Showing Ads to European Visitors After Friday

What changes on Friday

Europe's new privacy rules, GDPR, apply from Friday, May 25. For a site that carries advertising, the most visible change concerns visitors from the European Union.

Personalised ads, the kind chosen using a visitor's browsing on other sites, will need that visitor's consent before they are shown.

That can reach Canadian sites too. GDPR applies to organisations outside Europe that monitor the behaviour of people in the EU, and tracking people online to analyse their preferences is what it means by monitoring.

Your ad partners are also changing their own terms, which apply to you whatever view you take of GDPR's reach. This is a general outline, not legal advice.

Personalised and non-personalised

A personalised ad is chosen using what an ad company knows about the visitor: sites visited, things searched for, and interests inferred from both.

A non-personalised ad is chosen using the page it appears on and broad details such as the visitor's rough location, without drawing on their history.

Advertisers generally pay less for ads they cannot target, so non-personalised impressions tend to earn less. How much less depends on the site, the audience and the season.

Non-personalised does not mean cookie-free. Google, for one, says such ads still use cookies to limit how often an ad repeats and to fight fraud, and some European countries' cookie rules require consent for that too.

What Google's policy asks

Google has updated its EU user consent policy, which covers publishers using AdSense, DoubleClick for Publishers and its other ad products. For visitors in the European Economic Area, it asks a site to do the following.

• Get consent for personalised ads, and for cookies where the law requires it.
• Name the companies that will use visitors' data.
• Keep a record of the consent given.
• Let visitors change their minds easily, at any time.

The second is the one that surprises most publishers. An ad request can pass through many companies, and each one with access to visitors' data has to be named.

Google's settings let publishers limit which outside ad companies are used for European traffic, which keeps that list shorter and easier to explain.

The consent message

For most sites, consent means a short message shown to European visitors before personalised ads load, offering a clear choice and naming the ad companies involved, usually behind a link.

Most publishers use a ready-made consent tool rather than building one. The tool records each answer and passes it to the ad code, which then serves personalised ads, non-personalised ads or none.

Decide whether the message appears only to visitors detected as being in Europe, or to everyone. The first leaves most Canadian readers untouched; the second is simpler but adds a step for every visitor.

Keep it brief and readable on a phone. A message that buries the page under legal text costs readers wherever they are.

Non-personalised for Europe

The simplest route, for some sites, is to show only non-personalised ads to European visitors.

Google's ad products offer a way to do exactly that, through a setting or a line in the ad code.

Doing so removes the need to ask for consent to personalise, though a cookie notice may still be needed where local rules require one.

The trade is revenue. For a site whose readers are overwhelmingly Canadian, it may barely register. For one with a large European audience, it deserves a closer look before Friday.

A worked example

A two-person publishing business runs a site of trail guides for hikes in the Coast Mountains, funded by display ads. Most readers are in Canada, with a steady minority from Europe planning trips.

The owners had assumed their main ad partner would handle everything. Its new options did let them request non-personalised ads for European visitors, and they set that up.

But a second network's tag, added years earlier to fill unsold space, had no consent settings at all. It would have carried on serving personalised ads to everyone.

They asked the second network what it planned for Friday. The answer stayed vague, so they set that tag not to load for visitors detected as being in Europe.

A short message about cookies and consent now appears only to those visitors, the privacy policy names both partners, and a link in the footer lets anyone change their choice later.

Questions for every ad partner

Put the same short set of questions to each ad partner this week, in writing, and keep the answers.

Ask what they will serve to European visitors from Friday if your site sends no consent signal, and what form that signal needs to take, including whether it works with the consent tool you use.

Ask which other companies receive data through their tag, whether they offer terms covering GDPR, and whom to contact when something stops working.

Several partners at once

Larger sites often run header bidding, where several ad companies bid for each space at the same moment. Each of them needs the consent signal, not only the main partner.

The same applies to anything else on the page that tracks visitors for advertising: retargeting pixels, social widgets and old tags nobody remembers adding. One overlooked tag can undo the care taken with the rest.

The privacy policy and the footer

The privacy policy should say plainly that the site carries ads, name the partners that serve them, explain what personalisation means, and tell visitors how to change their choice.

A footer link that reopens the consent message gives every visitor a way to change their mind later, which Google's policy expects.

The counter-case

Not every publisher faces the same amount of work.

A site with few European visitors can reasonably show all of them non-personalised ads and keep the rest of its setup.

A site with a single ad partner that supplies its own consent tool may need little beyond switching it on and reading the settings.

But every site carrying ads needs to know what each tag does for European visitors after Friday. Choose between consent and non-personalised ads, and make sure every partner knows which.

Before Friday

1. Check your European audience in Analytics.
2. List every ad tag on the site.
3. Read each partner's European policy.
4. Choose consent or non-personalised ads for Europe.
5. Set up a consent message where needed.
6. Name your partners in the privacy policy.
7. Add a footer link to change choices.

Step two is where most surprises turn up. A forgotten tag from an old network, or a test nobody removed, keeps loading whatever else changes, and it is the one nobody thinks to ask about.

The last change that decided which ads may appear at all is covered in Chrome's ad filter starts today.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.