But today, I wanted to talk to you guys about the value of consent. So first off, I'll get started by talking a little bit about myself.So my name is Melanie Tonneau. I'm the regional director at Sourcepoint Technologies. I'm an expert in data privacy technologies. I've worked at Sourcepoint for almost the last seven years. And what we do is help companies to be compliant with GDPR and other data privacy regulations, across the world. I have worked in, different start up companies in Berlin over the past eleven years, and I've led sales teams, technical account management teams, and also manage very large scale integration, projects. So here's our agenda for today. I'm gonna give you a short history of GDPR and privacy leg legislations. We'll talk a bit about what consent means to users, and the value of consent to the ad tech ecosystem, give a little perspective from publishers, retail, and social media, talk about the evolving trends in privacy and AI, and also talk about the future of consent.

So thanks to Edward Snowden for this quote. The consent of the governed is not consent if it is not informed. Informed consent is really a key theme throughout my presentation, so this was kind of a very relevant quote. So let's talk a bit about GDPR. Some of you may be quite familiar with it. The GDPR is the general data protection regulation. It's one of the most comprehensive data privacy laws, and was enacted in the European Union and came into effect in 2018. The purpose of the law is to give individuals more control over their personal data and to really unify data protection across Europe so each country does not have to, manage their own laws, although they still really do. So GDPR not only applies to companies who are based in Europe, but it also applies to any organization that handles EU residents' data, regardless of where the organization is located.

So you may have seen lots of messaging that looks similar to this if you live in Europe. So since GDPR came into effect, it's really changed how we use the Internet today as many, many messaging, pop up banners, consent messages. They appeared all over the Internet, across websites and apps, and even now connected TVs. These messages allow you to have more knowledge and control about any kind of cookies or trackers, technologies, that are used, and how your personal data is stored, tracked, or shared, or sold for advertising and analytical purposes. You might not realize that there's a system behind these messaging. It's called a consent management platform or CMP. That is what powers these banners. And there is a specifically in Europe, framework called the transparency and consent framework or the TCF, and that is what standardizes the messaging across, Europe specifically when it comes to programmatic advertising.

So you'll notice a lot of the messages have very similar, look and wording. And, actually, as of 2025, about 60% 7% of websites, they'll use some form of consent messaging, although the level of compliance would definitely vary. So GDPR really had a impact globally and inspired other similar data privacy legislations around the world, specifically the California Consumer Privacy Act in 2020, the LGPD in Brazil in 2020, and the DPDB in India in 2023. So all these laws are similar in that they have the same core principles of transparency, consent, and user rights. There's actually no federal law legislation in The US as of today. So each US state has had to enact their own comprehensive privacy law. And, so far, there's been 20 US states who have enacted those, those laws. So this really indicates a general global shift towards, data protection and, regulatory accountability.

You may be familiar already, about cookies and trackers, but in case you're not, here's a a quick review. So cookies, they're small text files. They're stored in your browser. They remember your user preferences, details about your session, and they track you across websites. So that's why if you Google search for something, you're suddenly gonna see advertising for that same thing on another website. But there are also other kinds of tracking technologies, such as pixels or fingerprinting. Session replay, that's gonna record your session and show how, you you interact with the website where you click. So there are all these other kinds of tracking technologies as well that have varying levels of, effect on your user privacy.

So what does this consent mean to you as the user? So the data that is being shared when you provide consent, this is information like your browsing history, your location, your device ID, the type of device you use, any kind of identity data that they know about you, preferences, behavioral signals. And what are you getting in return? Well, you're getting free Internet. In case you thought before that the Internet is free, it definitely is not free. You pay for the Internet with your eyeballs. And by eyeballs, I mean, you're paying for the Internet is being paid for by advertising. So you get free content, access to tools like AI, personalized content, content that's supported by ads, and a really, like, a more seamless platform access. And so what are you giving up in Exchange? This is your anonymity and control of your data and how it's used.

Like, it could be used to train AI models, for example. I'd say that most users don't really fully understand, that this is the exchange when you're using a chat. Also wanted to give you an idea of, like, what happens, in the ad tech ecosystem. So when you provide consent, this actually leads to a very powerful chain of events, that happens all in real time. It's called real time bidding, where data driven decisions are made in order to show you the most relevant content and advertising. So when you provide your consent, that leads to a targeting and optimization process. Different bidders will, bid on a certain ad slot. Let's say, like, a banner, on the side of the website.

If they win that bid, an ad will be personalized to you based on the cookies or information that they know about you. That website is gonna gain ad revenue, because a, an ad was shown. And there might be then the likelihood that you'll see such a relevant ad that you will click on that ad, and you will then go to that page of that company who advertised and maybe buy something or become a customer of theirs. So coming from, like, the publisher or the retail media view, if you have advertising with consent, the pros of this is that you would have access to all the addressable inventory. So this could be any kind of ad slots that are available within, websites or the apps. The CPMs, which is the cost per 1,000 impressions, this is at least five times higher, if not many times more. It's kind of hard to, to calculate actually.

You get much more insights about who your audience are. The personal ad personalized ads increase engagement both with the content and the ads themselves, and therefore, a higher click through rate and conversion rate to actually possibly buying something. Versus advertising without consent, there's a huge loss of data for the advertiser and the website themselves. The users are basically anonymous. The revenue will decline. They'll have to rely more on other platforms like social media. They'll have to use contextual advertising, which is just, you know, you know, we know that you're looking for a shoe. We don't know what kind of shoe. So it would be very, very basic, in terms of how the ad is shown. Some companies choose to use walled gardens.

So this is like a consent or pain model where certain areas of a of a website or app wouldn't be accessible unless you you pay, for that content. And then the first party data that, the website, owns would be much more valuable. And first party data is any data that you have freely given, let's say, when you signed up and create an account, information, your email address, your your age, your location, any information that you have, freely given. And so what about social media? What is collected there, and what is what is that worth? Actually, this meta message, that showed up on my Instagram, back in October 2023, Meta introduced then a pay or a k model, allowing users to pay a monthly fee to avoid, behavior advertising. And me as a more informed user, I had switched off anything I possibly could have for my privacy, and then suddenly I was told I would have to pay €13 a month, to continue to use Instagram, if I didn't wanna see ads.

At the time, I wasn't too interested in that, in that proposition, but it turned out that the European Commission fined Meta for offering this choice. They deemed that it was not compliant with GDPR. Although other, let's say publishers and newspapers have used the pay or okay model extensively, the European Commission felt that is not compliant for large online platforms. This table as well shows the type of data that, social media apps, take about you such as your location data, your contact data, personal data, usage data, but it seems that TikTok puts even deeper data, than other platforms, such as your biometric data, keystroke patterns. So it's just important to be aware when you're using these platforms about what kind of data is is being taken about you. And also to let you know about how much all this advertising is worth in 2025. The digital ad spending is projected to be over $700,000,000,000.

So I'll talk a little bit about AI, which obviously, over I found over the last year has drastically changed how I operate and how I work. AI tools rely heavily on large volumes of personal data to enhance targeting, personalization, and predictive modeling. If they didn't have consent for personal data, they'd really lose their effectiveness. They would have lower audience match rates, less ad personalization, and less ROI for the advertisers. So the accurate consent signals, this really enforces that there's compliance and preserves monetization in the AI driven ad tech. But we need to have consent in AI systems. I think up till now, you know, AI didn't really even ask consent when you, when you gave your, or when they started using and and crawling web sites. So, AI engines, they were trained on personal data. They require consent, to process, infer, or profile individuals.

So AI the other thing it also introduces is more layers of sensitivity. So there's, predictive behavior. They're inferring characteristics about you. They're analyzing emotions. So regulators are now emphasizing you need to have more explicit, more informed, and more granular consent for the different AI, use cases. That transparency and consent framework that I showed you before, this was created back in 2018, although there's been lots of iterations since. But these frameworks, they don't encompass AI and, the use cases of AI yet. So they will need to evolve to address AI and make sure that it is accurately being, consented to. One thing that will impact, the use of AI and consent in the future is the EU AI Act.

And no doubt, there'll be similar, legislations passed in other countries and regions. The EUAI Act, is expected to go to full effect in 2026, but it will be highly encouraged that companies are compliant with it before that. It's the first legislation globally to really classify and regulate AI systems based on risk. So there'll be AI systems deemed at either limited or minimal risk, a high risk, or unacceptable, level of risk. So especially those AI ad tech tools that they're using AI for profiling, behavioral predictions, or emotional recognition, those will be classed in the high risk, category. And if they're in high risk category, they would need to re meet even stricter requirements to be very transparent, to actually have, human oversight and to be accountable.

So that means that we have to be very clear documentation about how those AI models use your personal data. Consent will have to be informed when interacting with AI and it must be auditable. And, individuals must be informed when they're acting interacting with an AI and especially if those decisions, are being made by any types of automated systems. So in general, the future of consent, it's going to be shaped by not just privacy, but also ethical AI design, ensuring fairness, bias mitigation, and explainability in how data is used. So let's, end with the key takeaways. So data is power. Empowerment starts with awareness. You need to know what information that you are giving. Consent needs to be clear and it needs to be informed, and we need to educate ourselves. We need to understand how the attic in ecosystem works.

We need to stay up to date with laws and tech shifts, and we need to know what are