The European Commission's draft ePrivacy Regulation, published earlier this month as the EU works to replace the ePrivacy Directive (aka "the cookie law"), is a game changer for online privacy. It is a big push for a structured framework on technology enablers for companies doing business within Europe. The regulation makes a minimal effort to address the actual use of "cookies," and getting user consent through cookie banners has been left in the dust. Instead, the regulation goes into great length explaining case scenarios on technology enabler examples required to have enhanced privacy protection that include an end-user's consent and transparency on expected usage. The definition of these technology enablers has expanded under the regulation — highlights include, but are not limited to:

• MAC address
• IMEI device number
• IP Address
• Spyware
• Web bugs
• Hidden identifiers
• Local storage
• Pixels
• Other tracking tools 

The regulation looks comprehensive at face value, especially when considering the breadth of highlighted technology enablers. It includes anyone processing electronic communication, whether be it through an OTT (over-the-top) service, IoT (Internet of Things) providers, or any website that uses any technology enablers to collect data from European visitors.

Under the regulation, all such technology enablers are required to have enhanced privacy protection that include end user consent and transparency on expected usage. Now, this is great in theory. In practicality, it’s an operational nightmare.

The regulation will force providers to establish an operational framework for every technology enabler used — whether it’s the website operator or the extended relationships with affiliated vendors that provide targeted advertising, fulfillment or analytics. This is where it’s going to get cloudy for operators. These days, there seems to be audience segments for all sorts of analytics. Currently, there are multiple layers and elements collected online in the name of "analytics." As a matter of fact, analytics providers have expanded into basic analytics offering in a plethora of marketing and advertising services based on the data gathering. The regulation on these data gathering and usage methods will put analytics collectors in a tailspin. If the regulation stands in its current form, getting affirmative consent and disclosing usage in transparency will play havoc for operators. Especially considering operators don’t always know how the data will be used until after the fact.

The regulation also tries to establish a firm distinction between analytics and targeting. Let’s say you truly have gone through the analytics "analysis" and think you have a good rationale as to why the data collection is classified as analytics and not targeting. Great, well I hope you have this analytics working in-house or collected through true "first-party" cookies, otherwise the third-party data collection and passage will pose a problem to comply with the regulation. Per the regulation, third-party cookies are not allowed without additional provisions. Operators that need to collect information through third-party analytics may be forced to address this scenario through a binding agreement between the user and operator. The challenge will be how to implement this affirmative consent process before placing any third-party technology enablers on the user's browser.

The regulation also talks about centralizing consent in software such as internet browsers. However, do-not-track signals were introduced over seven years ago, yet there still is no consistency and commonality on how to interpret such signals. To compound the scenario, there still is no consistency on the technology enabler platform — as highlighted above, there are multiple competing technologies for how such data is gathered. Every technology differs on what that do-not-track signal would look like. It’s easier said than done to have do-not-track signal be opted in and out in such a diverse ecosystem.

The biggest evidence to highlight this dilemma is the advertising ecosystem. This has been a swirling discussion within the industry for quite some time now. As much spin as there seems to be the around lack of agreement, there does seem to be a consensus on moving toward the right direction. On Jan. 25, the Digital Advertising Alliance finally came out with an enforcement commitment for its members as of Feb. 1,  just two days after FTC released a transparency report on cross-device tracking with best practice recommendations for truthful disclosure, consumer choices, gaining affirmative consent and maintaining reasonable security. Between best practice recommendations from the FTC and DAA’s self-enforcement commitment, there is hope for some sort of standardization in recognizing the do-not-track signals.

Finally, the regulation expects websites to obtain affirmative active consent before any cookie is placed, and a separate consent is still expected for each type of cookie used on any given site. In practicality, it is extremely difficult to operate by this model. Website operators drop cookies and information collection practices ensue the moment you land on a site. The regulation dictates that website owners will need to be able to demonstrate that users have consented. In addition, website owners (i.e., first parties) will be responsible for managing consent needed for third-party tracking.

The regulation suggests that operators have pre-defined categories of data collected and technology enablers along with a concrete roadmap in place that defines such collection and usage practices. In reality, operators do not always know how to interpret the collected data and what aspect to use the data for until after the fact. Boundaries between analytics and marketing type data will be extremely difficult to pre-define. If the regulation stands in its current form, we may see a very mixed type of implementation from companies operating in Europe.

The regulation is certainly advanced in its ask, but the technology and its standardized treatment of collection enablers, including how to interpret into actual consent and truthful transparency is still lacking.