Journal of Marketing Research Scholarly Insights are produced in partnership with the AMA Doctoral Students SIG – a shared interest network for Marketing PhD students across the world.
The General Data Protection Regulation (GDPR) introduced by the European Union in 2018 marked a pivotal moment in privacy regulation, especially for online advertising practices. A 2024 Journal of Marketing Research study by Pengyuan Wang, Li Jiang, and Jian Yang investigates the early effects of GDPR compliance on display advertising, focusing on a large United States–based publisher with global traffic using a pay-per-click (PPC) model. By analyzing a proprietary dataset containing over 3.7 billion ad impressions across 6,000 ad creatives and multiple industries, the study provides insights into GDPR’s implications for ad performance, revenue, and the potential of contextual targeting as a mitigating strategy.
GDPR requires explicit user consent for personal data usage, fundamentally altering the landscape of behavioral targeting. Pre-implementation forecasts anticipated significant revenue declines, with some predicting annual ad revenue losses of up to 17%.
GDPR Reduced Ad Performance
Wang et al. applied a difference-in-differences (DID) methodology to assess GDPR’s impact, comparing data from EU users (treatment group) with non-EU users (control group) during five-week periods before and after April 18, 2018, when GDPR compliance was adopted. Key metrics analyzed as dependent variables included click-through rates (CTR), conversion rates, bid prices, and revenue per click.
The results revealed moderate but significant declines in ad performance and revenue following GDPR compliance. Revenue per click dropped by 5.7%, primarily due to reduced bid prices and fewer active advertisers. The CTR and conversion rates decreased by 2.1% and 5.4%, respectively, signalling diminished user engagement and conversion efficiency. These findings highlight the challenges posed by restricted access to personal data in ad targeting.
Content and Industry Factors
The study identifies content-based targeting as a mitigating factor. Ads contextually aligned with webpage themes, such as sports ads on sports-related pages, were less impacted by the GDPR. Contextual targeting offset approximately 44% of the conversion rate decline and 42% of the revenue-per-click loss caused by the absence of personal data. This underscores the strategic value of content-based targeting as a privacy-compliant alternative, offering a degree of resilience for publishers navigating GDPR’s constraints.
The study also highlights varying impacts across industries. Sectors such as travel and financial services experienced greater performance decline compared to retail and consumer packaged goods (CPG). This disparity reflects differences in reliance on granular audience segmentation, with industries requiring precise targeting (such as travel and finance) being more adversely affected by GDPR’s restrictions.
Despite these declines, the advertiser return on investment (ROI) under the PPC model remained stable. This stability suggests that publishers rather than advertisers endured most of GDPR’s economic effects. Reduced bid prices primarily impacted publisher revenues, while advertisers continued to pay proportional costs per click.
Reduced bid prices primarily impacted publisher revenues, while advertisers continued to pay proportional costs per click.
Through robust analysis and a large real-life dataset, Wang et al. contribute valuable insights at the crossroads of privacy regulations, targeting strategies, and economic outcomes in display advertising. Their findings quantify GDPR’s initial impact and highlight the resilience and adaptability of advertising practices in response to stringent privacy norms. As policymakers and industry professionals navigate the implications of GDPR and similar regulations, this study offers a roadmap for managing challenges and leveraging opportunities in the evolving digital advertising landscape.
For more insights, check out this interview with lead author Pengyuan Wang:
Q: Your paper highlights how a limitation in access to personal data only caused a limited negative impact on ad performance, bid prices, and ad revenue. Do you think personal data in online advertising contexts is overrated by the industry?
A: I don’t think that personal data is overrated by the industry. The entire internet ecosystem and the free content model we all benefit from are, to some extent, built based on online advertising. The efficiency and revenue growth of online advertising have been significantly enhanced by the use of personal data. Personal data acted as a catalyst, not only for online advertising but also for the development of the IT industry.
We have been using personal data for years, and now we are moving toward a more privacy-conscious era to ensure that our personal data is used responsibly and aligns with each user’s preference. This is good and necessary, but it does not eliminate the critical role of personal data in online advertising.
Q: The results of the effect of personal data found in the literature vary significantly in magnitude. Do you find this surprising and why do you think that is?
A: It is not surprising to me. Companies use personal data in different ways. The impact of personal data is highly context-dependent and is affected by factors such as the industry, nature of the advertising campaigns, and the sophistication of the algorithms used to analyze and apply the data.
Q: Your work distinguishes itself from the previous research by using a natural experiment instead of self-reported purchase intentions. Why in your opinion is there such a discrepancy between the self-reported data and actual measures?
A: Both self-reported data and actual measures provide valuable information, and I don’t think one is inherently superior to the other. As for the discrepancy between studies based on self-reported data and actual measures, again, all studies have different contexts, which can significantly affect the outcomes. In addition, there is a fundamental distinction between what people say and do. Privacy, by itself, is important. However, when people need to choose between free content and privacy, there is a trade-off to make. Thus, personally I think self-reported data might tend to overestimate the importance of privacy protection.
Q: The study spans five weeks before and after GDPR compliance. Are there indications of how GDPR’s impact might evolve over a longer period? Do you anticipate that publishers will adopt new strategies as they adapt to the GDPR constraints?
A: During the study period, I did not observe any clear indications of GDPR’s impact evolving over time. I do expect publishers to adopt new strategies gradually, but it takes time for publishers to develop and experiment with these new strategies.
Q: The study notes a decrease in both bid prices and number of active advertisers. Could you discuss the potential implications of this trend for market competitiveness and pricing strategies in online advertising?
A: During the study period, the observed decreases in bid prices and number of active advertisers suggest reduced market competitiveness. This finding suggests that advertisers may be less willing to invest in online advertising when tighter regulations on personal data are implemented. However, I do not think it will always be like this. Online advertising remains a powerful tool, and the industry is evolving too to develop ad strategies that rely less on personal data or to use people’s personal data in ways that still protect privacy. For example, there are papers on how to use data anonymization techniques (such as k-anonymization) for online advertising, which allows for user targeting while protecting individual privacy. Many other approaches such as differential privacy and federated learning are also under development for online advertising. I am confident that online advertising will continue to thrive as the industry adapts to these challenges.
Q: Do you think CPC pricing models are more impacted by limited access to personal data compared to CPM? Could it be inferred that CPA also suffers from a lack of behavioral-based data? In other words, does this impact conversion-based campaigns compared to branding and awareness campaigns? Could that explain why Google has many times delayed the plan for cookie deprecation, given their core business on search ads?
A: The company in this study employed CPC pricing models, so I don’t have data on the impact of GDPR on the CPM model. My conjecture is that stricter regulations would protect user privacy at the cost of ad efficiency. This will also affect CPM models, as it may reduce the likelihood of reaching high-intent buyers with the same number of impressions.
For the CPA model, again, I don’t have data from businesses operating under this model, but I can offer some conjectures. If we define the “A” (action) here as something very close to a purchase, I conjecture that the CPA metric itself might be stable, because CPA represents the value of an action, which should be stable. However, it might be more difficult to perform the action. So CPA might be stable, but the total number of users completing these actions could decrease, ultimately leading to lower revenue. Therefore, I think that companies with CPA models would also see some impact.
As for Google’s decision to delay its plans for cookie deprecation, I cannot comment on their internal business decisions since I don’t have access to this information. That being said, cookies have historically played a significant role in collecting user information and enhancing Google’s advertising efficiency. The delay might reflect the challenges of transitioning away from such a tool while maintaining ad effectiveness.
Q: We often discuss the different approaches taken by Europe and the United States in regulating technology and its impact on innovation and the economy. Do you think GDPR-like regulations stifle or foster innovation?
A: I believe regulations such as GDPR need to be implemented at the right time. In the early stages of the internet and online advertising industries, when companies were still developing ways to leverage personal data to enhance ad efficiency, when they needed to quickly generate revenue and accumulate capital for re-investment, stricter regulations could have hampered growth. For example, if the GDPR was implemented in 2008, it might have stifled innovation and slowed the development of the broader internet economy.
However, by 2018, when GDPR became effective, online advertising reached a certain level of maturity. The industry had accumulated sufficient capital and expertise, allowing companies to bear temporary impacts on revenue and invest in new technologies. This timing provided an opportunity for innovation in privacy-preserving ad strategies such as data anonymization or federated learning.
Therefore, restrictive regulations can hinder innovation if introduced prematurely. When they are applied at the right stage of industry maturity, they could drive the development of creative solutions and ethical practices.
Read the Full Study for Complete Details
Source: Pengyuan Wang, Li Jiang, and Jian Yang (2024), “The Early Impact of GDPR Compliance on Display Advertising: The Case of an Ad Publisher,” Journal of Marketing Research, 61 (1), 70–91. https://doi.org/10.1177/00222437231171848
Go to the Journal of Marketing Research
