The online advertising industry is about to be severely disrupted - 'it's the amputation of a significant revenue stream'

The European Union announced late Tuesday that it has settled on tough new data protection laws.

The new, unified data protection rules across Europe are designed to give consumers in Europe more control on how their data is used (you can read a summary of the key points here) - but they could have a severely damaging impact on the online advertising industry.

The full text of the EU's data protection reform is not yet out. But a press release from the European Commission signals some significant changes that could hamper online advertising companies and the publishers which rely on digital advertising revenue to stay in business.

The European branch of the Internet Advertising Bureau's (IAB Europe) interpretation of what has been released of the new rules so far identifies two key concerns: That the idea of "personal data" has now been widened, and that companies will now need to gain explicit consent from European users before they use their data in order to serve targeted advertising to them. Furthermore, the raising of the digital age of consent" to 16 (from 13) could be hugely disruptive to companies that have strong teen user bases.

Townsend Feehan, the CEO of IAB Europe, the trade body that represents the European internet advertising industry, told Business Insider: "It's the amputation of a significant revenue stream just at the moment publishers are having such a challenge in switching to digital."

A broad definition of "personal data"

One of the IAB Europe's key concerns is that "everything" will now be considered personal data, according to Feehan. She added that the new rules include language that suggests "some identifiers that could not possibly be used to trace back to a an individual person" will be included under the "personal data" bucket.

"There appears to be a broader definition and bigger scope for personal data, and a narrower legal basis for the processing of that data," Feehan said.

Feehan says a lot of consumer data that falls under these new laws are "low risk or no risk" - the type of contextual data that might tell an advertiser you are in the market to buy a car, but not that you're female and live in London and are a certain age. That could serve as the "amputation" of many publishers' revenue streams, who rely on such data to sell their advertising at a premium to marketers and might find it hard to comply with the new rules.

She added: "It's an own goal [from the EU], [the impact] will be insidious and happen slowly over time. It will be an inexorable impairment on online media in Europe ... it's not good for media pluracy and democracy."

The need for "explicit consent"

IAB Europe is also concerned that the EU will require internet advertising companies gain "explicit consent" from users before they use their data to target them with ads. Essentially, that means that users would have to opt-in to receiving this kind of behavioral advertising.

There are two clear issues: Research shows it's far harder to gain explicit consent from consumers than it is to gain "implicit consent" - merely stating you will use some data for advertising purposes in terms and conditions, or via pop-up-style messages that inform consumers that cookies are running.

The other issue is that while it is (relatively) easy for big consumer-facing platforms like Google and Facebook to ask consumers to click a box confirming their data can be used in such a way - it's a lot harder for the huge array of ad tech vendors who serve hundreds of millions of dollars-worth of ads each year, but don't have consumer-facing platforms. What consumer is likely to have visited the websites of AppNexus, Rubicon Project, Criteo, or Media Math, for example?

It's not terribly practical. Feehan worries that some of the smaller ad tech players could go out of business.

Ian Maude, head of internet at Enders Analysis, says there might be a workaround: Companies like Google and Facebook that partner with these ad tech vendors could also ask users to click whether they opt-in to their data being used by third-parties for advertising. Although that would clearly put more power in the hands of the internet giants at the expense of smaller companies.

There's a further issue, too: It appears companies must gain explicit consent for each way in which they use consumers' data.

Ian Saunders, an adviser to technology businesses, told Business Insider: "Buying a product [from a brand] does not mean you have the right to serve advertising henceforth to that individual."

The raise of the digital age of consent from 13 to 16-years-old

A formal vote is taking place among the European Parliament's civil liberties committee on this particular aspect of the regulation on Thursday. There will be a full parliament vote next year, and the BBC reports that it is unlikely to go through on a European-wide level, and instead it will be up for member states to set their own limits.

The proposal would essentially prevent internet companies like Facebook and Snapchat offering their services to younger people under a certain age limit - which could be raised from 13 to 16-years-old.

Dylan Collins, CEO of "kid safe" marketing platform SuperAwesome, told Business Insider the decision has the potential to "massively disrupt" the online advertising market. Whatever age restriction is chosen will not only prevent children under that age accessing certain internet platforms, but it will also restrict all behavioral and programmatic advertising aimed at them. This has already happened in the US under the Children's Online Privacy Protection Act, which restricts profile-based advertising to under-13s.

He estimates the total amount of ad dollars spent on advertising online to the global teen market is $30 billion.

"The under-13 space has aggregate spend of ~$7 billion, but the 13-t0-20-year-old market almost doubles this number. Many major tech and media companies have already started to target the under 13 space - eg. YouTube Kids and Amazon - but extending the same requirements to the teen space and shifting the entire sector to a contextual-only basis would be hugely disruptive for companies [with large teen userbases] like Facebook, Snapchat, YouTube, Viacom, and many others," he added.

Balance is needed

As said previously, the full text of the new rules have yet to be released and it will take a while for the full effects to be realized. In the meantime, there will continue to be discussions amongst policymakers, lobbyists, and the tech industry about the best ways to interpret and implement the new laws over the next couple of years.

What is clear is that the EU is trying to solve an issue. The EU's public consultation on its data protection reform showed that many consumers were concerned about how their information is used and did not full they had full control over their data online.

Maude said: "This should ring alarm bells for the internet advertising industry in the same way we have seen the rise of ad blocking. That's happened for a reason, it's not just about ads themselves, but more broadly about how data is used for tracking, for example. Regulators like to regulate so it was always going to be likely that we would see more regulation in this area."

There are benefits too, according to Maude, including that there will now (broadly speaking) be one set of regulations to abide by across Europe, rather than many different laws for different countries.

Maude added: "One clear set of rules and regulations where consumers feel confident that they have control over their information and how it is being used and accessed and not being mis-used is ultimately a good thing."

But ultimately, the reaction from the advertising industry is one of disappointment.

Ian Twinn, director of public affairs at UK based advertising trade body ISBA, said: "The EU fix on the four-year run in trying to find a common agreement on data protection is a mixed bag. Of course advertisers, and businesses more generally, will be pleased that there is an end to the indecision. We particularly welcome the need to deal with only one data regulator."

But he says the compromise is less clear: "The fine detail may be better than the press release but at first sight both citizens and businesses will be disadvantaged. The European Parliament has failed to understand the impact of its hard-line political stance. This is the EU at its worst. The end result is a new regulation that is based on five-year-old thinking, sourced from old technology and old expectations."