Data, Privacy, and the Future of AI in Digital Advertising

Dive into the complex world of data privacy, advertising technology, and the future of AI in digital marketing, with Ted Sfikas, Field CTO at Amplitude. Together, Ted and Aaron discuss the strategies employed by major players like Google, Apple, and The Trade Desk in navigating privacy regulations while still providing effective advertising solutions. The conversation also touches on the importance of first-party data, the challenges of the Google Privacy Sandbox, and the potential impact of AI. Throughout the discussion, Ted emphasizes the need for greater transparency, user control over personal data, and the importance of staying informed about the rapidly evolving landscape of privacy and advertising technology. 

AdTech and Privacy Regulations

Welcome to the Digital Clinic, the podcast that goes deep on critical digital marketing trends, strategies, and tactics for the healthcare and medical device industries. Each episode brings you expert guests sharing the knowledge, insights, and advice that healthcare marketers need to be successful in this complex and rapidly evolving digital landscape.

Aaron: With me today is Ted Sfikas, who is Field CTO for Amplitude. Ted, thanks for being with us.

Ted: You bet, Aaron. It’s really great to be here and talk about the topics that are near and dear to my heart, like MarTech and AdTech, and especially as it goes over into HIPAA compliance and the medical and healthcare world. Thanks for having me. 

Aaron: I know you’re deeply expert in those areas, so I’m excited to talk to you. Let’s start with AdTech and privacy regulations. You were just beginning to describe, before we got started, what’s happening and where you think things are going. 

Ted: Yeah, it’s really interesting. As you know, I’ve been following the big players in AdTech, like Google and Meta, to an extent, but The Trade Desk especially; it’s the number two DSP. I’m reminded of a quote that I read in a recent article, I think an adage, it was, “you either die a hero, or you live long enough to see yourself become the villain,” and they made that comment on The Trade Desk, and it couldn’t be more true. It’s really accurate because two years ago, The Trade Desk was the industry darling, it was the Pepsi to Google’s Coke. If you didn’t spend on display and video, with Google, your next choice was very likely The Trade Desk or a consortium of DSP vendors, but they really surfaced to the top because of their identity strategy. They blended in consent, and they did it ahead of time. They were pioneers in aligning privacy with marketing, but now fast forward two years, they’ve incorporated AI into the platform, right? Now they’re even better at finding you the right channel for your data. They’ve incorporated integrations with Snowflake and Azure, whereby their impressions, the people that actually saw your ad, are completely transparent to the advertiser, placed in an S3 bucket, called REDS, real event data streaming, and ingested by the brand. I just think that’s fabulous, but then the implemented supply path optimization SPO, and that basically took out the SSP, the seller on the other side of the trade. Magnite and all those other ones sitting there waiting to accept bids from The Trade Desk to sell inventory no longer had to be there. SPO follows the bid, the purchase, and tracks the impression. It doesn’t need the SSP, so did they become the villain? Not necessarily. They claimed that this is good for programmatic, but direct buys still go through an SSP. If you’re an advertiser, you should straight to the SSP for that. But it’s certainly diminished it, and it gave the SSPs no choice but to integrate with supply path optimization and make the case that their inventory was being optimized. Now that we have much clearer signals from the buy side, the sell side can produce better inventory at a higher price. Let’s see where it goes.  

Aaron: Let’s dig into that a little bit. Can you go your next level of detail down into the way that Trade Desk has been able to account for and comply with privacy regulation, and yet still provide good targeting and transparency to advertisers?

Ted: That’s right, yeah. It’s not a silver bullet. A lot of people will just speak of the good things about The Trade Desk or Google or Meta, but to be objective about it, you have to remember it all hinges on first-party data. Brands have taken stewardship of owning data, which means the brands define the privacy preferences, they define the means under which data enters the organization. It starts there. That data is small, but precision is high, it’s 100%. You know exactly that this is Ted Sfikas. In the olden days, when we bought data, reach was incredibly high. You had mounds and mounds, terabytes of data, but precision was extremely low. Some of it was duplicates, some of it was useless, some of it was stale, etc., so we’re doing a tradeoff. What I’m seeing is that first-party data tranches are getting bigger and bigger and bigger. The longer you invest in them, and the more money you put into making it high fidelity – bringing it through a warehouse, activating it, following its journey – the better off you’ll be, and the larger it’ll grow. Give it time. What we say here today could be completely different in six months, as the data grows. How did The Trade Desk get there? It invested in selling the idea of having first-party datasets being brought to its system, rather than turning into a DMP, “we’ll get the data for you.” They went down a different path, and the linchpin to that strategy was the UID 2.0. They invented an identity token that is compliant with the law in the United States and many other regions around the world. Europe is a different story, they have the EU ID. The whole idea is that this token represents a person, and the PII is hidden. You don’t need to know their name. All you need to know is their affinity, their intent, where they are in the funnel, which channel they prefer, and away we go. Your advertising works and it’s attributable, it’s addressable – that was the key. That’s how they did the magic. The rest of it, the SPO, the AI, they call it Kokai, that came following after. They’re making the first-party data tranche bigger and bigger. It’s brilliant. They created a movement, and they’re fueling it. 

Aaron: Yeah. So, they created in this UID, a de-identified token, and the token persists over time. 

Ted: Not only does it persist, it rotates. There’s a Prebid.org matching table that AWS will host for free because they want to be part of the solution. Thank you Amazon, and thank you Bezos, but Prebid lives on an AWS infrastructure. When a person enters a digital property, if that person doesn’t possess a UID in the cache, there are technologies such as Tealium CDP – Particle does this too, and Segment – it’ll trigger them to ask Prebid for the UID token. That token comes down, and away we go. If none exists, they create a new one using an email. The email was the basis of that hashing and the salting of the ID. It rotates every, I think, 10 days, three times a month, the UID algorithm for encryption changes, just to add an extra layer of security, and I think the privacy regulators like that part a lot. 

Data Privacy and Advertising

Aaron: Sure. As we think about the healthcare ecosystem, where privacy regulations are even more stringent, do you see this as applicable and compliant, potentially for healthcare advertisers? 

Ted: I do. I see every vertical doing this. But if you’re not sensitive to data, perhaps you’re small business and retail, by joining this movement, you automatically become data sensitive and a good data steward, just by virtue of working with companies like The Trade Desk. It doesn’t stop there. We have ramp IDs that do the same thing. They mix offline demographic data with the digital realm, and they produce a unified ID that’s secured and compliant with the law, from their perspective, of course. Many people will poke holes in a lot of the different IDs, but the main sense is it’s a federated strategy. You’re not just going to use one. You’re going to have your own private ID, and I think Wheelhouse does this very well, where they create a unique singleton of an identity, that represents a person as a pseudonymous ID. It’s perfect. What you’ve done at Wheelhouse is you’ve brought the compliance and the security right at ground zero. The moment the person enters the realm, before the healthcare organization accepts the data, it’s compliant and ready to be used. That was the missing piece, the beginning. The problem in the past was data was flowing into the organization and people tripped over themselves trying to secure it, and hash it, and where to share it, and the through-process edit, and nothing ever got done. So being compliant in real time, the moment of engagement is the most critical part. That’s what you guys do, and you can match it to UIDs, Criteo IDs, ID5, you name it. Whatever is relevant for the channels that healthcare wants to get into. 

Aaron: Yeah. Thinking about The Trade Desk and thinking about programmatic advertising, sort of writ large, given deprecation of third-party cookies, which is impending – supposed to be later this year for Chrome – how do you see that playing out for other programmatic providers? 

Ted: They’re really going to have to jump on the long tail that’s already been produced by The Trade Desk and learn from who blazed the trail, the pioneer. A lot of these DSPs are ready for that. We always forget that even though Safari doesn’t own a massive share of the browser market like Chrome does, Safari is significant in a lot of different industries. For example, in publishers, half the time it’s Safari that’s viewing their websites because it’s a click on an iPhone, and it just brings up a browser, and people leave it to Safari for default. Anyway, the point being is that they’ve had to deal with the loss of the third-party cookie in many, many different situations already. They’re seeing the results of not being compliant with a first-party data strategy, and they’ve adjusted. I see them just carrying forward. I’m pretty impressed with how far the prevalence of this strategy goes. It seems like every DSP has their own identity token, and it’s able to be considered in the grand scheme of things when matching people.  

Aaron: I have been surprised though by some who seemed flat footed. Speaking of, another two or three weeks ago, a company who shall remain nameless, their strategy seems to be to go simply back to contextual targeting. 

Ted: Contextual targeting, in my opinion, is the easy way out. Look, there’s nothing wrong with contextual targeting. If you ask anybody in Europe, involved with the DPA, they’ll go, “What’s wrong with contextual marketing? Why can’t you just look at what I’m doing on the screen and go okay, he has an affinity to dogs? Let’s trim it out on dogs.” Well, there’s nothing wrong with that, but it’s just not effective. I also noticed that Google is getting back into the acronym marketing mix model – Triple M. Those backwards looking things from six months ago, that’s not modern, digital, real time, fast, personalization, and all these new strategies fall by the wayside with contextual marketing. Is it a good complement? Sure. Supplement your strategy with a good marketing mix model. Bring in an agency that does good analytics and says, “Based on what we’ve seen in the past X, Y, Z.” An AI model would probably be applied to a marketing mix model at some point in the future, to give you better recommendations, so that we don’t have to do all that work.  

Aaron: Yeah. We’ve been watching that closely. We do marketing mix modeling for some of our clients. We’ve been able to dramatically accelerate and shorten the amount of time that it takes to develop and work through a model and get to some degree of prediction, but it still takes weeks to build initially. We can refresh very quickly, but the tuning and refining still takes a lot of human intervention. It’s expensive. We are waiting for the moment that we can begin to apply AI. 

Ted: When you do apply AI that will make your rates better, more appealing, and you’ll get more work, and you’ll get more campaigns because of it. It won’t cause anyone to lose revenue, and it actually opens up new revenue streams. The classic, “Will this robot take my job?” No, your robot is going to create five new ones. 

Aaron: Yeah, I think that’s right. I think existing jobs in some instances will inevitably disappear and be supplanted by AI, but as you said, there will be other roles, other jobs that will be created.

Healthcare Marketing and HIPAA-Compliant Data

Ted: Yeah, we’ll think of new things. I mean, healthcare, pharma, the highly sensitive organizations, we saw a dramatic change post-pandemic with these organizations. Look at Quest Diagnostics. When they had to go D2C to get the virus vaccines out, they had they’ve never done a D2C model. They’re a B2B, and they’re a Fortune 50, they’re not changing anytime soon. But they changed. They understood those mechanics very quickly, they invested in first-party data, they understood their customer, knew who needed what, when, where, and why. Marketing mix models can’t help. The virus is flowing, and you have a limited time to get this vaccine out. It’s a perfect example of a HIPAA-compliant, traditional, old-school vendor having to dynamically change because of the environment around them. We have Vertex, another example, a brand new pharmaceutical that they’re releasing to the market. If you look it up, their stock went through the roof. The FDA is approving this. It’s the alternative to opioid pain relief. We never have to worry about the addiction again, according to Vertex. This is a market of literally 8 billion people. Everybody on the planet is going to want that drug. You can’t go B2B with that. You have to reach out to people. This is a phenomenal new innovation, and so people want to read about it, they want to learn about it. They want to work with Vertex in a direct consumer to the business fashion. It’s another reason why first-party data is becoming important to HIPAA-compliant industries. More and more, you are becoming closer to the to the consumer or the patient. 

Aaron: Yeah. We certainly have found, even in a HIPAA-compliant context – whereby definition, the data that you can use to inform ad platforms is constrained – we’ve been able to continue to drive really good performance by just thinking of the data differently and driving performance differently. We still can glean insights from the first-party data, the performance data, and the analytics that we have around that within our own HIPAA compliance systems. We derive insights, and we’re able to inform our strategies, but we’ve just got a wall between those HIPAA compliance systems and any advertising platform. We take the insight, and we action the insight, but we never share data. 

Ted: Yeah, the lineage is logically there, but technically broken, at the point where the data must be protected. You’ve just described the composable CDP architecture, where we have Snowflake data bricks They’re keeping the data in a key component; a key characteristic is it’s no copy. You’re not allowed to take the data out of the warehouse. Why? Because every time you move data or it’s copied to another system, your risk just doubled. We want to mitigate risk to the lowest point possible. We want to guarantee that a copy of my data is never going to leave the walls of that warehouse. By presenting a view, which you can query upon, draw insights, and take your insights back, do you really need the lineage? No, you just need to know, “Hey, 6,000 people in Seattle are probably going to want to see this out about my pharmaceutical between week one and week three of the next quarter.” That’s it, that’s all you really need. When we have the technology working with us in this way, we can then proceed to bring HIPAA-compliant and pharmaceutical and healthcare to the to the modern era of advertisement. 

Aaron: You touched on something else that’s really critical, too. It is that it’s not sufficient just to have the data in a HIPAA-compliant system. You have to be able to surface insights in a really easy-to-use fashion, so that analysts, strategists, the people who need to derive insights, can do so quickly, efficiently, and with clarity. 

Ted: That’s right. Again, I love the private client idea about Wheelhouse, the pseudonym following me wherever I go, protecting me. If I’m in the warehouse, do I really need to know that my attention metrics were 75% on the New York Times, versus 60% in The Wall Street Journal? I don’t want that in the warehouse. Why does the warehouse need to know that? But, Salesforce Marketing Cloud does. The pseudonym’s the bridge. This person, whoever he is, you don’t need to know their name or address, had this much exposure to your ads, and his attention metrics indicate that he has an affinity to pain medication. What are you going to do with that? That’s amazing. We’re basically taking an old model, think Axiom, think Live Ramp, where they take the demographic sensitive data, slap a pseudonym on it, and then take it and onboard it to the open Internet, and use it for the right purposes. These models are all becoming very similar now.  

Amplitude’s Customer Data Technology

Aaron: Tell me a little bit about Amplitude. That seems very much in line with this. 

Ted: Yeah, it’s what I love about this topic, after spending almost a decade solely focused on the CDP, the customer data platform industry. I began to see that 10 years is a very, very long time for a technology, any technology. Remember, when Tableau was all the rage? Everybody and their dog bought Tableau, but towards the end of Tableau’s reign, before it got purchased, it was running into trouble. It was being called a commodity. Other analytics tools, you run your course. I think the CDP, I don’t think they’ve run their course per se. I still think there’s some goodness in the market ahead of it, but there’s been some very impactful changes along the way. I don’t believe a customer data platform exists as a product; I believe it’s a system. I believe that just storing the data into a single place where it’s protected, whether it’s a warehouse or whether it’s a CDP, it doesn’t matter. I think the storage is step one, but the value isn’t realized until you do steps two, three, and four. You must activate data, you must bring data out of the CDP and use it for your investment in the CDP to become popular.

That’s a long way of saying it’s not just the CDP, it’s about the connections and the integrations to the left and to the right of it. The sources are changing all the time, the omnichannel, as we like to call it. New devices, new techniques, the destinations are getting better. Now there’s AI on places like DSP. So now you don’t have to do AI in the CDP, that changed. A lot of R&D budgets that were committed to AI, people were asking, “Why are you doing that? Why don’t you just do your function?” Because if I take my audiences and give them to Google, or The Trade Desk, they’ll have AI running that will find me the right channel. I don’t need to do it in the CDP. That changed; it came out of nowhere. We didn’t expect that, and so you see this becoming a system, and I see it becoming commoditized.

With Amplitude, that’s the preamble to why I joined. This is a company whose only mission is to make better products, period. It’s a very simple, straightforward mission. Through insights and through understanding that data is chaos, always changing, always coming in and out, applies the governance, we just happened to build the easiest analytics tool to use in the world today. You turn it on, your event definition automatically brings up dashboards and reports, and you’re off to the races. I like that about Amplitude. As we were talking about before, in the lobby there, people nowadays just expect things to work. They just expect to turn on a piece of software, not have to move around a data mart and do some sequel query, they just want to say, “Show me the funnel,” and the software shows you the funnel. Send it to Sally, send it to Rick, send it to Joe. Now we’re all working on the same project. I don’t care how it’s configured, and I don’t care how the data is secured. That’s your job. Let me do my work, my insights. That’s Amplitude. It makes it so easy to look at the data. I always knew that data collection, the most critical aspect of your first-party data strategy, a fast follower to that is data analysis. A lot of CDPs are missing this.

The number one question I got asked as a CDP adviser for a decade was, “Hey, so what should I do? What audience should I make?” I’d be like, “I don’t know. You’re the one who’s running the business. What do you think?” We both were like, “Okay, we understand that each of us doesn’t know, but we have to figure out what’s going on.” Introducing analytics, insights, good ideas about where audiences are trending based on behavioral, you should be able to query an analytic system and predict what this person is going to do next to help me define the audience I need. That’s what Amplitude does. It just looks at the analysis, and then it improved right before I joined. It improved because it realized that those analytics change constantly. Ted went on Disney+, watched Star Wars, we showed an ad and it didn’t work, but we also see he’s a football fan. Taylor Swift is about to get together with Kelce, and they’re playing this Thursday on Prime. Take our budget out of Disney and throw it to Amazon. That’s the kind of thing that I want to see, and it’s dynamic. You have literally a week to get your budget over there. We can do that today. Understanding those insights and predicting the next cohort that makes me addressable, I think is what Amplitude does really well through experimentation. We test the data constantly. We’re putting our first-party data tranche through A/B testing, keeping control groups, comparing them with the variants, and seeing if our hypothesis is true. You really have two approaches: do no harm to our marketing or hypothesis. I think we’ll do better if we actually show them this ad, and we can run those with Amplitude. That’s exactly what you need in step one. All the stuff about The Trade Desk and Google, I love that stuff; it’s better for me, but we need some more scientific understanding of our data earlier in the process, and I think Amplitude does that very well.  

Aaron: That’s great, I agree. To clarify, or drill down on this, Amplitude does testing. Are they also running scenario modeling? 

Ted: In a sense. They don’t call it scenario modeling, but they’ll set up an A/B test where they actually lead a user through, what we call, the product. It’s a very broad term. The product can be a website, it can be an app, or any scenario or journey that you can think of, that’s what we mean by the term. We would take them through an A/B test, and we would look at the results and actually put them side by side for easy analysis. 

Aaron: That’s live test with actual users, not predictive and hypothetical?  

Ted: Yes, actual users. That’s a good point, though. I think in the future, our strategy with AI is to incorporate more of the AI and to be more predictive. Right now, we have the ability to predict audiences, what they’ll be made up of and which users, but we’re not linking them to tests. They have to end up into an audience of your choice, but that’s a good idea. Tell it to the founder.  

Aaron: Yeah, sure. How big is Amplitude? 

Ted: 700 people there abouts. We’re still hiring. It’s growing internationally – offices in San Francisco, London, and Singapore, all that you might expect – and picking up. They started off with SMB, very easy to get Amplitude in there. We have a great pricing model where you pay by the drink, very much like the old: start small, grow large. We believe in the product so much. We think it’ll be so sticky that people will come back and just go up to the next tier. We have a good pay as you go tier that brings in companies like startups. We have a special program for African American founders, as an example, that we give different pricing. We believe that everyone should have this tool right at the start of their business, when they’re working out of the garage, just got a grant from their university, or now, a massive enterprise, just sick and tired of having 17,000 different analytics tools running around. You don’t need all that. As of the recent short term, we’ve been selling to the enterprise and we’re over, I believe, about 2,700 customers now, and we have ranges from $1,000s a month to millions a year. The range is through the roof. It’s showing me that this is one of those companies, like a lot of the successful ones, they started off small, and they appealed to the market through good PLG, product led growth. That’s how you get your mark, your product, out there. Let the product do the selling.  

Aaron: What was the genesis of the product? This sounds like the sort of thing that would come from a frustrated marketer or a very observant technologist. 

Ted: Yeah. Getting onboarded at Amplitude was a lot of fun because they go through, “How did we get here?” Two guys out of MIT basically wanted to build app tracking, go into an app and track the app and tell me what’s going on. They realized, “Hey, this is a lot bigger than just tracking performance and seeing who arrived at the app.” We can go much further; we can actually look at the behavior of people and understand what features they like, what should they be using, and tell product departments about that. Saying, your new feature isn’t working well, no one’s clicking on it. Literally at Amplitude, our Slack channels are full every day with, “We just saw our new cohort for the new feature have increased by 40%. It’s time to start new pipeline.” It builds pipeline for you automatically, and it’s stuff that people want. It allows us to do, what we call, place our bets. Our product team will place a bet on a feature that they think will bring better customer experience, leading to better revenue, better value for clients, and then we track it. We are very data-driven in how we look at that and how we evolve our product. That’s how it started, just with apps, but now we’re into experimentation, we’re into web analytics, and so forth and so on. We’ve embedded a CDP, not to be confused with these massive CDPs or warehouses. Our CDPs are fit for use for the analytics and for the testing. I believe that our CDP works in concert in the federated composable architecture very nicely. We’re not trying to become the single source of truth, we know the warehouse is, but we have a spoke, a contributing spoke of data, that the warehouses critically need to understand the chaos.  

Google’s Privacy Sandbox

Aaron: I think that makes a lot of sense. Let’s shift back to another topic we’ve been communicating about for the last few weeks – Google Privacy Sandbox. It seems to have problems. That seems to be almost universally accepted by everyone except Google. What do you think about the viability of the Privacy Sandbox? 

Ted: I mean, in theory, it sounds right. I think the IAB, the other quote that comes to mind, is that they complained that Google wasn’t making it easy to use the Google Privacy Sandbox. Google’s retort was, “Well, it’s not our fault. You didn’t learn it. Learn it, do it. Follow the directions.” We’ve all been in that situation before. You’re complaining that something’s hard.  

Aaron: Particularly with Google. Follow our documentation, which is Byzantine. 

Ted: It’s very confusing. The quote from the IAB, and I’m paraphrasing, was something like, “Can I walk to the airport from my house and get on a plane? Sure, I can. It’s possible, but I’m never going to; I’m going to drive.” Google’s telling us to walk to the airport. That’s how you get this thing working. It was a perfect quote because it speaks to the power that this company has. I don’t think that they fully appreciate how impactful their decisions are that they make on how advertising runs, how data tracking and data governance on the web, in general, is done. The moment that they draw the line and say it’s intuitive enough, or I’ve given you enough information, it’s never good enough for the public. We want more transparency from Google. It hasn’t changed in the, I guess, 24-25 years of its dominance. That’s the biggest problem. Put the technology aside, this company is a black box. 

Aaron: I actually think that’s the biggest problem, and I think that was both UK’s CMA and IAB’s problem with the Privacy Sandbox. What Google has done is said, “We still get all the data. We will feed you little bits of it, based on what we think you should have and not have, but we’ll still have it,” which gives them the opportunity to self-deal and be preferential. They’re a massive corporation, even if led by the best of people, they will just axiomatically act in their own favor because that’s what people tend to do. That’s problematic, and as you said, I think that it must have been developed with complete ignorance of what people outside Google need to do. One of the things that was most compelling about that IAB Tech Lab report was their scenario testing. They tested 45 common use cases for digital advertising, and 43 did not work, and there were two that still worked, that were viable. 

Ted: Interesting. I remember reading that in the article, too. Everybody forgets the internet is first-party data to this company.  

Aaron: That’s exactly right. 

Ted: That’s a first-party data tranche that they have, and they’re going, “Well, since governments don’t want to let us do our thing, we’re going to give you very low fidelity contextual data, and have at it.” Meanwhile, Google Ads hub is going to have the best inventory available on the face of the planet because we will just pseudonymize everybody and say these are people in market for trips to Hawaii, and we will know, without a doubt, that they are. 

Aaron: That is exactly right.  

Ted: The restrictions that were intended to clamp down on the, I’ll say it, monopolistic behavior of this company, only strengthen them. 

Aaron: Yeah, and I actually think that Apple is working to become quite similar to Google in this regard. They started earlier, and they’ve been more customer centric in their approach, but they still have created an ecosystem in which they have massive amounts of first-party data. They have permission from users, they’re, based on my reading, building a DSP. They’re building their own ad ecosystem, and so as this data goes away, is removed from the rest of the ad ecosystem, Apple, if their timing is perfect, would have the ability to come to market and say, “Well, we have quite a high-fidelity marketplace.  

Ted: Yeah, of course they do, and they also own the app store, so they get to decide who gets to compete with them. It’s actually worse than Google.  

Generational Technology Considerations

Aaron: Well, and as you suggested, it is worse, totally worse. It’s much worse as we consider the generational shift as well. You were saying just before we came in here, the prevalence of the mobile phone, and in particular the iPhone, and the way that people so completely depend on it, creates this ecosystem in which you have a captive audience, particularly among younger generations, that you can target. 

Ted: Like I said out there, they just expect these tools to work. I recently said, “Why aren’t I in the whole IoT phase? I need a home pod, so I went, “I pick Apple,” because I’ve got the iPhone. The way you install these, you just hover your iPhone over the home pod, and it just lights up and comes to life, and goes, “Okay, you’re connected. What do you want?” I’m like, “Stream KEXP.” Now I’ve got the University station playing rock music all day. It’s awesome. My MacBook is synced with it, and it was so easy, and I remember when this was super hard. It wasn’t even possible, constantly breaking down. I’m thinking of the next generation they just expect this. The kids being born today, can you imagine what they’re going to have for the home IoT devices? They’ll just be talking out loud to themselves, and lights will be turning off and on, and refrigerators will be starting up and down. It’s amazing, and it’s one company owns all that. Well, actually two. Google, and you can invest in a Nest, that too.

These tools, they have more customer data, they have more insights on us. We’re really reliant on the companies and the corporations responsibility to preserve our privacy, and it shouldn’t be that way. I appreciate Tim Cook, not giving the passcode to the iPhone for people who are accused of breaking the law. “No, you can’t do that. I need an affidavit,” but it’s crazy. You should not have to call the CEO of a technology company to get around the law, it should just be the law. We have a long way to go as a society to get that ingrained. I said to you in the lobby, all society has left now is their data. That’s the only currency they have there. You’re not going to be able to barter. I’m not going to get rid of my iPhone and move to an Android just because I don’t like something. I’m used to this thing, and it’s very hard to switch. I’m not going to stop using Google, best search engine out there, I love Google.com. Don’t get me wrong, love YouTube, but the only thing I have left is my data to give them to govern. I should be able to control what pieces of my persona go to whom, and I should be able to say how far they should use it and for what purpose, and I should be able to report upon it, so it’s my responsibility. I think that’s where the industry is heading. 

Aaron: Well, it seems to me that there are two things that need to converge. One, is greater literacy and greater education around what you need to do, what you need to be thoughtful about, with regard to your data. But, that needs to converge with the ability to understand, interact with, and govern the way your data is used that is much easier and less complex than exists today. You have to have a high degree of sophistication and invest a lot of time to attempt to discover, master, and control your data today. If we think about those younger generations, they expect to be able to do this in a really easy way, using a straightforward utility, and have that be pervasive in a fashion that just doesn’t exist. 

Ted: It’s true, and that’s why I appreciate organizations like the IAB and OneTrust and the IAPP. All of these organizations work together to provide the genesis of this law, of the state of privacy law, in easy-to-understand lexicon. My kids have no idea what a DSP is. If they were in the room here right now, they’d be bored. They don’t understand what we’re talking about, but they do get that Facebook needs their data, so they can have the service for free. Same with Snapchat, same with TikTok. They do get that they watched a video on TikTok and then two seconds later, while looking at a new site, an ad appeared for that. They get it, that they’re talking. So, talk to them in that manner, none of the legalese, nothing like that. Privacy preferences, the way we present what we call the value exchange to a consumer, needs to radically change. Some brands are doing very well, right now, explaining what where your data goes. “I’ll be showing you ads on your favorite news sites.” It’s all you need to say. Don’t tell them what a DSP RTB SSP handshake is. They don’t get it. That legalese allows me to turn on all the DSPs, and that’s where I think privacy regulators have gone too far, they’re stepping too hard down on that weight. The IAB is correct. You don’t need to consent to every single display, DMP DSP. You just need an overarching governed lexicon to express my intent for my data. Well, I think we’ll get there because I think I have banner fatigue. Every time I go to Europe, I can’t surf the web without getting hit with 16,000 vendors.  

Aaron: Yeah, I feel the same. Well, I think that it makes sense, to me, to begin to think of the impact of privacy regulation and the implications around ad targeting, from a customer experience perspective, as opposed to a regulatory perspective. If as a brand, you’re thinking about the experience that you want your customers and prospects to have, and you instrument to communicate with them in that way, I think you’d take a very different approach than just throwing up a banner that says, “Accept all.” 

Ted: Yeah, it really is. It’s based on the domain that you’re working with. When was the last time you heard people complain about Spotify? We love Spotify. I listened to the podcast with Spotify, all my favorite music, and my friends share stuff. Well, they know so much about you, based on what you’re watching and listening to, the genre of music that you have, and the friends and what they do, it’s kind of like a social network. They’re under the radar. Why? Because their service is so beloved. Then you take a look at Meta. Why is Meta under so much pressure? Why does Facebook get so much shade thrown at it? Well, because of what they did in the election, and what they did with the analytics; that was creepy. People misinforming to the point where the election was impacted, and now other foreign governments, bad actors, are using social platforms to get untruths out there, to get bizarre takes on reality, and Facebook can’t control that. That’s not cool, but it’s the same basis. It’s the same problems. Spotify should be under just as much pressure as Facebook or TikTok. It really depends on how we interact with the platforms that use our data that, in my opinion, judge the level of scrutiny that they achieve. They’re all the same. I don’t let anyone off the hook. My data needs to be controlled in a much better fashion.  

Data Strategies and Advertising in the Age of AI

Aaron: Yeah, I completely agree. What do you think is the future of AI with regard to data science, data strategies, and advertising? 

Ted: Oh, it’s so much fun. We could talk for hours on this like, where’s this going to go? We’re just scraping the beginning of this. I read an article recently on something I follow on LinkedIn about AI, and they were talking about how Chat GPT 4.5 had a better accuracy than 4.0, which totally get that. Chat GPT is getting smarter, newsflash. Then they said the next generation coming back is a cyclical AI. Here’s the analogy. Imagine telling an AI bot to make you an essay on the history of America. Then what happens is the AI, the Chat GPT, will write from left to right, beginning to end. They’re not allowed to push the delete button and correct themselves. That’s how it works today. With the next generation of AI, it’s going to run, create the essay, scrutinize the essay, correct the essay, and improve upon it. That’s what’s coming. I’m like, “Okay, highly intelligent.” Then I said, “What about after that?” After that, the author begins to say, then they’ll start sharing. So one AI bot will compare notes with another LLM that did the same kind of thing, find it on the on a private web or internet, I don’t know, still don’t understand the rights about this. But, they’ll improve and refine their outcomes based on other bots and learn from each other. Networking AI is coming next. Networked AI, where they interact with each other. It follows the same model that, for those of us who have been in tech, we’ve seen this pattern happen with every technology. 

Aaron: We’re working on a project right now that is, what’s called, orchestrated AI. Let’s say in the context, I’ll describe this generally rather than the specific project. Conceptually, this is consistent. You have a program manager, and the program manager is working to develop a website or a set of web pages, and that program manager is the master GPT. Then you have specific custom GPTs for each aspect of the process that is required to build a website. You have requirements definition, you have UX, you have visual design, you have front end development, you have back end development, and each of these sub-AIs are orchestrated by the project manager, spun up until they deliver and the next takes over. That’s possible today. 

Ted: A hierarchical command and control pattern whose evolution is very likely to do what we just described with Chat GPT, to share the outcome with other orchestrators and then come up with a federated, curated, high fidelity set of information that has been vetted and that has been compared. It sounds amazing. When AI starts working with AI, I think that’s the next step. I read a report from Accenture for 2024 on the State of AI; it’s 80 pages long. It’s a great read when you’re on a plane going to the East Coast. I strongly recommend it. I love when Accenture puts this together because they had four different sections of innovation. One of them is they strongly believe in spatial computing. They see that as the future, and they give you a chart on how spatial computing history began, where we are today, and where do they see ourselves going. I remember one of them was, by the end of this decade, we will have a sports league that’s virtual. There won’t be any stadiums. There won’t be any real players. It will all be a figment of AI because if you think about it, the large language models can study the outcomes. We see it in gambling already. How can they predict that the Seahawks are going to lose to the Ravens next week, based on injuries, based on performance in the past? They’re actually right. Look at the odds. The over under is tough to get. The house always wins, which proves that these models are correct. Now take that one step further and actually create the environment where these AIs play. There’s no fraud involved. We don’t know how that game is going to end. We’re just going to put two mathematical models against each other to play. I firmly believe that we will be cheering for athletes that don’t exist. 

Aaron: I had not considered that as an outcome. 

Ted: But, wouldn’t you get the same pleasure from that sporting event? 

Aaron: Probably, and in a real way, it would be much more humane. There would be no injuries. 

Ted: You wouldn’t feel bad if they got suspended or hit because they’re not real. I mean, look how we’ve progressed as a society. We went from meeting with serendipity, our dates, to going to Tinder and jumping right into a relationship, getting married off eHarmony. There’s nothing wrong with that. In fact, today, it’s totally normal to meet people that way. Why not make friends that way? Why not enjoy sports that way, except with AI running it? 

Aaron: All right. This is a fun thought experiment. How does this play out then in our industry? How does it play out in a digital marketing ecosystem or in an advertising ecosystem, if we project forward to this context in which so much of what we do might be avatar based? 

Ted: I see it scaling. I’d like to say that we’re heading into the golden age of marketing, only because I can’t see 50 years into the future. We might just be in the silver stage. As far as I can tell, this is gold. We’re already grappling with the overture of marketing and privacy. We get it now. We’re in trouble; we can’t just show people stuff and take their data. We’ve got to comply with the law, and most of the laws in the regions that I’ve seen around the world are all the same – right to access, right to erasure, right to modification, and consent with basis. We get that part. We’re starting to get over that, the lawyers have gotten involved. We’ve set our first-party data tranches up correctly. Now we know who our customers are, who they should be for acquisition marketing, and we’re moving forward. Once first-party data takes over the entire tranche, like I said, we start off with a little bit, pretty soon everybody’s going to be in a first-party data tranche, for all brands that you care about. When you give the right to share your affinity, your intent, your personalized desires, for the platform you’re under – when I’m on Spotify, I want heavy metal, iTunes, I play that at home with the kids around, so I just want soft rock – you’ll be able to do stuff like that. Meta is going to set up a Metaverse. We kind of chuckle at that right now because it failed miserably in the last three years, but Apple just brought out the VR goggles. They’re heavy, I don’t know if you tried them on.  

Aaron: I haven’t tried them  

Ted: Yeah, it’s going to hurt your head. We can easily see how that’s going to innovate. It’s going to be slick. We’re going to be like Cyclops from the Marvel Universe with glasses on, and it’ll still look cool. We’ll be in a Metaverse at all time; I see that. That’s related to spatial computing. We’ve set the struts for this architecture in first-party data and privacy laws. We have a ways to go, and we’ll get there, but it will usher in all of these new branding opportunities for advertisement, and won’t even be considered invasive. I want to see an advertisement for Chipotle because my AI assistant has seen that I haven’t eaten Mexican in over a month, and very time I eat Mexican, I like the burrito, and Chipotle has got it on sale. They’ll show me an ad while I’m in the Metaverse playing a multimedia game, or whatever you call it, with 1,000 people. Who wouldn’t want to advertise in an environment like that, where your dollars are quantified by AI, which is highly advanced by this time, and doesn’t need to give you a marketing mix model that goes back six months. They’re doing marketing mix models in real time. I see it going like that, and I see advertisers shedding the shade that they’ve been getting lately. Frankly, I see Facebook improving its image. Once we solve how to curate information, we’re already talking about water coloring the AI produced images, we understand the threat of this kind of content, I think it just gets better. I think Meta continues to win its credibility back from society, as it steps forward and works with governments to promote data privacy. At the same time, society becomes more educated. 

Aaron: That’s the critical part. Then in terms of advertising and the roles that brands play, I think that by implication, anything that is mechanical, anything that’s process-driven around advertising or marketing, is subsumed by AI. What you have left is deep strategic expertise, and you have creativity – the ability to be really thoughtful and offer the customer experience you want to create and the way that you communicate that offer. In one sense, it’s almost a regression; it’s back to old school kind of advertising. It’s about the quality of the idea, how sensitive it is to the needs of the consumer, and the creative execution of that item. 

Ted: The content, we can do so much better. Think of all the best commercials you’ve seen and that have been purchased in the upfront season. People paying $17 million to show an ad on the Super Bowl. I’ve wrote a blog about this. I’m fascinated by the Super Bowl because it’s like, “Okay, here’s your chance.” You just spent $10 million alone to get the actor coming onto this advertisement. Now, how are you going to wow us? Some of these commercials are awesome. I won’t go through all the Super Bowl stuff, but content is king. Whether it’s video, whether it goes on which channel, like TikTok, whether it’s user generated content, UGC, that you dynamically respond to – somebody just did a really funny skit on TikTok with your brand, and you didn’t even ask for that. How do you react to that? AI can’t help you there. AI is not going to predict that some person in Orange County is going to go skydiving drinking a Coca Cola, but they can try. When it happens, you still need humans to react to that, so I think brands will be on the lookout for that. Brands will realize that their website, their app, the traditional notion of an owned and operated property, is gone. Really, your brand is not pervasive across the digital ecosystem, the open internet, and you have to be everywhere. You need a federated identity strategy to do so, you need to be compliant with the law, and you need to be ready for the next big content release. 

Impact of Changes on Data Regulation

Aaron: As you talk with brands, as you talk with others in the industry, I know that you may be in sort of a bubble of people who are highly attuned to what’s happening from a regulatory perspective. Is it your sense, though, that out of that, you speak maybe with prospects, that people are paying attention to the degree that they should – that they’re as aware of the impending changes as they should be? 

Ted: I don’t look at that very enthusiastically, honestly, and I don’t say that as an opinion. I look at the fact. Why are marketers “rushing” to deal with the third-party cookie Apocalypse? We’ve been writing about this for five years. When I talk to my peers, people like yourself, we’ve been aware about this stuff for years. We’ve been building software and technology to prepare for it, but I haven’t seen mass adoption. I see a massive tipping point probably going to happen in Q2 this year, when the next chunk of Chrome users loses third-party cookies and attribution falls. It’s going to be a tidal wave, and there’s going to be a lot of “I told you so” all over the place. I don’t have a lot of faith. That’s why there’s innovators and there’s laggards, and there’s not a lot of innovators out there. It’s important to stay in touch with the companies that are building the foundation to be able to react quicker, and that’s what AI is. I look at the Snowflakes, I look at the Databricks of the world, and they’re doing a fantastic thing. They’re setting the stage where we can react to the changing times. What happened with the third-party cookie didn’t need to happen. We could have easily taken charge. The APIs are better than the JavaScript. We could have easily done this five years ago, but marketers had no incentive to do so. They were like, “My job is to show ads, and I’m making a row as of three.” 

Aaron: It’s so much easier to do it this way than to invest in server side.  

Ted: Yeah, and it’s very hard to say, “Sure you made a row as of three, but you could have made it a 4.2, had you gone to the multi-channel and shown a few ads on Amazon.” Instead of constantly Google, Google, Google all the time, go to the open internet with The Trade Desk. “Oh, we need to test that, and that’ll cost money.” It’s interesting. I think some of these jobs do need to be taken over by technology that’s predictive and reactive, and it’ll leave the humans in our society at a better position to get some help with what they see as the compelling reasons for them to change.  

Aaron: I agree. Well, let’s see. A refresh on the OCR guidance last Thursday.  

Ted: Oh, I didn’t hear about this. Tell me about it.  

Aaron: Yeah, it really is just confirmation, for the most part, on a couple of things. One, confirmation that there are limited instances in which you could be a covered entity and collect IP address and it doesn’t rise to the level of PHI, which is kind of an academic allowance, but it has very little practical value, I think, because the instances in which you could collect IP address have to have nothing to do with past, present, or future health, healthcare, or payment for healthcare, which leaves directions, checking a job board, or being an academic researcher and coming to a covered entity’s website. These are the examples that are provided. So technically, you could collect IP address, but practically you really shouldn’t because you have no way of knowing whether someone is there because of a health issue or just to get an address. 

Ted: Well, that’s interesting because I have the app from my doctor, Epic. I don’t know if you have this as well, but it’s called MyChart, MyChart by Epic. When I click on it, it’s awesome. I can say, “Should I be able to take ibuprofen with Aleve? Then a doctor responds via text, and I didn’t have to go to the office. This rocks. There’s also things where I can check my schedule, when’s my next appointment with my doctor, am I seeing a specialist for my knee, that kind of thing. Then there’s, “Here’s your blood results.” Now that’s sensitive. “You have diabetes,” and that’s very personal, or, “You don’t have diabetes.” Nobody can see that, so the IP address is linked to both sensitive and non-sensitive data, and you have to take the lowest common denominator. 

Aaron: Well, you do either that or you need to instrument your site and your systems to collect IP address only in these very limited cases, based on your belief that you really can discern whether someone is there for any other issue related to health and healthcare. The other confirmation was indeed the confirmation of IP address and anything related to symptoms or treatment for healthcare or scheduling an appointment or paying for health care is absolutely PHI. Then there was a footnote that was germane, and that is it is valid and acceptable for some intermediate system, a solution, a technology like a CDP, to de-identify information to be shared with third-party entities that aren’t under BAA.  

Ted: So, there’s a notion of cleansing the data and aggregating it. 

Aaron: That is explicitly called out in that guidance, so that’s helpful that they explicitly say, “This is absolutely acceptable.” 

Ted: I like that, and it’s kind of like they’re putting on their IAB hat, like this is the HIPAA IAB. They’re saying here are the categories that make up acceptable aggregation: date, city, nothing below the city level, though. If they give the boundaries for that, that opens up a whole new market for healthcare that they can actually learn from this.  

Aaron: Their guidance wasn’t that detailed.  

Ted: I guess we’ll find out when everyone gets sued.  

Aaron: They just described conceptually, de-identification, and that it is acceptable for a CDP or other solution to do that. 

Ted: Okay, it’s going to be open to interpretation. That’s the problem. Legal cases in this country, they largely determine by case laws. I mean, HIPAA-compliant organizations are not going to be incentivized to be the first ones to the gavel. 

Aaron: Well, you have the suits against covered entities, and you also have suits against HHS, related to this guidance. 

Ted: Okay. As long as the HHS gets it, then I have some faith. That’s interesting, so the OCR continues to be a little bit vague. That was the whole reason for the 2022 wrist slap on December, like, “Let us be clear.” Thank you for being clear; you weren’t being clear before. Kind of acting like Google.  

Aaron: Yeah, exactly. Well, this has been great. 

Ted: It’s always great. We could talk for hours.

Related Links

For more information on today’s episode, view the discussed topics below.

Navigating the Impacts of Google’s Privacy Sandbox on Digital Advertising

Clarity for HIPAA Compliance From OCR’s Updated Guidance on Online Tracking

Make sure to subscribe to the Digital Clinic on Spotify, Apple Podcasts, or Amazon Music to stay up to date on our weekly episodes.

Questions or comments

Please let us know if you have questions or comments about this episode by emailing Grace Johnson at grace@wheelhousedmg.com. Want to be a guest on a future episode? Fill out the Be a Guest form at the top of the Digital Clinic page to submit your inquiry.