3 ms·

> how programmatic ads could be compliant with GDPR? One way would be to: - store all user data client-side, stuff it in a cookie. - Guess this user data, as

> how programmatic ads could be compliant with GDPR? One way would be to: - store all user data client-side, stuff it in a cookie. - Guess this user data, associate particular articles with particular data, e.g. X % chance of being male/female, probably likes cars, probably likes the colour "yellow", even if some of this data has been given to you directly by the user. -"Clean room" ad selection. Have the ad selection algorithm run on the same server/network that serves the content and retrieve desired ads directly without exchanging any user data. Advertisers provide matrices of desirable matches of available ads to match against. Matches won't be as precise, available data will be very limited, and if a user clears the cookie, you'll have to start from scratch again. This way: - you know nothing about the user, except for what could be inferred from their reading behaviour on a single site. - even that limited data never reaches advertisers, so it can't be collated and aggregated in a pernicious way - users are in complete control of their own data. If they clear their cookie, there's nothing left on the publisher's side. -if you shield and rotate your ip logs, they're nothing more than addresses that requested some page at some time. None of the data is combined in an attempt to identify a user, other than possibly in a security context. So yes, it should be possible even if it needs a more careful approach and more deliberation with regards to user privacy, but that's a main point of the legislation.

skrause 8y ago
> - store all user data client-side, stuff it in a cookie. That's still a tracking cookie, not allowed under the GDPR without explicit consent.
- craigsmansion 8y ago
  "Tracking Cookies are a specific type of cookie that is distributed, shared, and read across two or more unrelated Web sites for the purpose of gathering information or potentially to present customized data to you." You still make a valid point though, but my guess is it's not going to be considered pervasive tracking, where a data subject loses hold of their information, and will be considered in-line with the spirit of the GDPR, since it addresses the excesses the law set out to regulate: the wide-spread leaking and sales of profiling data.

skrause 8y ago

> - store all user data client-side, stuff it in a cookie. That's still a tracking cookie, not allowed under the GDPR without explicit consent.

craigsmansion 8y ago
"Tracking Cookies are a specific type of cookie that is distributed, shared, and read across two or more unrelated Web sites for the purpose of gathering information or potentially to present customized data to you." You still make a valid point though, but my guess is it's not going to be considered pervasive tracking, where a data subject loses hold of their information, and will be considered in-line with the spirit of the GDPR, since it addresses the excesses the law set out to regulate: the wide-spread leaking and sales of profiling data.