As if we needed more evidence there's a privacy-competition tradeoff
Meta's bad quarter underscores the disproportionality in digital markets, small changes on privacy can have outsized impacts on competition
I know a lot is going on in the world, but I cannot keep my mind away from what happened last month with Meta (Facebook). In one day, 26 percent of its value was erased. It is still a big company, to be sure, but it's still about two-thirds the size.
Leadership was clear about the cause. Apple’s iOS 14.5 software update, which was deployed in June 2021, cost Meta $10 billion. Because of the update, iPhone users now get a popup asking them if the app they just downloaded has their “permission to track you across apps and websites owned by other companies.” Some 80 to 90 percent of users have opted out of this tracking, so Facebook and Instagram aren't able to connect users across the ecosystem. My most recent CGO piece explains why this change has been so devastating for Meta and why it is cratered that company’s ad effectiveness.
I’ve been watching 14.5 unfold over the past year. As I said a year ago, “The biggest threat to Facebook probably isn’t antitrust scrutiny, but the changing ad ecosystem, especially those brought on by iOS 14.5.”
Honestly, though, I still find it somewhat absurd that an app popup has wiped billions from the bottom lines of Facebook and Instagram. But that is the lesson of popups and privacy. Small changes in defaults or limitations in use can have big impacts on revenue, which in turn, alters what competition looks like.
There is a tradeoff between privacy and competition.
As with every piece of writing, some paths weren’t taken, so I have tried to take my analysis a little further here. Also with every piece of writing, I already want to revise it. But only to more fully emphasize the key theme: Privacy changes disproportionally affect small businesses.
Of all the biases in policy-making, proportionality bias is the least talked about but the most pernicious. For whatever reason, there is a tendency among all of us to think large events are caused by large actions and small effects have small causes. In the real world, however, causes and effects are rarely of the same proportions. Small actions can shift the equilibirum.
As one would expect, Eric Benjamin Seufert wrote a phenomenal piece on 14.5's impact on advertisers, explaining why the ad dollars wouldn't simply shift towards other platforms. Yes, some ad buyers did head elsewhere, as I said originally, but the 14.5 update meant that a lot of businesses enabled by Facebook and Instagram are just no longer viable.
Seufert walks through some reasonable but hypothetical numbers for a game app, both before and after the 14.5 change. Let's also assume that this company, following many others online, has a power law for its total lifetime value (LTV) "with 95% of users spending $0 in their lifetimes." This means that there is a skew between the average revenue per user (ARPU) and the average revenue per paid user (ARPPU), which comes from the long right tail.
So what happens once ad personalization declines due to the change? For one, the top-of-funnel marketing metrics lose their precision, so relevant high-value audiences aren't reached as often. The result is that fewer people go through the conversion funnel. At the same time, all of the down-funnel metrics degrade as well. So the entire value distribution shifts and declines, since there aren't as many paying users. ARPU and ARPPU both decrease, and combined, "the underlying economics for the advertiser change in a way that reduces the viability of ad spend."
Seufert's post has all of the details, but one of the lessons he tries to impart from his own experience in the industry is about disproportionality. "If top-of-funnel marketing metrics decrease even slightly, the CPM decrease needed to compensate for the lack of conversion is disproportionately large." Again, using some common numbers in the industry, he was able to show how a 10 percent decline in ad precision had an outsized impact, reducing ad margins by 78 percent. In other words, "if ads are less personalized, not only will fewer users survive the marketing funnel, but those that do will likely monetize to a lesser degree as a result of the loss of precision in targeting."
In other words, ad dollars don’t shift elsewhere because it was the precision that allowed the business to pop up in the first place. Not surprisingly, direct-to-consumer (DTC) brands online, which have typically been small operations, have suffered the most. They use precision ads to build brands. As Mike Faber of Spree said, “The times of independent DTC brands might be coming to a painful end.”
Seufert concludes by stressing that local context matters,
This dynamic obviously most impacts apps that are dependent on high-monetizing users that subsidize non-spenders and low-monetizing users. Apps that have a more balanced distribution of LTVs, with less extreme monetization at the high end, will be less impacted by the loss [due to 14.5] for ads personalization, presumably because they are more broadly appealing and less dependent on reaching very specific segments of users.
In reality, the declines were much steeper than 10 percent. Patrick Coddou, the Founder & CEO at Supply, chronicled on Twitter what his clients were saying about the change:
“...our overall marketing performance has declined by ~40% starting on Monday, 6/21 and continuing through today (6/28)."
"We are heavily reliant on FB, and the results we’re seeing reported in-platform are very, very bad (CPAs skyrocketing up 100%+ what they were a month ago).”
“Nothing is working. We know very well what audiences and creative perform for our brand. We have been doing this for years. We know the problem is on the Facebook side.”
“June has been terrible. Seeing over 60% drop in revenue.”
“Facebook/Instagram Cost Per Acquisition is up triple digits and spend is down 90% from peak in March. Total revenue across the entire business is down 40% from March highs”
"Our store traffic hasn't recovered post-iOS14 updates. It's insane the drop we've seen in the last three months"
"Seriously halted us and sick to my stomach daily. Living the American dream to nothing right now. 5 figure spend daily, to absolutely being off the platform because of it."
"A consistent drop since mid-June with no recovery yet."
"Our revenue is down 40% this month. Went from very stable cash flowing to hemorrhaging $40k+ per month in our projections. We also barely have runway to make the holidays at this pace. Needless to say, I’ve been pretty much living in a panic attack for the last two weeks."
Consumers clearly have shown a preference for limits on tracking across the ecosystem. As I said in my CGO piece, “While Apple has not released official numbers, third-party reports suggested that 80 percent to 95 percent of users were choosing not to be tracked across sites.”
But the changes that came with 14.5 only restrained Apple’s ecosystem, not the wider market. As the blog Transparency Matters explains of the App Tracking Transparency regime, the name for the 14.5 change that affected Meta:
App Tracking Transparency made no difference in the total number of active third-party trackers, and had a minimal impact on the total number of third-party tracking connection attempts. We further confirmed that detailed personal or device data was being sent to trackers in almost all cases.
Taken all together, I read this story as a regulatory fable. It is a tale about the impact of data regulation. It charts out what will happen if the rules change for data collection and dissemination. Everyone desires privacy and wants their data to be secure in the abstract. But this sense of security comes with a real cost. The cost to marketers and online businesses may be unseen by most, but it still exists nonetheless.
In law and policy circles, it is not uncommon for someone to say that privacy laws spark innovation. But the changes brought with 14.5 cuts against this folk theory of the world. There are disproportionate costs. So, the specifics of privacy law are important, especially since changes in data collection have asymmetric impacts on different industries and players within those industries.
As I detailed in my CGO post:
The United Kingdom’s “Online platforms and digital advertising: Market study final report” compiled by The Competition and Markets Authority offers evidence to this effect. In a wide-ranging report, the agency dove into data provided by Google on an internal test that the company ran in 2019. In a head-to-head battle between publishers using personalized and non-personalized advertising, Google found that “UK publishers earned around 70% less revenue when they were unable to sell personalised advertising but competed with others who could.”
But there are many more examples of the broad lesson, helpfully compiled by Jura Liaukonyte in the Twitter thread below. Also, check out Jura Liaukonyte (2021) for a framework to conceptualize the scope of personalized and social commerce.
Indeed, the evidence has piled up. Privacy laws, like the European Union’s GDPR, have lopsided effects. For example:
Garrett Johnson, Scott Shriver, and Samuel Goldberg (2022) found that “after the GDPR’s enforcement, website use of web technology vendors falls by 15% for EU residents.” Smaller vendors were more commonly dropped, which increased the relative concentration of the vendor market by 17 percent. This increased concentration largely came from vendors that use personal data such as cookies, and from the increased relative shares of Facebook and Google-owned vendors. (SSRN)
Johnson, Shriver, and Goldberg (2021) found a “reduction of approximately 12% in both EU user website pageviews and website e-commerce revenue recorded by the platform after the GDPR’s enforcement deadline.” The hardest-hit industries are those with the biggest effects. Larger effects are found in email and display ad marketing channels, specific targets of the GDPR. (SSRN)
Christian Peukert, Stefan Bechtold, Michail Batikas, and Tobias Kretschmer (2022) show that GDPR caused websites to substantially reduce their interactions with web technology providers, even for websites not legally bound by the GDPR. The researchers also documented an increase in market concentration in web technology services after the introduction of the GDPR. Although everyone does worse, Google lost relatively less than everyone else. Unlike others, the company was significantly able to increase its market share in important markets such as advertising and analytics after the privacy regulation and effectively weather the storm. (PubsOnline)
Julia Schmitt, Klaus M. Miller, and Bernd Skiera (2021) analyzed data from 6,286 websites spanning 24 industries during the 10 months before and 18 months after the GDPR’s enforcement in 2018. Their results show “that, on average, the GDPR’s effects on user quantity and usage intensity are negative; e.g., the numbers of total visits to a website decrease by 4.9% and 10% due to GDPR in respectively the short- and long-term.” (Arxiv)
Jian Jia, Ginger Zhe Jin, and Liad Wagman (2021) studies the impact of GDPR on investment in new and emerging technology firms. After GDPR’s rollout, the number of financing rounds for startups decreased. The law could be shown to cause a 26.1% reduction in the number of monthly venture deals by EU ventures compared to their US counterparts. As we should expect from regulation, the negative effects are larger in the 6 months period immediately after GDPR’s rollout in 2018, but some of them are sustained throughout the study time period. (SSRN)
Yu Zhao, Pinar Yildirim, and Pradeep K. Chintagunta (2021) investigates the impact of GDPR on consumers’ online browsing and search behavior using consumer panels from four countries, United Kingdom, Spain, United States, and Brazil. After GDPR, someone exposed to the regulation submits 21.6% more search terms to access information and browses 16.3% more pages to access consumer goods and services compared to someone who hasn’t been exposed to the rule. The paper highlights the friction in online search across the board. But the increased friction doesn’t affect everyone the same or more specifically the effects are heterogeneous across firms: “Bigger e-commerce firms see an increase in consumer traffic and more online transactions. The increase in the number of transactions at large websites is about 6 times the increase experienced by smaller firms. Overall, the post-GDPR online environment may be less competitive for online retailers and may be more difficult for EU consumers to navigate through.” (SSRN)
In a related line of work, Wesley W Koo and Charles E. Eesley (2020) found that, "When platforms like Etsy or Amazon change policies, it disrupts the many entrepreneurs who rely on it. But the effects aren't equal.” Using data from a leading e-commerce platform in China, the researchers found that rural sellers were particularly poor at adjusting to a major design change on a website compared to those in urban areas, resulting in a persistent performance gap. As they conclude, “We attribute these misaligned responses to rural sellers’ lack of local access to rich information. This study shows that sellers’ local heterogeneity generates equivocal responses and carries unintended consequences for platform governance.” (SSRN)
Vilma Todri (2021) analyzes a consumer-level panel data set of online search and purchasing behaviors to investigate the impact of ad-blockers, another kind of information restriction. The paper reveals that “ad-blockers have a significant effect on online purchasing behavior: online consumer spending decreases due to ad-blockers by approximately $14.2 billion per year in total.” As Liaukonyte describes this paper, “ad-blockers lower product discovery – consumers decrease spending on brands that they have not experienced before, shifting spending toward already experienced brands.” (PubsOnline)
These recent papers connect to a line of research going back into the early 2010s. As I wrote in Should the US Adopt the GDPR?, on the eve of its ratification in 2018: “It might take some time to truly understand the impact of GDPR, but the law will surely change the dynamics of countless industries. For example, when the EU adopted the e-Privacy Directive in 2002, Goldfarb and Tucker found that advertising became far less effective. The impact seems to have reverberated throughout the ecosystem as venture capital investment in online news, online advertising, and cloud computing dropped by between 58 to 75 percent. Information restrictions shift consumer choices. In Chile, for example, credit bureaus were forced to stop reporting defaults in 2012, which was found to reduce the costs for most of the poorer defaulters, but raised the costs for non-defaulters. Overall the law lead to a 3.5 percent decrease in lending and reduced aggregate welfare.”
In a reflection of sorts to the Chilean study, Tat Chan, Naser Hamdi, Xiang Hui, and Zhenling Jiang (2021) analyzed a data set covering employment verification inquiries to Equifax and found that the availability of digitally verified data significantly expands credit access. “The loan origination rate increases by 35.5% on average, and is more significant among deep subprime (146%) and subprime consumers (44%). The interest rates charged on these loans rise only slightly. The expanded credit access also benefits lenders, with an estimated 19.6% increase in profit.” (SSRN)
The research is fairly clear that there is a privacy-competition tradeoff. The recent Meta stock drop is just the latest example of that lever in action.
All of this being said, the disproportionate effect doesn’t mean that privacy laws might not be worth it in the end. Seth Godin framed it simply, as he is apt to do. “The art of good decision making is looking forward to and celebrating the tradeoffs, not pretending they don’t exist.” And there is clearly a tradeoff here.
“Digital Advertising in 2022” by Ben Thompson