GDPR comes into force in about 4 weeks and, in theory, by this point, businesses large and small should all be ready for it, or at least very close to ready. In practice, there are probably quite a few businesses, particularly small ones, that are really nowhere near ready and that are racing to become compliant before the deadline. Frustratingly for these companies, their sprint to the finish may involve negotiating some unexpected hurdles thrown up by Google and its approach to implementing GDPR.
Google – a case of them and us
Although Google has published a statement about GDPR on its AdWords blog, this statement is lacking in detailed information about the path forward. Most of what has been revealed has come from media reports, which suggest that Google will take ownership of managing GDPR on its own platforms (including YouTube) but will require its publishers and advertisers to manage the issue of consent themselves.
Theory, practice and timeliness
In theory, Google’s position on this is not that far removed from the current situation in that Google does already require their publishers and advertisers to obtain the necessary consent from end users.
In practice, however, there will presumably be some difference between the current situation and the post-GDPR one since Google says that “the revised policy will require that publishers take extra steps in obtaining consent from their users” while, disappointingly, not revealing what those steps might be.
This is particularly frustrating given that the clock is now ticking down very loudly on the GDPR implementation date and the longer Google takes to reveal its plans, the fewer time companies will have to see what they have to do to continue to make legal use of Google’s services.
There will also be less time for companies to raise concerns about any issues they perceive and less time for Google to respond to any concerns raised. Although Google states on its AdWords blog that it will have a solution for non-personalised adverts in place by May, this may not be of great comfort or reassurance for companies which have come to depend on using profile- or behaviour-based adverts and wish to continue to do so without breaking the law (or their budgets).
The control of consent
There are already rumblings of discontent at the prospect of publishers and advertisers having to manage consent for adverts alongside consent for other purposes such as email newsletters, but there could also be a case for arguing that it is only right that the third-party publisher or advertiser is the one who, ultimately, has the relationship with the end user and hence that it is reasonable for them to manage the consent.
The problem with this argument is that Google has indicated that it wants to be a co-controller of the consent and may also wish to be co-controller of other data gathered by its publishers and advertisers. At this point in time, it is not at all clear what Google means by this in practice, however, it is probably fair to say that unless Google plays its hand very carefully here, it could well find itself on a collision course with the EU (again).