What you need to know:

• New laws governing privacy in Australia could severely restrict how ad tech providers and platforms use location data.
• A discussion paper exploring possible changes to Australia’s Privacy Act appears to zero in on geolocation, with profound implications for the Out of Home and mobile advertising sectors that use location data.
• Mobile in-app advertising platform InMobi has urged lawmakers to be practical when proposing changes, and also to provide more detail on what is in scope. 
• While concrete changes to the Act are still months off, JCDecaux says it is reviewing its use of geolocation data to be prepared.
• The Out of Home industry has been adding location data to its buying platforms and acknowledges the data they use is likely to change over time.

Attribution and measurement in the Out of Home industry and mobile advertising sector would be undercut by changes to geolocation data flagged in Australia’s review of privacy laws.

But major industry players, some of which say they are reviewing any use of geolocation data, have urged lawmakers to make practical changes and are confident workarounds, consented data streams, or other alternatives will emerge.

Buried among the suite of changes proposed for Australia’s Privacy Act in a discussion paper released by the government last month were clues that could rule out swathes of location data currently used for tracking and measurement.

Just this month, QMS touted its new City of Sydney street furniture as having transaction data – and GPS data – integrated into buying.

“Internationally, privacy legislation is beginning to recognise how intrusive location information can be,” the paper says. It puts forward two proposals:

• Users could have to explicitly opt-in to personal information sharing, including location data.
• App makers may have to ensure there is button that, with a single click, changes all settings to the most restrictive – including location data.

The review of the privacy laws could make some data more tightly guarded than that governed by Europe’s General Data Protection Regulation, experts say. It raises making metadata and location data “personally identifiable information” (PII), which would require anyone holding it to abide by strict Privacy Principles.

The discussion paper gives the example of a weather app. A user might “reasonably expect” to give their location to the app, but the sale of their precise geolocation by the app to data brokers is “unlikely to be fair and reasonable in the circumstances”. Yet this is what currently happens, and Out of Home and mobile advertisers often rely on this third-party data.

“They have said inferred data is an online identifier information that can individuate people – so be able to distinguish one person from another – such as your online behaviour, pattern data, location data. All of that is within scope,” former deputy NSW Privacy Commissioner Anna Johnston, now principal at Salinger Privacy, says.

Major OOH players reviewing use of data

JCDecaux is one major player moving early to understand the impact of location data changes. “Geolocation data is only one type of data we use,” CEO Steve O’Connor says.

“Whilst we do not collect this information directly, we are currently in discussions with our data partners about how this potential change would impact our business. It may be, for example, that less data sources are available as people opt out of sharing geolocation data, but that the quality of the data is better and more reliable, because the data is from people who have fully opted in.”

Whatever the final changes end up being, O’Connor says, they will undoubtedly drive innovation and other ways to source the data – with the right level of consent.

The Outdoor Media Association, the peak body representing OOH display companies, says the proposed changes to metadata and location data come as the industry is building a more robust measurement system, MOVE 2.0.

MOVE (Measurement of Outdoor Visibility and Exposure) is the industry-wide attempt to measure reach and frequency for OOH campaigns. MOVE 2.0, which is expected to go live in 2024, will, ideally, provide very granular information about who is seeing outdoor ads. But it has to be future-proofed before the future changes are even set in stone.

“We know that the data we have access to now might not be the data we have in the future, and MOVE 2.0 is being built with this in mind. You only have to look to the GDPR in Europe to see that privacy changes are likely to happen in Australia too,” OMA and MOVE General Manager Kylie Green says.

“That’s why we have gone to the effort of getting our own first-party data by undertaking and underwriting our own travel survey as the basis of the granular behaviour data going into MOVE 2.0. This survey’s participants have been recruited and are paid to provide us with the data… What’s also become clear is that each data source on its own cannot measure the entire Out of Home audience.”

Out of Home verification platform Seedooh says it does not use personally identifiable information, including geolocation.

“So any potential changes in this area will not have a direct impact on our business,” CEO Tom Richter says. “These proposed changes and industry responses to them – however they all play out – might actually create an opportunity for more standardisation in audience measurement, which would also be a good thing.”

Lawmakers must be practical to avoid stifling ad industry

The source of a lot of location data is mobile phones, and so any legislation that impacts geolocation data will have a profound impact on mobile ad targeting, too. India-based mobile ad company InMobi says so far, it’s not clear exactly what would be in the data crosshairs of any privacy changes.

“We understand the need for informed consent with regard to precise and fine location,” Richard O’Sullivan, VP and General Manager of InMobi ANZ, says. “However, more clarity is required as to why and exactly what sort of location data and which use case scenarios should be in play for such data to be deemed as ‘sensitive information’ on a standalone basis.”

Politicians and regulators need to be practical, O’Sullivan believes, when framing new laws, and take the time to understand the nuances of the advertising industry while also bearing in mind the privacy rights of individuals.

“While traditional personal data, precise location and sensitive information such as credit card data, ethnicity, sexual orientation, biometric data, etc, certainly requires further robust legal framework, bringing more non personal data or personal data within the ambit of sensitive information restrictions might stifle the advertising industry without any real benefit to the users,” he says.

The introduction of iOS14.5 by Apple, which severely restricted the data available to some platforms and ad tech providers, encouraged innovation.

“There’s been a 25 per cent opt-in within Australia meaning the data is no longer provided or available via the unconsented devices. The reality is that at first (iOS14.5) did have an impact in Australia in Q1 (2021) but we soon found that advertisers and tech platforms adapt, learn and leverage the proliferation of data sets available to find the consumer in different environments so we quickly made up lost ground.

"The market is dynamic and we'd advise advertisers, agencies and publishers to work collaboratively with partners and vendors to find mutually beneficial solutions that include the customer at the core.”

Precise or imprecise

What’s unclear at this stage is whether the geolocation transmitted by a mobile device, or simply any information that could be used to determine broad location, would be captured by privacy law changes. Meshh is a company looking to do hyper-local, de-identified location data to help OOH and large sites understand the movement of people.

“We have the view of not taking location home with the consumer,” Meshh managing director Duncan McIntyre says.

They install WiFi sensors that regularly “ping” with nearby mobile devices, and with several of them around, it can generate a rough location for each device.

“It passively listens to those pings, anonymises them, looks at dwell times, unique visitors, conversion rates. We do a total reach number as well. We look at the science of dwell time, unique visitors. We give brands that passerby metric, which is kind of the eyeballs in Out of Home,” McIntyre says.

“We anonymise the Mac ID, the device ID and turn it into our own personal identifier – it’s encrypted, non-reversible, you can’t figure out who it is. The whole solution is GDPR compliant, basically.

“Geolocation is great for maps or if you’re going for a run. Outside of that, as a consumer, you really need that value exchange. The list is a lot longer for bad geolocation cases than it is for good geolocation cases.”

Ben Baker is Asia-Pacific Managing Director of Vistar Media, a programmatic buying tech company for OOH.

Whatever the changes to individual tracking in Australia privacy laws, Baker reckons the OOH industry is in a fundamentally good position.

“Out of Home is inherently PII compliant. It’s a one to many medium. It strikes a balance between being relevant but never creepy,” he says, adding: “If you’re using Out of Home to reach an individual, it’s not a good mechanism. Very expensive.” 

If all location data disappeared tomorrow, “Out of Home is incredibly well positioned because you can tap into contextual relevance,” he says.

Vistar Media uses no bidstream data, no latitude and longtitude coordinates, but rather data from software development kits (SDKs) that come from apps that have asked for consent.

“At any given stage, we’re looking at the patterns of 3.5 million devices in Australia,” he says. “All pings are randomised and hashed… we’re using it to build heat maps.”

Any change that moves the industry away from one-to-one targeting to one-to-many is a good change, Baker says, and key players must be transparent, open, and ready.

Data Synergies principal, Peter Leonard, doesn’t think the proposed rules will eliminate online identifiers or geolocation tracking entirely – but it may increase the storage and transparency burdens on businesses that use them.

“No, that will not be prohibited,” he told an Mi3 podcast. “But a much higher level of transparency disclosures as to these practices will be required…There would be more clear disclosures up front as to what is happening and then an ability for individuals to opt out from direct marketing using those kinds of individuating practices.”