Why privacy measures can cause the monopolisation of online platforms

Third-party cookies have come under increased regulation or outright bans due to growing privacy concerns Image: Shutterstock

Cookies (the internet ones) play an essential role in collecting data on individuals’ online behaviour, but they are now inviting increasing scrutiny and regulations due to privacy concerns. We argue here that the privacy regulations being proposed and implemented can come back to hurt user-interests in a variety of ways by causing a significant increase in the monopoly power of a few online platforms.

Simply put, a cookie provides data on users’ browsing behaviour, retail purchases, and demographic details. It is important to distinguish between two types of cookies: First-party cookies and Third-party cookies. First-party cookies can be used by website hosts to get data on a user’s behaviour on the host’s website(s). Third-party cookies provide user data from other websites as well.

It is these third-party cookies that have come under increased regulation or outright bans due to growing privacy concerns. Examples include the General Data Protection Regulation (EU, 2019), California Consumer Privacy Act (US, 2020), and the new/upcoming default settings of internet browsers like Safari, Firefox, and Google Chrome. However, a ban on third-party cookies can have severe unintended consequences on the concentration of online platforms through effects of this ban on online advertisement markets.

Online advertisement markets

Ad spaces on webpages are usually auctioned off by a website host and the buyers are firms that want to advertise their offerings. When you visit any webpage, it triggers a bid request for ad spaces on the page that you see. Online ad auctions happen extremely fast, almost instantaneously. Both sides—website hosts and advertisers—transact through digital demand-side platforms or DSPs. Google Ads and Facebook Ads Manager are examples of large DSPs, while DoubleClick or MediaMath are relatively smaller DSPs. Potential advertisers pre-specify some metrics that they desire in ad spaces (such as the number of impressions or age group) along with their online advertising budget to these DSPs, who then run algorithms to submit optimal “real-time bids” in response to websites’ bid requests.

Online advertisement auctions are a major source of revenue for multiple internet companies. For instance, over 80 percent of Alphabet’s revenue ($147 billion in 2020) came from Google Ads (CNBC).

Why privacy measures can cause the monopolisation of online platforms

DSPs want to know how likely different users are to click on a particular ad (i.e., users’ click-through rates) to better estimate the value of ad space to the advertisers on their platform. Banning third-party cookies, given that first-party cookies are nearly impossible to ban, creates information asymmetry about ad-space values among the platforms (DSPs) bidding for ad spaces. For example, suppose you do a Google search. Since Google is hosting the site and collecting first-party cookies, Google Ads (as a DSP) knows about your browsing behaviour from the various webpages hosted by Google. But, smaller platforms like MediaMath or DoubleClick won’t have as much data on you. Thus, banning third-party cookies means that larger platforms can have substantially more precise information about the value of an ad space relative to smaller platforms. 

Also read: How has marketing changed over the past half-century?

In such a scenario, smaller platforms can easily fall prey to the winner’s curse, where if they win the auction for an ad space they end up making a loss due to overestimating the value of the ad. To see why, note that if a small platform beats a large platform’s bid for an ad when the latter had more precise information about its value, the small platform may well have overestimated the value. This means that with third-party cookies banned and information asymmetry present, smaller platforms should bid extra conservatively or avoid certain auctions altogether, leading to a market concentration in the hands of larger DSPs.

Empirical evidence supports these hypotheses. Alcobendas et al. (2021) find that with privacy measures, the number of bidders falls by seven times and bidding becomes less aggressive. Peukert et al. (2020) show that the GDPR (EU) led to greater market power for larger DSPs with Google emerging as the clear winner. Empirical projections show that a consent-based third-party cookie policy would decrease online ad publisher revenues by 52 percent (Forbes), while a complete ban on third-party cookies would decrease publisher revenue and advertiser surplus by more than half, and many advertisers would exit the market (Johnson, 2013). Companies like Google will continue to benefit from the asymmetric access to first-party cookies, and companies like Facebook will aim to increase the ambit of their platforms’ first-party cookies (Meta, 2022) to avoid the astronomical losses in ad revenue they face otherwise (Vox.com). Meanwhile, smaller DSPs will suffer and might eventually exit the market.

Therefore, banning third-party cookies can cause online ad-market concentration in the hands of the larger DSPs, and the effects may not end there. If advertisers are concentrated within the larger DSPs, individual websites will also have an incentive to join a large DSP to give their advertisers more user data and better targeting using first-party cookies. If both websites and advertisers are concentrated within a few large DSPs, this could mean an extremely unhealthy concentration of control over users’ data and online experience within a few online platforms. Thus, solutions are needed that allow the targeting of customers in a de-identified form and secure environments—an important open question.

Rohit Joshi and Vidhi Shah are MBA (PGP) alumni, and Jeevant Rampal is a faculty in the Economics area of IIM Ahmedabad.