EU cracks down on Facebook and Google — what it means for third-party data collection

Last week, the Irish Data Protection Commission (DPC) reached a decision to potentially suspend Facebook’s data transfers from the EU to the U.S., marking one of the latest developments in the EU’s war on transatlantic data collection.

The war that’s been brewing since the release of the European General Data Protection Regulation (GDPR) came to a head recently when Austria data regulator Datenschutzbehörde said that medical news provider NetDoktor’s uses Google Analytics unlawfully, exposing the data of EU data subjects to U.S. intelligence agencies. 

These developments highlight that relying on third-parties to gather data is becoming a losing proposition for tech executives amid the enforcement of international data protection regulations

The end of EU Facebook data collection?

The EU’s criticism of Facebook and Google Analytics data handling highlights that the regulator is looking to evaluate the way that EU-based organizations share data with downstream U.S. service providers, and are willing to enforce the data protection requirements of EU subjects. 

“The eventual result of this decision, and recent decisions for Google Analytics and other cloud services, is that almost all U.S. companies, and U.S. companies with U.S. subsidiaries will have to end data transfer with Europe,” said Jules Polonetsky, CEO Future of Privacy Forum. 

“At this point, only a new political and legal agreement for U.S. surveillance oversight and redress will prevent this catastrophic outcome,” Polonetsky said. 

“The irony is that Facebook and Google will be fine no matter the outcome, as they and a handful of others has the resources and technical ability to invest in the massive tech changes needed. Healthcare institutions, universities, government agencies, small and medium businesses and their customers are the ones who will suffer if there is no political resolution,” he said. 

The implications for third-party data collection 

When considering Facebook and Google’s run-ins with EU regulators alongside the wider crackdown on third-party data collection, the future looks bleak for third-party advertising. 

Not only has Apple given users the choice to opt-out of sharing their data with advertisers, but Google has recently restricted cross-app tracking of Android users, after announcing that they would ban third-party cookies on Google Chrome in 2023. 

The combination of the EU regulator’s crackdown on U.S. data sharing and service provider’s phasing out of third-party data collection suggest that organizations and decision makers will need new ways to collect data and gather insights on customers. 

“The era of third-party advertising is getting to a close and it remains to be seen if Google is willing to act as an independent internet gatekeeper — via Android and Chrome — or a provider of third-party advertise tech (Topics API),” said Mander Shinde, cofounder and CEO of customer data platform provider Blotout. 

“For the past two years, Google has struggled trying to have their cake and eat it too as Apple forced the hand. The announcement with Android is a reflection of those struggles, and so were changes in Chrome that were pushed out to 2023,” he said. 

What’s next for advertisers? 

The most obvious solution for enterprises appears to be first party data, where organizations request permission to collect data directly from users, and use that to develop their insights without relying on a third party like Facebook or Google. 

Collecting first-party data has emerged as a priority for many markets after the cookie phase out, with 88% of marketers in 2021 agreeing that collecting first party data was a priority, and 52% saying their organizations had prioritized digital experiences and/or strategies to collect more first-party data. 

However, while Shinde believes that first party data will play a role in enabling enterprises to gather user data going forward, he also believes that organizations can still engage in data sharing if they form close relationships as referrers and beneficiaries. 

“We believe that two parties, a referrer (say Facebook) and a beneficiary (say advertiser) can still match signals to be able to work with each other. We expect that every party will have their customer and will enable content-based participation between parties. This scenario will drive significant consolidation in the market, as we have seen in the App industry,” he said. 

While it remains to be seen whether Facebook will halt data transfers from the EU, the writing on the wall is that enterprises can’t afford to rely on third parties to access insights into their customers, it appears they’ll need to own the insights themselves if they want to work intelligently long term.