As the challenges around digital privacy evolve, one of the more fascinating transformations is the expansion of the definition of “personal data.” As an industry, we evolved to ensuring the protection of PII (Personally Identifiable Information). Having access to PII is not needed to achieve the goals of personalization, optimization and targeting. In so doing we sought to protect ourselves from privacy regulations while still achieving the goals leading to business success. But the definition of personal data has grown from a narrow set of direct identifiers into something far more encompassing – and potentially unwieldy.
The Evolution of Personal Data: From PII to Everything Else
At the heart of the privacy debate (since we’re talking about definitions, let’s be clear – I am referring to information that advertisers use to target audiences) is the fear that you are being profiled by advertisers leading to one-to-one manipulation. I place much of this fear on the movie, The Social Dilemma, where the filmmaker depicts imagery of Facebook creating an avatar of a young boy and driving him to take actions he wouldn’t normally take. It implies that Facebook is selling his name, his home address, his phone number and email to advertisers for the purpose of targeting Ben.
Without going into the details here of why the “personal dossier” narrative is false, advertisers have worked to eliminate any identifiable information from the data to collect in order to protect them, and you. For many years I partnered with The Trade Desk in my class at Syracuse University, “Who’s Your Data?” The students were provided with sample datasets to analyze and recommend targeting optimizations. What was in those datasets? Things like:
- IP Address
- City/State
- Time of day
- Day of week
- Browser
- Operating system
- Screen size
All of that information was useful in helping to understand which devices (not people) were most likely to respond favorably to an advertiser’s message to inform where our investments were most likely to pay off. We did that to most effectively and efficiently send the right message to the right person at the right time. Remember the last time you were annoyed by an ad message? That represents a failure on our part, that is not what we hope to do.
But as more privacy regulations get written, the narrower the definition of what private information is. Much of what is now being called “personal data” is information you don’t even know about yourself.
Not surprisingly, California was the first mover in the U.S. in enacting legislation. Rightfully so the California Privacy Regulation Act calls things like name, address and social security number personal data. That is information no advertiser needs to know, unless you tell them (you do want Amazon to have your address). The law goes on to include browsing history, website and app activity, employment and education data (which, by the way, is public information) as personal information. The law in Virginia includes probabilistic identifiers as well. That means that even if we got it wrong, the information is still somehow attached to you.
The Unintended Consequences
This expansion of personal data definitions has created a Catch-22 which can ultimately completely restrict an advertiser from effectively targeting audiences at all. To remain compliant with global laws around data privacy and maintaining consumer trust, advertisers have been creating methods of “de-identification.” Advertisers have been striving to strip the information of any personally identifiable indicators, which we don’t need and don’t want. But the evolving regulations are going after that too. Under current regulations, “personal data” is becoming something that both can and cannot be attached to you. I think a physicist named Schrödinger batted that idea around with a cat once.
The challenge moving forward will be finding ways to protect privacy while maintaining the utility of data-driven services. This might require a more nuanced approach to personal data classification – one that acknowledges different levels of privacy risk and applies proportional protections.
As the definition of personal data continues to evolve, my goal with Your Digital Ally is to keep businesses informed and adaptable. The days of simple PII compliance are long gone, replaced by a complex web of considerations that touch almost every aspect of digital operations. Success in this new landscape requires a sophisticated understanding of these nuances and a commitment to privacy-conscious innovation.