What is GDPR?
The General Data Protection Regulation (GDPR) is a new comprehensive data protection law that updates existing EU laws to strengthen the protection of personal data. It replaces the current patchwork of national data protection laws with a single set of rules, directly enforceable in each EU member state. The GDPR took effect on May 25, 2018.
In response to the GDPR, Dstillery immediately blocks any information that arrives from a device originating from the EU. No EU user data is persisted in Dstillery servers, and Dstillery does not attempt to do any OBA to EU based devices. Dstillery’s general approach is to not collect data from EU data subjects. We block it prior to ingestion to our platform. Prior to May of 2018, Dstillery was not particularly active in the EU and didn’t derive significant revenue from the EU. As such, the recent passing of the GDPR has not had and will not have a financial impact to our business.
1. Which, if any, of your location data collection methods are impacted by GDPR?
Dstillery only collects location data from devices located in the US and Canada.
2. What data collection policy changes are you making in response to GDPR?
All data that is determined to have originated from the EU is prevented from entering our systems.
3. Does this policy differ within the US and Canada? If so, how?
4. Are there any types of data that you are no longer able to collect within the US and Canada? If so, please explain how this will impact/change the way you build your audience segments.
GDPR does not affect Dstillery’s data intake within the US and Canada and therefore has no effect on the company’s audience building capabilities.
5. How do you anticipate GDPR impacting audience sizes? Please provide % estimate.
GDPR does not have an impact on US and Canada audience sizes.
6. How are you collecting data tracking approval from consumers in response to GDPR? Is this a new process? Is this being done in the US and Canada?
The GDPR imposes a strict opt-in consent standard for processing precise location data. We don't anticipate a similar ruleset to be released in the U.S. at any time in the near future. Under the Digital Advertising Alliance Code in the U.S. and Canada, companies that seek to use precise location for ad targeting purposes must obtain reasonable assurances that upstream partners have obtained user consent. Dstillery obtain such assurances from our upstream partners in accordance with the DAA Codes.
7. If you have a measurement offering, please explain how GDPR will impact that capability.
Not applicable to Dstillery. We will not collect data on EU data subjects on the platform. All of Dstillery’s offerings are unaffected by the GDPR, as Dstillery does not leverage any data determined to have originated from devices located in the EU.
8. If we syndicate European audiences to another delivery platform does the onus shift to the delivery platform or is Dstillery still liable as they built the audiences?
There is potential liability, so we are avoiding any situations where we could potentially capture/use known EU data or be seen in a position to question whether we are. We do not do any manner of audience building using data from devices in Europe.
9. Can Dstillery deliver in Europe if we use a 3rd party platform and 3rd party audiences?
10. Are EU visitors to the US and Canada or EU citizens living in the US or Canada impacted by GDPR?
EU data subjects who happen to be visiting the US and Canada are generally subject to US and Canada law. As a practical matter, the only way we can ascertain jurisdiction is by an IP address lookup and/or lat/long passed to us via partners.
If you have additional questions, contact us here.