This post first appeared on the TRUSTX blog on February 7, 2024
Here we are, just a few days away from Super Bowl LVIII: the San Francisco 49ers versus the reigning champion, Kansas City Chiefs.
Those who know me are quite aware that sports isn’t my thing, but when a 30-second spot costs $7 million, you can be sure I’m paying attention. And even more so than the roughly 115 million people watching the Big Game from home, what really captures my attention are the 65,000 super-fans attending live at Allegiant Stadium in Las Vegas.
What? This seems counterintuitive. Why would I care about a group that’s a tiny fraction of the complete audience? The answer lies in the powerful secondary market for location-based programmatic advertising, the sky-high economic advertising value of these 65,000 on-location fans, and the fact that targeting many of them is illegal.
Yes, illegal. Furthermore, it’s a potential data leakage nightmare that’s just plain old bad business for advertisers and open-web content publishers.
Let me explain. To start, how about we kick off with a few Super Bowl facts to see the power of location-based programmatic advertising?
Let’s zoom into the audience. The fans who have managed to get a coveted – and expensive – ticket to one of the biggest sporting events of the year skew heavily toward some combination of wealthy, at a reasonably senior level in their businesses, or famous (or all three). Data also shows an increasing number of families.
Now let’s consider this fun fact: for the sixty minutes of clock time in a football game, there are only 11 minutes when the ball is actually in play. The rest of the time is taken up in between plays, timeouts, injuries, and of course, commercial breaks.
While at-home viewers enjoy roughly 100 ads during the three-plus hours of scheduled game time, fans at Allegiant Stadium will have plenty of downtime to scan their phones, which means that these highly-targetable, super-valuable on-location sports fans will browse hundreds of thousands of websites and apps, all in the space of just a few hours.
And there’s no better way for brands to reach these consumers than through programmatic, location-based advertising.
Here’s a simple example: During some downtime between plays, Anne pulls up her favorite news site (let’s call it “The Times”) to catch up on the day’s events. The Times knows a few things about Anne, including the fact that she’s at Allegiant Stadium, and pushes these details into the programmatic supply chain with a bid request.
On the other end of the bidstream, Coca-Cola, the exclusive soda brand at Allegiant, has trafficked a campaign with geolocation targeting parameters that cover a small radius around the center of the stadium. Coke wins the bid and Anne sees an ad for $1 off a Coke product at any of the concession stands.
Imagine the same for Lyft and Uber, a jersey apparel company, a local tour operator, and the plethora of other brands who want to catch the eye of a captive Las Vegas audience.
This is great! Nothing could go wrong, right?
Alas, the days of unfettered access to personal information are coming to an end. What’s more, location data, when paired with any form of personal data, is sensitive data. And herein lies the first of two very tough plays in Big Game advertising.
I Broke the Law and the Law Won
As of this writing, thirteen US states have enacted privacy legislation that includes special restrictions on sensitive personal information. These laws set specific requirements for collecting, protecting and sharing location-based data. Some, like Virginia and Connecticut, require an explicit consumer opt-in before disclosing “precise geolocation data,” which they define as “information derived from technology that directly identifies the specific location of an individual within a radius of 1,750 feet.”
The Federal Trade Commission considers precise geolocation data to be sensitive personal information, and failure to reasonably protect this information, or failure to adequately disclose its collection or sharing, would violate Section 5 of the FTC Act for unfair or deceptive trade practices.
The problem is that personal data – whether it be a cookie, device ID, IP address or otherwise – is all part of the OpenRTB spec, and when The Times sends a location-enriched bid request associated with Anne’s mobile browser, her sensitive personal information is released into the wild.
As a practical matter, Anne may not be too worried that The Times knows she’s at the Super Bowl. But from a regulatory standpoint, The Times has just as much legal liability for this bid request as it does if Anne were checking the news at her doctor’s office or between hymns at church on Sunday. Which is why location data is very much under a microscope.
In January, the FTC banned X-Mode (now known as Outlogic) from sharing and selling sensitive personal information. The FTC alleges that X-Mode sold precise location data that could be used to track people’s visits to sensitive locations, such as the ones I mentioned above. In a separate suit, the FTC claims that Kochava sells data that reveals precise information about a person, such as visits to hospitals, “reproductive health clinics, places of worship, homeless and domestic violence shelters, and addiction recovery facilities.”
While there’s clearly a difference between Allegiant Stadium and The Church of Our Utmost Allegiance, the laws generally do not make a distinction. Precise location data, when tied to something personal, is defined as sensitive. And once the data is sensitive, every entity in the data chain of command becomes subject to special legal requirements, none of which are enabled by default in open programmatic advertising.
Show Me the Money
If lawyers from The Times aren’t already on the phone with Revenue Ops, then I’d hope their CFO is sprinting down the hallway. That’s because, in addition to the plethora of seemingly benign information about Anne that The Times is pushing through the bidstream, the value of that data goes up exponentially when tied to location data.
Over time, location data tells a story about a person.
Anne goes to the airport once a year? Probably for a vacation. She goes to the airport twice a week? She’s likely a serious business traveler. Anne goes to the Super Bowl? She’s likely got significant disposable income. And The Times is just giving away this information for free by putting it into the bidstream.
That constant drip we call “data leakage” is followed by the sucking sound of the adtech ecosystem ingesting Anne’s data to build an audience graph. And once Anne’s data story has been told, there’s very little incentive for Uber, Coke and other brands to buy The Times premium, high-CPM inventory, especially when they can wait until Anne’s boredom between plays leads her down some MFA rat-hole where she can be bought for a fraction of the cost.
Sorry, premium publishers. The clock’s run out of time.
In the Play for Privacy, We’re First and Goal
Today’s open-web programmatic advertising infrastructure is at odds with a growing list of US and global privacy laws. This is especially true when it comes to real-time, location-based addressability. When a publisher transmits an OpenRTB bid request, lat-long data rides alongside personal data, which by definition, makes it sensitive data.
This data is extraordinarily valuable, and for economic reasons alone, should be protected. For the last dozen or so years, publishers have been burned by throwing their hard-earned first-party data assets into the unregulated bidstream. Many blame programmatic markets for commoditizing premium inventory, but history aside, first-party data owners – publishers and advertisers – are finally starting to take more seriously the need to protect their audiences.
It’s time for all of us to wake up and stop playing with fire. If we continue down the field without changing our playbook, we’ll end up with a yellow flag and not a dime left in our pockets. The significant location-based advertising opportunity will be lost under the weight of regulation.
As for Anne? Uber will be waiting until the fourth quarter to hit her up with offers to drive her from the stadium to her hotel. By then, Uber’s DSP will be bidding on anything, so The Times should see more ad revenue even if Anne’s data gave Coke the opportunity to buy her attention more cheaply during the first half of the game.
And fortunately for the rest of us, most of the enforcement attorneys at the FTC will be in front of their TVs, so I don’t expect any Monday morning lawsuits.
