralized and have a system of automated and self optimizing processes determine the validity of each identity and each transaction associated with it? This is what blockchain does and it already does it successfully for cryptocurrencies. Other applications for blockchain technology are popping up all the time and identity management seems to be particularly suitable: it would solve the issue of having the data in the hands of a limited number of companies, the data would be stored decentralized, so any one breach would reveal only scrambled snippets of data, the user decides who to share the data with, for how long and for what purpose in particular, identities are validated, so it puts a brake on anonymous misbehavior like cyberbullying or ranting and the mass creation of profiles to manipulate public opinion with fake news.
At the same time, for advertisers it includes validation of the total amount of real identities reached with their ads, where programmatic advertising so far has in many cases suffered from a total lack of transparency and accountability.
A system like this would put individuals in the driver’s seat of their data management, have them decide if they want to pay for consuming information online with their browsing data in exchange for advertising, or by paying for it through micropayments. They could even decide to exploit their data by exposing themselves to advertisers of their choice and earn money that way.
Faktor is a Dutch startup that is currently building a system like this and its co-founder and COO Anke Kuik happens to be my neighbour. What follows, is a transcript of my conversation with her.
The management team at Faktor, from left to right: Tim Geenen, Anke Kuik, Niels Baarsma, Johan de Groot.
(RN) How did you guys come up with this idea?
(AK) We all have a background in programmatic advertising and while we believe programmatic advertising brings a lot of efficiency and effectiveness in online advertising, there are also still some challenges. The market is going more and more to a duopoly where Google and Facebook receive more than the half of the digital media budget. The reason for this is that these multinationals have scale, a lot of good data and an easy accessible advertising system. Outside of Google and Facebook advertising data is poor - it is difficult to recognize people over time, across devices and across browsers at scale.
Another challenge around data and advertising is the GDPR, the new privacy law that will come into effect in May this year. Although we believe this is a great initiative as it puts people first, a lot of companies don’t really know how to deal with this, especially when it comes to advertising, which is nowadays a complex ecosystem. At Faktor we have taken these two challenges and created one vision for it: a set of tools that helps online entities to deal with the GDPR requirements. At the core we’re developing a consumer controlled identifier.
(RN) What do you mean with 'Online Entities'?
(AK) We initially focused very much on publishers, as we see that they struggle to remain profitable while Facebook and Google get more and more of the online advertising budgets. They are still our core customers but our solutions turn out to be valuable for a much broader group. Our consent manager for example, in which people can set their data sharing preferences, is actually relevant for brands and e-commerce stores that collect or process online data. Hence we are talking about online entities.
(RN What is this set of tools that Faktor offers?
(AK) Faktor is an identity management platform that gives consumers control over their personal data, publishers the tools to operate sustainable business models and brands the tools to advertise more effectively.
We start with offering online entities support to comply to the GDPR - with our privacy analytics product, that is now in beta, websites can scan, monitor and analyse cookies and generate and manage Data Processing Agreements (DPAs).
Next to this we are building a consent manager - a consistent tool across web and in-app environments, with which consumers can manage their online advertising data and set their preferences. Websites can implement this consent manager to ensure GDPR compliance for advertising.
At the back of the consent manager is our core product - the Identity Network. Through this network companies can access and contribute to a decentralised Consumer Controlled Identifier. The identifier is paired with demographic data, is persistent across devices and is validated by the contributors. This is THE solution for significantly better data when advertising outside Google and Facebook.
(RN) On your website there is even speak of a micropayments and incentives tool. What is that exactly?
(AK) We believe that people need to be incentivised for sharing their data. Nowadays, when you are surfing the web and read articles on sites, you are implicitly paying with your data. The internet is simply not for free and even though we can read articles or watch videos for ‘free’, the reality is that it is paid for by online advertising. And by extension: online advertising is fueled by data. People are just not aware of this (yet). We believe that in the near future, people should have a choice - they either pay for content with data or with money. Our future micropayments & incentives infrastructure is a technology for publishers to provide choice to people.
(RN) GDPR compliance is a strong selling point of your product. Will publishers be GDPR compliant when they implement only the Privacy Analytics product or will they need the entire suite for this?
(AK) GDPR compliance involves a lot and goes further than online advertising. Our tools support publishers and other online entities in GDPR compliance around advertising. The privacy analytics tool helps you to get an overview of the companies you need to have contracts with and helps you to create these contracts and the consent manager is an answer to the consumer rights in terms of advertising data: The rights to access, change, download and delete their online data and the right to complain about it.
(RN) How about advertisers?
(AK) They have the same legal framework to comply to, but it is much less complex than on the publisher side. Simply put; where a publisher has up to a hundred third parties on their website, an advertiser typically works with three to six third parties.
(RN) It almost seems too good to be true 'just buy our product and you will be GDPR compiant.' What about existing client data and advertising infrastructure - will this need to be ceased and the data purged?
(AK) Not all data is considered ‘personal’ and not all advertising includes ‘profiling’. The reality is that by turning the ecosystem upside down and give power to the people, we immediately solve one of the biggest challenges in advertising.
(RN) A lot of companies have invested heavily the last few years in Data Management Platforms in order to have a single view of the customer, compliance with local privacy laws and the possibility to create audiences to target advertising to. How does your product fall in this data landscape. Instead of, on top of...?
(AK) Both, the consumer controlled identifier can be used by existing ad technologies (like DMP’s) as a persistent ID for which explicit and informed consent was given.That is a very solid base to further expand the ‘single’ view. Data Management Platforms are also used very differently, from segmenting profiles for advertising to optimising website experiences in real-time. But the truth is: DMP’s are central data aggregators, where we believe in a decentralized experience where consumers are part of the value exchange.
(RN) Speaking of landscape - we all know the increasingly crowded images of the marketing technology landscape. Sorry for the need of pigeon holing, but where do we slot you in, if at all?
(AK) These maps can prove helpful, but they exist not to inform you, just to confuse you :) If I have to choose: we fall in both the iPaas and Customer Data Platforms buckets. I do think that in 2018 you will also see new categories like ‘Privacy Tech’, which we would fit into perfectly.
(RN) What is your business model?
(AK) Publishers and advertisers are our customers, the incentives for them to join our network is a future proof, open, decentralized system with validated identities and touchpoints, reliable, deterministic data, total advertising transparency and GDPR compliance. The tools will be offered to them as a SaaS or DaaS model.
(RN) About the technology: where will the data by physically stored?
(AK)The consumer data will be locally stored on their own device. Whether that be their browser of their mobile phone doesn’t matter. For a better user experience we let them link both of the environments so that they only have to set their preferences once.
(RN) What is your opinion of Brendan Eich's Brave browser, that I discussed in my previous blogpost?
(AK) I like what they are doing, but it’s completely different to us. We don’t incentivize people to engage with ads, but with content. Our philosophy is to facilitate a fair value exchange between brand, publisher and consumer. The best way to do that is decentralized and permission based.
(RN) Currently your tools are all in beta - is that an open beta? When do you expect them to be widely available?
(AK) Our first product, Privacy Analytics is now in Beta and will be open for more clients from February. We expect it to be widely available by the end of that month.
Conclusion: Power to the People
Yesterday I discussed the changing political attitude toward data privacy in Europe through the GDPR and a private American initiative that aims to redraw the map on online value exchange, called Brave. Today, we learned from Anke about the way she and her company Faktor plan to take personally identifiable data out of the hands of single online entities and bring the power over it back into the hands of the people.
Faktor and Brave share the vision that people themselves should be in charge of their data management. Both offer a solution for the boundless capture and distribution of everyone’s personal data, that lawmakers want to put to a halt.
Where they differ, is in the amount of engagement they expect from websurfers and the role they see for advertising. Brave aims to be the center of a new architecture that defines the relationship between publishers and their readership, where advertising only plays a secondary role and surfers pay for access to information. Faktor leaves most of the current advertising infrastructure intact, maintaining it as a main source of income for publishers, just making sure that the use of personal data in this process occurs more consciously, more transparently and with a more even distribution of the proceeds.