What you need to know:

• Brands, publishers and media supply chain must disclose the data they collect and how they will use it in language simple enough for people with below average literacy to understand at a glance.
• Or they increasingly risk being taken to court by regulators, with Google and Trivago early test cases, and each facing tens of millions, potentially hundreds of millions, in fines.
• Regulators are staffing up and being given increased funding to prosecute firms that fail transparency test on data collection and use. And they are "marching in lockstep", warns data business expert Peter Leonard.
• Leonard told Sydney Programmatic Summit overhaul of Australia's privacy laws could also pose existential challenges for segmentation and targeting.

Brands, publishers and the media supply chain could soon follow Google and Trivago into the Federal Court for breaches of consent to use consumer data, Australia’s programmatic industry has been warned.

They face a pincer movement from both the ACCC and the Privacy Commissioner as well as incoming changes to how consent to use consumer data for the basic tenants of digital advertising is lawfully gained.

The upshot is that publishers and brands will need to describe in very simple terms how they will use consumer data – which in turn will limit what they can actually do with that data.

Consent, transparency crunch

Leonard predicted regulators will increasingly “focus on the transparency of disclosures about how digital advertisers collect and use data about individuals in ways that affect how those individuals are treated”.

Under Australian Consumer law, he said, “transparency has a special meaning”.

“The way the Privacy Commissioner interprets transparency is: ‘Are the words displayed sufficiently prominently and expressed in a way that a person of below average literacy could understand?’ So the target audience against which your disclosures will be measured is a target audience of people of below average literacy,” said Leonard.

That has major implications for audience segmentation and profiling.

“Having drafted hundreds of these disclosure contracts… I can tell you it is really hard to explain those things even to people of above average literacy [that do not have] specialist knowledge of how [digital advertising] works.

“As we ramp up transparency requirements, it will get more difficult to explain those things,” cautioned Leonard.

“And if you don't explain them properly and fully to people with below average literacy, and it's not done in a way that's sufficiently reasonably prominent, then you might follow Google into the full Federal Court and have some judge say ‘your disclosures have not been sufficiently clear and expansive about everything you do’.

“So the task of explaining what you do will in turn limit what you are able to do, because of the regulatory risk that… the ACCC will come after you like it went after Google, like it went after Trivago, and say that your disclosures as to algorithmically-driven profiling or differentiation between individuals have not been sufficiently clear.”

All bets off?

There may be worse to come for the digital marketing sector: Regulators may come for them “even if you are using non-personal information, non-personally identifying Information,” Leonard portended.

That is because increasingly savvy consumer advocates are pushing lawmakers to broaden the reach of Australian privacy law “to include any form of profiling which enables an individual to be treated differently on the basis of their inferred interest characteristics or preferences, regardless of whether that individual is identifiable or not”, said Leonard.

So whereas under current regulation, marketers can “profile and target to your heart’s content” provided an individual cannot be identified, that would no longer be the case.

“If the law was changed so that any form of targeting activity for, example, direct marketing was covered by the Privacy Act, there's a whole raft of new obligations that would come into force,” said Leonard.

“Potentially you then come under the jurisdiction of the Privacy Commissioner in relation to those profiling activities, as well as the jurisdiction of the ACCC as to whether you have made adequate and transparent disclosures to consumers as to how you're using data about them.

“So you could have two regulators on your tail and a much broader ambit of operational regulation that happens today,” said Leonard. “That is a very big risk for this industry and one that you need to take very seriously – and it's currently in play.”

Marketers must heed warnings 

Leonard forecast "continuing vigorous enforcement of Australian consumer law," underlining the need for all parties collecting data to nail their disclosures "so that nobody can argue that you're misleading and deceptive in anything you say – whether it's in a contract, whether it's in your marketing collateral or whether it's in a conversation with your digital advertising agency or your adtech provider."

The regulator drums are already beating louder, he said, and brands need to heed the signals of what is coming.

“We'll see the ACCC and the OAIC, the Privacy Commissioner, marching in step – and we're already seeing increasing funding for the Privacy Commissioner to bring regulatory action. They’ve been seriously hiring.”