Episode 6: Duncan McCall on Protecting Consumer Location Data

Welcome to the Monopoly Report.

The Monopoly Report is dedicated to chronicling and analyzing the impact of antitrust and other regulations on the global advertising economy.

If you are new to the Monopoly Report, you can subscribe to our weekly newsletter at Monopoly Market tv and you can check out all of the Monopoly Report podcasts and leave us a comment or review at our new website, monopolyreportpod.com I'm Alan Chappelle and I'm excited to be taking over the reins here at the Monopoly Report.

Eric was traveling this week.

One piece of housekeeping before we get started.

Ari and I did an emergency pod earlier this week in light of some of the filings in the DOJ AdTech case against Google.

I'm now hearing that there will be a major competition announcement coming out of Europe by the end of November.

So look out for that.

And of course, we'll be covering it here.

In this episode we have Duncan McCall, entrepreneur and former co founder and CEO at PlaceIQ, which is a mobile location intelligence platform.

So welcome to the pod.

Duncan, great to have you here.

Hey Alan, great to be here.

Thanks for having me.

My pleasure.

So I've had the pleasure of working with you in a number of capacities over the years.

We were both on the board, the NAI board for a couple of years and we worked together pretty closely within the Mobile Marketing association where I think you're still on the board of directors, is that right?

Correct?

Yeah, in nine years strong or something like that.

So yeah, it's been a great industry board.

Oh, fantastic.

And before I forget, I like to ask each guest on the Monopoly Report to share a secret or semi secret passion or hobby.

So what you got for me, Duncan?

I have a few, but I think the obvious one is actually I'm become a very passionate spear fisher.

So spear fishing, lifelong fisherman.

And I don't know, probably six years ago, somebody introduced me into spearfishing.

It was one of those weird things that just like, just took hold.

Love fishing, love the ocean.

Never put them together.

It's been fantastic.

So obviously I don't get to do it as much as I'd like because the Long Island Sound here has about 6 inches of visibility and is not very open to spearfishing.

But yeah, whenever we go away, much to my wife chagrin, I'm trying to pack a spear gun and end up near a body of water.

So it's been great.

Well, that's great.

So all those hours that you spent as an entrepreneur, now you've got something else to be occupying your time.

The spear Fish.

Absolutely no problem occupying my time outside of work for sure.

I have family who are from Nicaragua and so I spend a lot of time with them.

By the way, I would invite you check out the Pacific off the coast of Nicaragua or Costa Rica, because the fish in there is pretty good as well, 100%.

I've spent a lot of time in Costa Rica in the last year surfing and fishing.

So I'd like to go further south.

Fantastic.

Okay, so in case folks aren't familiar with place IQ or the precise location space, let's start with an overview.

What is the precise location space and then how does it relate to the larger ads business?

Yeah, no, absolutely.

I think that maybe the simplest way to explain this is this idea of a lot of.

So your audience obviously pre educated.

A lot of folks are familiar with sort of cookie targeting, contextual targeting.

Hey, we understand the websites that consumers visit and we build a profile, right?

You visit sports websites, you're a sports fan, you maybe visit, you know, automotive websites, you're into cars.

Well, the location space leveraged the fact that mobile devices are location aware and often attach the location of the device to an ad request and then subsequently attach it to an app.

And that data was available as well.

So suddenly now, instead of profiling consumers based upon the websites they visit, you can build profiles of consumers based upon the places they visit in the physical world.

So, you know, similar concept, but actually physical visitation.

And now you can essentially target advertising based upon the indicators of physical visitation versus digital visitation.

That's the simplest way to explain it.

No, that makes sense.

And I'm probably preaching to the choir here, but in terms of signal strength, a visit to a website versus a actual physical visit to a particular location, I would imagine the location signal from an advertiser standpoint is just, well, a lot stronger.

100%.

Right.

And there are things that you don't visit on the web that you visit in the physical world.

And to your point, right, Researching a vehicle online is a much lower bar for intent than actually going on a car dealership, going into a Walmart, a target, taking a plane somewhere.

These are indicators of behaviors that are incredibly strong and have a much higher signal to them.

So when this industry sort of came about, yeah, People said, wow, this, this is a new type of targeting and it is a very strong signal of consumer behavior.

So what was that space like when you founded place IQ and how has it evolved over the last decade or so?

Like what were the big use cases as they pertain to the ad space back then?

And what are they today?

Yeah, so you know, when we founded Place iq, actually we, I knew nothing about marketing or advertising, so we didn't found it to be a marketing and advertising company.

We thought there was an opportunity to leverage all this new location data and build an analytical and data company.

And then we end up sort of finding marketing as a, as a use case.

But to your point specifically, much of your audience might remember way back then, we're talking, you know, 2010, 11, 12.

There was no persistent identifier, meaning there was no mobile ad id, no idfa.

So you actually couldn't build behavioral targeting to start with.

It was all about understanding the context of a location in real time and then connecting that with a real time ad request.

Hey, we see a consumer with an ad request, with location.

We've not seen this consumer before, we won't see them again because there's not a persistent id.

But if we understand the context of this location, it's a car dealership, it's a Walmart, right?

It's an airport.

We can attach in real time a more relevant ad.

Then suddenly, you know, one day Apple launched this thing called idfa and you had the mobile ad id, right?

And then you obviously had the Google Android id and you now had the ability to have a persistent identifier.

And that changed the game.

It changed the game because now you could build a behavioral audience.

You could start to say, well, this consumer has been going to golf courses, they've been going to big box retail, they've been traveling.

Okay, I can build a behavioral profile.

The other thing it enabled that was incredible.

That was, you know, a product we built and brought to market was foot traffic attribution.

Because you had a persistent identifier, you could now use the signal of physical visitation as an outcome measure.

Did somebody see an ad on tv, on mobile, on display, and did that mobile device end up going to the dealership, to the quick service restaurant, et cetera.

And then of course, the last thing that enabled was analytics.

So to set aside marketing and advertising and just start to say, well, we can now tell Walmart how busy this store was versus their competitor.

We can tell them all the people that drove past their store and went to their competitor.

So it enabled this entire use case of real world analytics.

So there was a lot of step functions along the way from, you know, very crude, blunt instrument to this new type of industry that had audience targeting, attribution and analytics.

So it's been quite the journey.

So one of the things that I remember from the early days.

And I'm curious if this, this is still a big issue, but you had app publishers who kind of recognized that their inventory would be more valuable if they had a location attached to it.

And so the rumor was that there were a certain number of apps who just sort of made it up and, or just pulled, you know, whatever they could or inferred it from an IP address which isn't always super reliable.

And so how did you guys.

You must have known that this was going on.

And so, like, what was your approach to weeding out the signal from the noise?

So it's polite the way you refer to it there.

You know, spam fraud.

So, you know, in life and in business, you've noticed when something has money attached to it, people will often create that product to get the money, even if it isn't real.

So to your point, when publishers realize that inventory with location was more valuable if they didn't have location, they would just pretend they did and create fraud and spam.

So initially this was quite easy to detect.

Right to your point, you take an IP address and you turn it into a large location.

Pretty easy to be able to detect.

Hey, these things don't look like consumer behavior.

So we built a whole product suite that we used to call Darwin that would weed out spam and fraud.

And without going too far down the rabbit hole, as always, like the financial markets, we would get smarter, then they would get smarter, then we would get smarter.

So this is arms race.

And towards the end of my time there, what the fraudsters were doing was actually taking entire real visitations so they didn't have to pretend and replaying them in the future.

So it was real consumer behavior, but it happened in the past, which is pretty cunning.

So, long story short, many industries where there's this monetary motivation, fraud and spam was created and there was a continual arms race to stamp that stuff out.

I guess that's just the nature of ad tech.

And you've got a new and developing industry and there's just always going to be folks who are looking to game things.

And then your job, I guess, is to weed that out and at least have a certain predictability and reliability in the information that you're providing.

And so in my view, the precise location space has increasingly come under fire for privacy issues.

And one of the reasons is that it's one of the few places where privacy fears have really moved from speculative to real.

And what I mean by that is in other ad settings, it's really hard to quantify how somebody Gets harmed because you know, they got an ad for a Toyota rather than an ad for Mercedes.

But in the location space you're seeing a drumbeat of tangible examples.

You've got, you know, that story where the bishop was outed based upon where they figured out that bishop had been going.

There's an identification of a person in Alabama, which happens to be a place that restricts abortion, and that that device anyway had crossed state lines and gone to a reproductive clinic.

And that information ultimately ended up apparently in the hands of law enforcement.

So I know that was a big preamble here, but I'm curious to know what tangible steps can the precise location space take right now to avoid creating consumer harm?

Yeah, no, and absolutely right.

And I think as you said, this is a very powerful signal and consumers aren't always aware historically, or they weren't aware historically, necessarily opted in because it was more of an opt out than an opt in.

And then to your point, because this was an unregulated space with no rules.

And I think the other dynamic is there wasn't like one or two, you know, we were the first company in the space and you know, often spaces evolve where there's two or three big companies and they, they can get together and do the right thing.

Right.

In this space, suddenly there was like two or three companies and then the next year there was 60 companies because the barrier to entry was very low and you could access the data that was attached to the ad request data very simply.

There wasn't a lot of consumer education or understanding.

So to your point, entities could buy this data or access this data very cheaply.

And that was, you know, the talk with Byron Tower was around the fact that the government realized, and just to give you an example, the government realized for better or for worse, depending on your position, that instead of going and getting a subpoena and trying to go through this painful mechanism to get, you know, a warrant to access geolocation data, they could just buy it from the marketing ecosystem.

That's been happening for a long time.

And it's not just location data.

And something that makes you realize, wow, this whole marketing ecosystem does have this tremendous amount of data leakage to your point.

And we can talk about this in more detail, but what do I think the space could have done, should have done, we tried to do was get together and define a set of self regulation that we all adhered to and really aggressively driven that home, that this is a standard and in an ideal world that would have led to actually some real regulation.

That then would have become a law.

That would have been the best outcome.

Yeah.

You know, one of the things that I think may ultimately save the space is that, you know, the government might be reluctant to impose draconian rules if they are the biggest customer.

And that's sort of a little bit of a challenge, I think for this space.

But one thing that I think, and I'd love your opinion on this, one thing that I think would be really helpful, just as a general rule, I find that the self serve location space where basically any entity who can work with the DSP and who has a few hundred bucks can start creating their own precise location zones, to me that just seems inherently problematic and perhaps not worth the risk.

But I'm curious to know your thoughts.

So, so the topic that you're pulling out there is, is one of this incredible innovation and evolution of technology and how do you play a whack a mole or catch up with the idea of rules and regulations and self regulation.

And you know, the reality is that we operate within a system whereby people try and make money and they try and make money in ways that are legal.

And if you don't have laws or self regulation governing the way folks behave, you're going to end up with a wild west.

And that's exactly what happened with the location space.

And there's certainly been ramifications.

The FTC has gone after various folks, but those ramifications haven't been substantial enough, I think to be able to stamp out that type of behavior.

So you've ended up in this situation whereby there's been a tremendous amount of bad press about the location space and we could talk about whether that's warranted or not.

And then the large companies have started to say hey, we're not going to enable location data to be captured and used in the same way.

So you've ended up, I think with a rather suboptimal outcome in the way that this industry has evolved.

And to your point, the idea that the government is going to be able to coordinate, hey, well we got some use cases for data over here, so we should change laws over here.

My personal observation opinion is I don't think that's going to happen.

The government will always find a way through, you know, through data and signals to do what they're going to do.

So I don't think that will have much of an outcome.

But it's a dynamic space and unclear where it's going to evolve to.

So you've mentioned self reg a couple of times and I know that you have been a pretty huge proponent of self reg.

I mean again, I've worked with you and I a couple of different industry groups really trying to set standards here.

You were one of a handful of CEOs in the location space who pushed to create an industry wide list of sensitive locations with a larger goal of setting up industry wide exclusion lists.

And so you mentioned coachava and I know there's been a couple of ftc, we'll just say enforcement actions again in the location space recently.

It's interesting that they're talking about the output of that is to set up this exclusion list because you were pushing for that at least five years ago.

And I'm just curious, you know, do you think industry has done enough to self regulate in the location space?

And what could industry have done better?

And maybe, you know, for you personally, you know, what button could you push that might have pushed things a little differently?

So do I think the industry has done enough?

No, let's just be clear, let's answer that.

So, so to your point, right, Sensitive locations and maybe just for the audience, right?

What's, what's, what's the concept of sensitive location?

So I give a real example.

I remember very vividly we started the company in Boulder, Colorado and remember we, we actually had a fire in our office and our office had burned down and we were in this like weird rented warehouse space and I'm whiteboarding with my co founder CTO and he's like, hey Duncan, schools, what do we do with schools and hospitals?

And we looked at each other and we're just like, that seems like a really bad idea to track consumers to schools and hospitals.

We said, how about we just don't, we don't have them in the base map.

So then we sat down and we built our own list of things, right?

Places of worship, right?

Cancer centers, Planned Parenthood.

All the things you would imagine that would be indicative of a real world behavior that doesn't really make sense to profile for many, many reasons.

And we said we're not going to do these things.

And it just seemed to us like the right thing to do, the right logical thing.

And then to your point, right, so fast forward some years later and it took, even then it was just blatantly obvious, hey, if we as an industry allow ourselves to profile some of these sensitive locations and sell audiences of people who visited Planned Parenthoods and cancer centers, that seems like a terrible idea that the media is going to pick up and run with.

And not only are they going to report it truthfully, it's going to create this incredibly bad aura around the entire industry.

Understandably.

Right.

That's what the media does with those things.

So at the time we went initially to the MMA that I've been on the board for a long time and said, you know, why don't we build an industry consortium to actually build a list of sensitive places we all agree not to target.

We spent years on that and, you know, didn't really work out.

We went through the NI and we finally got that passed.

Although it was not simple.

But let's be clear, I think it was by then too little, too late, right?

Maybe it was just more too late than too little.

The narrative had caught control that this is incredibly problematic.

So to your point, if I could take a time machine back now and go and see myself and I don't know what, 2013, 14, something like that, and then back to the future moment, shake myself by the shoulders and say, you need to do this, I think what I would have done and the only thing I can imagine is you couldn't have got the 63 companies that were doing whatever the hell they wanted to agree to be self regulated by the NEI or you know, in an ideal world, maybe in reality, no, the way that this, I had observed this had worked successfully is you got to go to the bias, right?

The agencies and the brands and you have to say, hey, you like this whole location targeting stuff, right?

If you do not only buy from, let's say, give the example, companies that have been vetted by the NEI or another industry group that are not targeting these locations, that are following legitimate consent, et cetera, et cetera, if you do not only buy from these, these things, the industry will fail to exist under its current guise and you guys will look bad.

Will look bad.

I think that is the only realistic way.

Go to where the money comes from and educate them.

You cannot buy from companies that are not doing this the right way.

I don't know if that would have worked.

But that again, if you put me in a time machine now and send me back, that's probably my best idea right now.

No, and that makes sense to me because really, even to this day, you know, one of the criteria that agencies are using is are you, are you part of the nei?

Are you part of the larger self regulatory movement?

This is less to do specifically with the precise location space, but like, you know, as you're trying to figure out what you're, you know, what you're vetting criteria are one of Them is participation in some of the industry wide opt out things.

Although I will say probably less so for mobile than for the browser space.

But you know, that's be as it was I think, you know, if we can only get that flux capacitor working and get you back to 2014, I would like another bite if that happens.

There you go.

Probably wouldn't be my first use of a time machine.

I would do other things first but yeah, it'd be on the list.

So I want to turn a little bit to large tech giants and they're making privacy rules mostly with the goal of shoring up their own businesses with the secondary goal perhaps of mollifying legislators.

And I don't want to completely undersell the goal of protecting consumers, but this has been a theme here on the Monopoly report.

Can you walk us through how the concept of having large platforms dictating the rules, which you know sometimes are aligned with state or federal law, sometimes they aren't.

And you know, how do you navigate that as a company trying to work.

Through that and maybe you know, for your audience that what happened in the location space, you know, and I can say with some degree of confidence, Having worked in it for you know, 15 years and looking back now and not being in the space right now.

Right.

So can talk from an unbiased perspective is you had this incredible explosion of God knows how many companies doing things that I think were not illegal but unsavory and unethical to, to a large degree.

You know, all that stuff's been in the, been in the press.

Then what happened, right?

Apple and Google said look, at the end of the day the consumer keeps reading these articles about location data and they're tracking you and all these different things.

And who do they, who do they ultimately blame?

They don't blame, you know, unnamed ad tech company ABC they've never heard of.

They blame Apple and Google.

That's the phone they have in their hand, that's their operating system, that's the share your location button you click, right?

I don't have a relationship with these third party companies.

It's Apple and Google.

So when this space sort of became slightly toxic, rightly and wrongly, however your perspective is Apple and Google said we're going to get the blame for this, we're going to close this thing down.

Right?

So they made it much harder.

It's no longer opt out, it's opt in.

They made it much harder to get access location obviously they shut off the mobile identifier, etc.

Etc.

And you Know, so A, that is not surprising that that makes logical sense and you would do that view of them.

But then, you know, B, I think the other construct is, well, what about these companies defining and writing privacy rules?

And to be clear, right, these are for profit companies.

These companies exist in a system to make money and do returns for their shareholders.

They don't exist to write privacy rules for the good of humanity or the digital ecosystem.

So the idea that we expect them to do that, I think is just invalid and incorrect.

That's not their role, that's not their job.

And they've done that A, because there's been a vacuum of no one else doing it, and B, because of this construct that, look, there has been no federal privacy law that's stepped in and taken place there.

Essentially.

Yeah.

And that's a challenge.

And I agree, your perspective here is really helpful.

It's funny, what came to mind for me was I go back to the adware space where there was a whole bunch of software operating on people's browsers and that software were literally shooting at each other and blowing up operating systems.

And so you had people calling up their isp, saying, hey, how come my computer doesn't work anymore?

And so they blamed the person who made the computer, they blamed their isp, they blamed, I'm sure, Microsoft in there somewhere as the browser company back then.

And so it's a lot of confusion about what happens.

And so there is some value to the market makers stepping in and at least trying to create some semblance of order and safety.

So we've been posting a bunch on LinkedIn over the last few weeks and my goal has been to really get the ad tech business community to define and explain what they mean by privacy.

Because you keep hearing out there, it's like, oh, we're privacy safe, we're the best for privacy, privacy by design, privacy from the ground up, et cetera, et cetera.

And one of the approaches that we keep hearing is this idea of putting consumers in control of their data.

Problem with that is that in my view is it's just really hard for that to scale.

And so now that I filibustered on something, I would love for you to react to it.

Like, what's your, you know, what's your sense of how those types of user empowerment initiatives, you know, how do those work?

The unfulfilled dream of putting consumers in control of their data.

Yeah, so I am a believer in that dream.

I don't know if we'll ever see it.

I remember I You know, I literally wrote a business plan for this in early 2000.

I've never done it, but, but you know, the concept perhaps, and the way I interpret this is the concept that why the hell does this industry exist that tries to cobble together these profiles of what people are interested in, what they buy, what.

And they do it imperfectly, they do it through imperfect device graphs.

And now we target people in cohorts and it's, it's a mess, right?

Instead of hey, Duncan just bought a new car.

Instead of seeing non stop truck ads for a truck I'm never gonna buy, I would love to be able to communicate in a, in a way I control the fact that I just bought a new car, right?

This is a make and model.

And instead of seeing ads for trucks in the future, I want to see ads for accessories for that vehicle, right?

Duncan bought a new spear gun.

I don't want to see, you know, spear gun ads.

I want to see accessories for this.

So the idea that you are advertising across the ecosystem becomes more like your Amazon recommendations versus this kind of mess we have now.

So people, well, that logically makes sense.

So why doesn't that happen?

I think number one is there's always been this myth that, well, paying consumers for their data, not that much money, they don't really care.

I don't think that's valid because you look at companies like ibotta and Fetch, right, Valuable companies, what do they do?

They pay consumers for their data and consumers are happy to take that money and they built, you know, very large businesses from that.

So that doesn't really resonate.

And then you look secondly and you say will maybe the ones right, really created the consumer experience and value prop that, you know, it's just so compelling and your Internet experience has become so much better because it's relevant, meaningful.

So that hasn't really existed, right?

And then you say, well hang on a minute.

Well, Apple, Google, Facebook, Amazon, they all benefit from the fact that this doesn't exist because they have walled gardens where they have many versions of this.

Perfect.

You think of your Amazon recommendations, right?

They're amazing because it knows what you bought.

You think of how good Meta is at advertising.

Everybody thinks they've got the microphone on because the frickin algorithm is just that good.

If the rest of the Internet was like, that would be amazing, but these guys would not like it.

And they have a tremendous amount of power.

And then of course, finally, well, you know, I learned the hard way throughout my career in advertising.

Just because you think you could build a meta better.

Mousetrap doesn't necessarily align with incentive.

So if I was to walk into the buy side and the folks who are using, you know, buying money, using buyers money to buy advertising and say, hey, good, good news everyone, I've got a way for you to manage and spend less money and I'm going to take money out of the ecosystem because it's going to be more effective.

You are going to be misaligned with a big part of the ecosystem.

So I don't know.

But my gut tells me as someone who really is passionate about that concept, there are a number of reasons this hasn't happened.

And I felt when Google was finally going to drop the guillotine on cookies, maybe that would be just enough to push it over because now it would be that much harder to cobble together these profiles.

But that didn't happen.

So I'm optimistic and hopeful maybe someday that will happen.

But I'm not holding my breath.

Yeah, from my perspective, a lot of this just runs heads up into consumer perceptions issues because there's a fair number of consumers who, you know, are closer to the privacy advocate side where they're not going to give you data willingly almost no matter what.

And then there's a, on the, on the other end of the spectrum, there's a number of consumers who, you know, probably don't care enough to actually proactively provide data and they maybe don't mind if you collect it.

And so the question is, is, you know, is there, is there a workable business, a scalable business within that now you and a couple other folks who have been able to make a scalable business.

I, I know the guys at Reclaim, I think are talking about Bill building a similar thing, the guys up in Canada.

So theoretically possible.

It's, it's funny though, I'm not sure it's, it's, it's, it's hard to do in practice.

Yeah, I mean, I don't, maybe it's like flying cars.

Right.

Should exist.

Makes logical sense.

But you know, for some reason it's a lot harder than people think.

Well, we need self driving cars which are actually safe first and then maybe we can get into the Jetsons.

Yep, still holding my breath for that, you know, at scale.

So we'll see.

So Duncan, before I let you go, I mean, what's, what's next for you?

Anything you can share about what you're up to?

Yeah, so I'd been lucky enough to take a sabbatical, do a lot of spear fishing and spend a lot of time on the Pacific coast in Central America.

But yeah, no, as of, you know, a couple months ago, really now thinking about what's next and looking at this space, we've been working with some folks in healthcare, which another very, very interesting space with lots of data, lots of misaligned incentives and, but lots of innovation.

So, yeah, looking at a whole bunch of new things and excited to reengage and get back out there.

So, yeah, well, cool.

We'll definitely have to have you back on as the healthcare stuff emerges because I think that's just such a fascinating area and one that is both ripe for disruption but carries with it a whole bunch of privacy issues, which I really don't think folks have entirely grappled with yet.

Absolutely.

Yeah, it's a fascinating space.

So let's leave it there.

This was a fantastic conversation.

I really appreciate you coming on with me.

Duncan.

We've got a bunch of other fantastic guests coming up on the Monopoly Report podcast over the next few weeks.

We've got Omer Tawakol, CEO of Rembrandt and the former CEO of Blue Kai.

We're going to have David Leduc from the NAI who's going to share his predictions around the privacy landmines the digital ads market will counter in 2025.

My prediction, by the way, is Peter Thiel is going to personally craft a federal privacy law and we've got nothing to worry about.

Well, there you go.

At least we maybe get one.

So please subscribe to the show@monopolierportpod.com or on Spotify, Apple, YouTube, or wherever you listen to your podcasts.

Duncan, thank you so much for being here.

It was my pleasure.

Great.

Thanks so much, Alan.