0:01

1 second

Sonia: Well, this was a private conversation though, right? 

Sharon: No, no, you read the privacy policy.

0:05

5 seconds

This is definitely not a private conversation.

0:08

8 seconds

My next guest is a digital marketing leader. She has led award-winning global campaigns for top brands like Heineken,

0:16

16 seconds

Gillette, Coca-Cola, and now she's the president of IAB Canada, the Interactive Advertising Bureau. I can't wait to get

0:24

24 seconds

her in the car. Let's ask her all of the important questions around cookies,

0:29

29 seconds

around As tech, around real-time bidding. What does it all mean for privacy? I see her right there. Let's get her in the car. Hey, need a ride.

0:37

37 seconds

Let's start off with cookies.

0:39

39 seconds

And not the ones that you eat, of course, the ones that are on your browser and the ones that most companies

0:47

47 seconds

have no idea how to deal with. Do you need ro give notice? Do you need a banner? Can it be on? Can it be off by default? What is a cookie?

0:56

56 seconds

Sonia: Imagine like a tiny little file and every time you visit a website, a tiny little file is given to you. And so that's a first party cookie. But then

1:04

1 minute, 4 seconds

there is the neighbours who are outside and they're kind of watching what's going on in the house and they also have cookies to give you.

1:14

1 minute, 14 seconds

That's a third party cookie. And that's the cookie that is probably a little bit more, I don't know, nosy. Let's just say

1:23

1 minute, 23 seconds

it's the It's the nosy neighbor cookies.

1:26

1 minute, 26 seconds

Sharon: Okay. Must you take them or can you say no thanks, not that flavor?

1:31

1 minute, 31 seconds

Sonia: Well, it's interesting. You may have noticed uh a popup uh coming up. It's it's basically the the world's least fun popup

1:38

1 minute, 38 seconds

Sharon: like these kind of pop popup things. 

Sonia: Um,

1:42

1 minute, 42 seconds

so the popup that you get is basically you swiping right or swiping left

1:50

1 minute, 50 seconds

on how much data you're willing to give this host, right? So like when you go to a website,

1:57

1 minute, 57 seconds

you have a decision to make. Are you going to trust that person or are you not going to trust them? Swipe left, swipe right.

2:03

2 minutes, 3 seconds

Sharon: Trust them with what? So So we talked about, okay, you're given a cookie, but what what does the cookie collect? 

Sonia: So the cookie just I mean a first party

2:11

2 minutes, 11 seconds

cookie is just there to make your life easier right so this is the sweet kind right the one that belongs to a publisher who wants to make your life

2:18

2 minutes, 18 seconds

easier by remembering your login

Sharon: Okay, for those who don't know what you're talking about when you say publisher, what do you mean 

Sonia: So, like let's say that you read the news

2:26

2 minutes, 26 seconds

and you go to your favorite newspaper website that is a publisher okay so any sort of website um you know .com

2:34

2 minutes, 34 seconds

Property or uh any sort of app that you use is basically like a publisher So, think of it that way. And you're going to their house, 

2:42

2 minutes, 42 seconds

So, there is the the kind of cookie that that is there because they want you to feel comfortable in their house and they

2:50

2 minutes, 50 seconds

want you to not have to log in every time, right?

2:53

2 minutes, 53 seconds

And they are wanting to remember what language you speak. And in Canada,

2:58

2 minutes, 58 seconds

that's important. 

Sharon: So, for most consumers, that's convenient. 

Sonia: Totally. Oh, yeah.

3:02

3 minutes, 2 seconds

Sharon: You don't want to keep putting in uh certain information about yourself. You want that website to remember some things about you to make your life a lot more convenient.

3:11

3 minutes, 11 seconds

Sonia: Yeah.

3:12

3 minutes, 12 seconds

Sharon: So that's a good cookie. First party cookie.

3:15

3 minutes, 15 seconds

Sonia: This only collects information on what you've done on that website in my house.

3:19

3 minutes, 19 seconds

So imagine you're at my house and I see what you're doing in my house and that's fairly understandable. 

3:27

3 minutes, 27 seconds

So you're a reasonable person, right? a reasonable five five-year-old would would understand that when you're in their house um you know you're being not

3:36

3 minutes, 36 seconds

watched but that you are being hosted let's just say right the publisher or the website that you're on has these

3:43

3 minutes, 43 seconds

first party cookies to better understand what you're doing in the house 

Sharon: Okay 

Sonia: Right 

Sharon: Then the third party cookies the nosy

3:50

3 minutes, 50 seconds

neighbor what do they collect about you 

Sonia: information about what you have done leading into going into that house

3:59

3 minutes, 59 seconds

as well as what you're doing in the house, right? So that's basically so that they can get a better understanding

4:06

4 minutes, 6 seconds

of who you are by triangulating information. So it's like, oh, I see that uh Sharon just walked from the swimming pool over to the house.

4:16

4 minutes, 16 seconds

Therefore, Sharon is a swimmer.

Sharon: Right.

4:18

4 minutes, 18 seconds

Sonia: And also friends with the person who lives at this house.

Sharon: Okay. 

Sonia: Right. 

Sharon: Okay.

4:23

4 minutes, 23 seconds

Sonia: Oh, Sharon tends to go to this house a lot. She must be good friends with whoever or whatever is going on in that house.

4:30

4 minutes, 30 seconds

Sharon: So, let me ask you a question. The host, the first party host, 

Sonia: Yeah.

4:35

4 minutes, 35 seconds

Sharon: Do they let that third party nosy neighbor into their house? Do they say,

4:41

4 minutes, 41 seconds

"Sure, come and get that all this information about my guests?"

4:45

4 minutes, 45 seconds

Sonia: Yeah. With conditions, right? So, uh so first of all, that third party has to be uh legitimate, right? and not the kind of nosy neighbor that's nefarious. 

Sharon: Okay.

4:56

4 minutes, 56 seconds

Sonia: Right. Or um creating some damage or like you know basically casing the joint.

Sharon:  Okay. Yes.

5:02

5 minutes, 2 seconds

Sonia: Right. So that nosy neighbor um needs to have a like a certain relationship with that house that is you know comfortable

5:10

5 minutes, 10 seconds

and uh and also they have to have a similar or you know sort of like a like an adequate uh privacy policy uh to know

5:19

5 minutes, 19 seconds

that you know it's safe for the guests of that house to be interacting with that nosy neighbor. 

Sharon: And so isn’t  the um

5:27

5 minutes, 27 seconds

the first party, the host that needs to inform the guest that I'm also going to invite all these third party nosy neighbors to our dinner party?

5:36

5 minutes, 36 seconds

Sonia: That's a good idea. Wouldn't you agree? Right.

Sharon: Of course. 

Sonia: Yeah.

5:39

5 minutes, 39 seconds

Sharon: So then how do they do that? How do they inform the guests? Hey, I'm also going to be inviting my nosy neighbors.

5:44

5 minutes, 44 seconds

Sonia: Well, this is where the analogy becomes really, you know, uh quite funny, right? Because it's like a surprise party.

5:51

5 minutes, 51 seconds

Surprise, we have cookies, right? like and so the popup enter the popup. Okay, right 

Sharon: The annoying popup, right? 

Sonia: Which can be shocking, right?

5:59

5 minutes, 59 seconds

When you enter a house, right? So, it's like surprise, we're using cookies. Do you accept? So, you're 

you're notifying the the people, your guests that um there may be some nosy neighbors around,

6:10

6 minutes, 10 seconds

but don't mind them, right? We're cool, right?

6:13

6 minutes, 13 seconds

Sharon: So, are the popups also for the first party cookies or are they just for third party cookies?

6:18

6 minutes, 18 seconds

Sonia: Well, I mean, that's an interesting question. And I think that it depends on what the first party is doing. And if the first party is collecting uh information that falls under, you know,

6:27

6 minutes, 27 seconds

pretty significant first party data or sensitive data, then it's their responsibility really to make that 

known. Right. And to be transparent about that. That's right.

6:36

6 minutes, 36 seconds

Sharon: Are there privacy laws that dictate whether you must provide transparency or it's a nice to have?

6:43

6 minutes, 43 seconds

Sonia: Well, I mean, that brings us to to a a framework that IAB ebuilt out with uh with Europe. So there the first law that

6:50

6 minutes, 50 seconds

came out that really made that abundantly clear was the GDPR which is the the general data protection regulation in Europe. Yeah. And and that

6:59

6 minutes, 59 seconds

one um came out in 2018 and required there to be transparency not only about the fact that um these organizations or

7:07

7 minutes, 7 seconds

the websites were collecting uh data but also what purposes they were using that data for and 

Sharon: so irrespective of whether you're first or third party.

7:15

7 minutes, 15 seconds

Sonia: Correct. 

Sharon: Okay.

7:16

7 minutes, 16 seconds

Sonia: Right. So it was it it was a matter of uh you know and that's where really the popup was born right so that notification there is no

7:24

7 minutes, 24 seconds

other way to notify somebody unless you're using a popup and you know I I'm waiting for the day that there's a new system but that's just not here

7:32

7 minutes, 32 seconds

Sharon: And when we're talking about popup just to be clear we're talking about a cookie banner 

Sonia: It's a cookie banner or it's something that's persistent right so I mean you

7:40

7 minutes, 40 seconds

may find it annoying but uh but it's actually necessary I mean not you but you know the general public might find it annoying, but it's a necessary, you

7:49

7 minutes, 49 seconds

know, evil. And some publications have been able to really do a good job of integrating it into the content or making it so that it's not as annoying.

7:58

7 minutes, 58 seconds

But if the name of the game is transparency, unfortunately, there has to be a level of annoyance there. 

Sharon: It has to be obvious.

8:04

8 minutes, 4 seconds

Sonia: It has to be obvious. And so that's the that's the story behind them. And in Canada,

8:10

8 minutes, 10 seconds

it's less severe than the GDPR requirement. um you know save for Quebec which has recently introduced a

8:19

8 minutes, 19 seconds

regulation called law 25 and law 25 requires you to notify at time of collecting data

Sharon: Setting law 25 aside because that you're

8:28

8 minutes, 28 seconds

right is kind of high stakes now you got to have that cookie banner for the rest of Canada it's not so clear

8:35

8 minutes, 35 seconds

whether you actually need the cookie banner or not what is your take on it

Sonia: The world is now using pop-ups

8:42

8 minutes, 42 seconds

anyways or using cookie banners as some sort of notification for you not to be is almost feeling not nefarious 

8:51

8 minutes, 51 seconds

but it's feeling a little strange if you're not somehow communicating what you're doing. 

Sharon: Um, I've obviously worked with many clients, right?

8:58

8 minutes, 58 seconds

And this conversation always comes up. Well, must we have this banner? Because if we don't need it, we don't want to put it up because we

9:07

9 minutes, 7 seconds

actually want to collect as much information from our customers as we can. And if we put up that banner, well,

9:12

9 minutes, 12 seconds

it gives them the option to opt out and that hurts our business. So, in that situation, what advice would you give to

9:19

9 minutes, 19 seconds

those companies that would prefer not to put them in

Sonia: in Canada currently? rest of Canada, you

9:26

9 minutes, 26 seconds

don't need to have that popup. You don't. However, you need to have prominent placement for somebody to be able to opt out.

9:34

9 minutes, 34 seconds

Sharon: Once the company has this information through cookies or once their nosy neighbors have this information about the guests, what happens next?

9:44

9 minutes, 44 seconds

Sonia: You're looking for a cookie recipe. okay you go to a website and let's say it's a recipes website and that recipe

9:52

9 minutes, 52 seconds

website um you know once you land on the site there's a series of kind of phone calls that go on behind the scenes okay and those phone calls are going to

10:00

10 minutes

servers right so the web page like the .com is making phone calls to a server and that phone call says hey somebody's

10:08

10 minutes, 8 seconds

here looking for uh the cookie recipe can you just bring me the recipe stuff right so pictures, videos whatever it is 

10:16

10 minutes, 16 seconds

Also, the person who's visiting is registered with a cookie that is XYZ and has XYZ in it..

10:23

10 minutes, 23 seconds

So, that phone call goes to an ad server. 

Sharon: Okay.

10:27

10 minutes, 27 seconds

Sonia: And once it's in the ad server, there's a marketplace that happens within a split second. So, it's like an auction.

10:33

10 minutes, 33 seconds

Who of all the advertisers currently looking for an audience on this website or with this cookie is willing to bid on this cookie? And that cookie has information. So that cookie may have,

10:42

10 minutes, 42 seconds

you know, uh so and so is a dog lover or so and so is uh you know, works in the online advertising industry. Uh and or

10:49

10 minutes, 49 seconds

so and so likes to skate in the wintertime. Um and so the highest bidder wins and as the cookie recipe gets

10:56

10 minutes, 56 seconds

loaded the winning advertiser

Sharon:  the highest bidder 

Sonia: the highest bidder appears on the website and that was based on and so that's why when you are downloading a

11:05

11 minutes, 5 seconds

cookie recipe sometimes it's curious that you see an ad for skates or 

Sharon: that you know I like skating.

11:12

11 minutes, 12 seconds

Sonia: I like skating. So and that can feel creepy but it's actually really personalization done done right. Look at it from a very practical perspective. 

11:20

11 minutes, 20 seconds

I go to uh to four different car manufacturing sites within a week.

11:25

11 minutes, 25 seconds

Therefore, I'm probably in the market for a car. I don't think that that's creepy or nefarious. I think 

that's just good business. Knowing who's in the market for a car is really valuable. And

11:33

11 minutes, 33 seconds

it's valuable to me, the buyer, because I want to see new options that I may not have thought of. And the advertiser wants to put an ad in front of somebody

11:41

11 minutes, 41 seconds

who's a like a very like imminent car buyer.

11:43

11 minutes, 43 seconds

Sharon: Sure. That's what advertisement is all about, right? Trying to get to your customer. 

Sonia: I mean, is it following you around? It's, let's say, it's greeting you, right?

11:52

11 minutes, 52 seconds

Or it's it's uh it's it's recording some of some very fundamental like information like sites that you've gone to, but it's against an IP address.

12:02

12 minutes, 2 seconds

It's not against Sharon.

12:03

12 minutes, 3 seconds

Sharon: So, it doesn't know who you are specifically. There's no personally identifiable information. Sonia: No. In the main, no. In the main, no.

12:12

12 minutes, 12 seconds

Right. So where it gets complicated is when it's a first party that is using the third party data and doing matching, right? 

12:20

12 minutes, 20 seconds

So you're getting a much better understanding of your user based on that kind of thing.

12:26

12 minutes, 26 seconds

Sharon: I think if I were to kind of take it back and really think through it, it is the fear that there's all these kind of cookie crumbs that we leave behind,

12:37

12 minutes, 37 seconds

right? And cookies may be collecting some of those crumbs and it's not the whole cookie. They don't know who we are, but they know pieces of us. But

12:45

12 minutes, 45 seconds

it's the potential matching with other information that could reveal a lot more about us and what can be done with that

12:54

12 minutes, 54 seconds

information. And yes, I understand like showing me an advertisement for Dyson,

12:58

12 minutes, 58 seconds

it's not going to hurt me. But then when it is combined with other information about what I've said or what I've seen

13:06

13 minutes, 6 seconds

or where I've gone, that's where you start to think, huh, it's becoming more and more identifiable. And once that is

13:13

13 minutes, 13 seconds

the case, what can be done with that information? But then also, and I know you're a parent as I am as well, like

13:21

13 minutes, 21 seconds

what um manipulative practices may be involved, especially around children and the information that's being collected through cookies of our children.

13:32

13 minutes, 32 seconds

Sonia: This is where it's really important to have general awareness out there, right?

13:36

13 minutes, 36 seconds

And to um to teach media literacy in a more meaningful way than we do. And also for us as individuals to think more carefully about our own data hygiene,

13:45

13 minutes, 45 seconds

right? swapping up your passwords, um,

13:48

13 minutes, 48 seconds

you know, maybe using more than one browser, maybe clearing your cash from from time to time, right? Like there's so there's

Sharon:  not accepting cookies.

13:54

13 minutes, 54 seconds

Sonia: Not accepting cookies. But I can tell you that that you know, nine times out of 10, you're actually grateful and you don't even know it. And the reason why I

14:02

14 minutes, 2 seconds

know that you're grateful is because you have a pretty seamless experience of the online environment. And when that goes away, I mean, you imagine you have to

14:10

14 minutes, 10 seconds

log in to everything again. Do you remember any of your passwords? It's like most people don't.. Right. So, so I think that there's like,

14:17

14 minutes, 17 seconds

you know, and Canada, it's Canada has done such a great job of really leading the charge on balanced regulation. It

14:26

14 minutes, 26 seconds

would be a real shame if in the fall when they reconvene and and talk about,

14:30

14 minutes, 30 seconds

you know, the new C-27, if that came out as being something that doesn't really respect the the balance that we've

14:38

14 minutes, 38 seconds

become so famous for maintaining in Canada with regards to privacy. I think that that's really important.

14:46

14 minutes, 46 seconds

Sharon: Rapid-fire questions. Here we go.

14:48

14 minutes, 48 seconds

Cookies 

Sonia: still. Okay. All right.

14:55

14 minutes, 55 seconds

Sharon: Oh my god. I can't get over this cookie face.