Guide to Navigating Consumer Privacy and Retail Media Networks

Experts predict that the retail media industry will drive over $60 billion in revenue by the end of 2024 — nearly triple the amount at year-end 2020. With this accelerated growth, eCommerce brands are quickly adopting retail media platforms to monetize and deepen relationships with brand partners. Yet, the rush to introduce retail media partners leaves eCommerce professionals struggling with new questions related to data privacy and using first and third party data. 

With so many moving parts and little documentation to guide them, retailers face uncertainty in addressing both the legal and practical aspects of managing consumer data privacy.

Consumer privacy: uncertain landscape  

With the deprecation of cookies on the horizon and growing privacy regulations, first party data has long been retailers’ most powerful asset. Yet, data security has become pressing particularly with the growth of retail media. Retailers have collected vast amounts of first party shopper data through loyalty programs and web purchase behaviors.

The promise of retail media is to activate that very data throughout the funnel. Retailers, therefore, need to leverage advertising technology from many different third party vendors to achieve a rapid time-to-market. However, data shared with outside parties increases the chance of compromising shoppers’ privacy — a risk for even the largest eCommerce brands. Instacart, for instance, suffered a security incident after two employees working for a third party vendor viewed more shopper profiles than necessary.

Regulations like GDPR (General Data Protection Regulation) and CPPA (California Consumer Privacy Act) have stemmed from such issues, as has Google’s announcement that it will sunset cookies on Chrome.

Without third party data, brands must turn to retailers’ valuable consumer data to continue delivering targeted, personalized ads. Retailers seeking to monetize from this opportunity must build a retail media network, which few, aside from behemoths like Amazon and Walmart, can afford to build in-house. Instead, most need to team up with a retail media platform, which carries a new set of challenges related to consumer privacy and compliance.

Retail media privacy compliance: 5 guiding principles

1. Each cookie is one too many

Privacy advocates take aim at the cookie for two reasons:

• Websites and servers can access data on shoppers’ personal devices.
• Access allows tracking of an individual’s browsing history – not only on the same site but across the web.

That’s why European laws require retailers to get user consent for all non-necessary cookies. Cookies used for marketing purposes (such as retargeting) are not considered essential, and thus need permissions, which many users reject.

In the best case, regardless of geography, your adtech partners don’t introduce or use any cookies. If they come into play, make sure your partner documents every single cookie and its purpose. This way, your website is transparent about cookies and asks for user permission when required by law. Since incorporating the retailers’ own personalization and audience targeting criteria is a best practice for retail media platforms, additional third party data would bring you limited benefits. 

2. Seek server-side integration

Regulators and shoppers are increasingly suspicious when webpages access third-party servers, which may profile and collect personal behavior for future targeting.

To minimize exposing your shoppers’ personal information, integrate third party technology on the server side as much as possible. When you integrate on the client-side using HTML tags, browsers will expose shopper data to third parties, such as their IP Address. This practice may fall victim to privacy regulation (as in Europe) or tracking prevention.

In short: server-side integrations provide better protection of user data. Using backend APIs also helps as your partners receive less sensitive information to protect or treat with care.

3. Applaud anonymity

Make sure your retail media vendor does not expose data sets that can identify individuals.

Reporting should only expose anonymous and highly aggregated data to advertisers, with no personally identifying information (PII). For example, technology may expose information related to a selected cohort of women in their mid 30’s. However, it should not have specifics on me, you, or other persons.

4. Ensure encryption

With your enviable ability to collect and access many data points, you want to ensure that it’s safe. To prevent leakage of PII, get confirmation that your retail media vendor processes personal data with the highest security standards. Look for encrypted data with hashed values. This approach also minimizes the negative impact of data breaches such as that experienced by Instacart and other retail vendors.

5.   Dedicate to datensparsamkeit

Literally: data thriftiness. This German term refers to how a business should approach capturing and storing data. Retailers should only handle the data that they need.

In the past, there was a push to capture as much consumer data as possible, with the understanding that it may be useful for future marketing efforts.  A more modern approach would be to economize data capture to only collect elements necessary for the sake of privacy compliance and consumer benefit. 

In the case of building a retail media network, your adtech partner should require just a minimum amount of data to work properly.

Next steps

Future-proofing your retail media technology will help you adhere to international compliance laws, address consumers’ data privacy concerns, and build trust.

In evaluating a retail media solution that follows these principles, consider Crealytics Middleware retail media solution. The simple backend API integrates directly into your ad server, introducing zero third party cookies. All personally identifiable data is 100% hashed. The retailer fully controls shopper data, not the adtech solution.

By introducing Crealytics Middleware to your technology platform now, you don’t need to worry about changing your technology later as data privacy laws heighten.

Ready to build your retail media business?

Contact our team at Crealytics.

Just getting into retail media?

Download our glossary for the latest industry lingo.