Navigating 3rd Party Data Challenges: Ensuring Quality and Compliance

{}Introduction

Jake Litke: Hello, welcome everyone to Cannabis Marketing Live, I am Jake Litke, the CEO of MediaJel, I am your host today, and we have a returning guest, may be our most frequent guest now, three-timer.

Matt Taverna: Three-timer.

Jake Litke: Well, we'll start to do it like SNL, where you get the jacket.

Matt Taverna: Get right on it.

Jake Litke: But we're here, and we have Matt again, because we're going to be talking more about data — we have topics we cover, but it's a complex subject, so we're doing more of these to get into more detail. Today we're going to be talking about navigating third-party data, how to use it, how not to use it, what the different categories are. For those of you who haven't joined us before, Matt, maybe you could do a quick bio about yourself, and why you have context to give here about third-party data.

Matt Taverna: Sure, yeah, Matt Taverna, principal at Statera Solutions, we are a data company and data solutions company, we build a national consumer file of over 260 million Americans, that compiles every American adult, and we do analytics based on certain demographics we've attached to that file, and make it available for data matching and audience creation and marketing. We have integrations with a few different cannabis tech companies, but first and foremost, our relationship with MediaJel, where our data is activated for display and CTV and other digital ads.

Jake Litke: Great, thank you for that.

First-Party vs. Second-Party vs. Third-Party Data

Jake Litke: Okay, so let's dive into it right away, I think it's always good to lay some foundational pieces of information — I know we've gone over this before, but really quickly, give us a definition of first, versus second, versus third-party data, we're going to focus most on third-party data, but that can bleed over.

Matt Taverna: Yeah, so first-party data is data that you, as a customer, own — it's a customer loyalty list, an opted-in text message list, an opted-in email list, and the actions you take on that data are related to the agreement you have with the customer on how you use their data — when they sign up, they check the box for terms and conditions, and that's the license you then have to use that data, usually just remarketing to those customers, and maybe gleaning some things about that customer from what you know.

First-Party Data and the Importance of Consent

Jake Litke: Before you go into second-party, let's mention something about first-party data — there's supposed to be some sort of agreement in place. The most simple version most people would see is if you're doing remarketing off your website visitors, and, to really be doing that compliantly, you need a privacy policy on your website, and, of course, a cookie notification. Then there's more complex things, like maybe you have email addresses, phone numbers — if you didn't actually enter into some sort of agreement, it doesn't have to be complicated, but you really do need to have a record, or at least someone checking a box, agreeing to receive communication from you in the future — just because someone hands you a list of email addresses doesn't necessarily mean you have the legal right to send them messages, that's an important distinction, and we'll get into how that affects other things.

Second-Party Data: Enriching What You Already Know

Matt Taverna: Second-party data is data you'll either append to your first-party data, to know more about that first-party record — if you have Matt Taverna as a customer who's opted into first-party communication, the second-party data would be data you'd buy, or record, or create yourself, that describes Matt Taverna — 42-year-old male, you might append some demographics, some new address information from the National Change of Address service for the US Postal Service, you might attach some of my purchase habits from your point of sale to that customer record — that creates a second-party data element attached to your first-party data. I'd say second-party data trends, for this conversation, more toward the first-party data conversation, because it's a little like the human brain and the human body, the second-party data isn't worth very much without the first-party data attached to it, and vice versa.

Third-Party Data and Levels of Compliance Risk

Matt Taverna: Third-party data is kind of what we're talking about today, where I think the compliance and privacy issues are most prevalent in the discussions — it's data you don't own, and data you purchase from literally a third party. This could be in the form of digital audiences, when you go to serve digital ads, you serve to audiences you don't necessarily have a relationship with, other than that you think they're a prospective customer. It could be, in certain industries, a purchased mailing list you mail your direct mailer to, or, in certain industries, a phone list, a list of phone numbers you call through — and, in reverse order, there's probably the most regulation on phone, then mail, then digital, as far as what you can do with third-party data.

Jake Litke: I'd say we can delineate a couple of things — there's utilizing the data, and, as you're saying, there's how you're using the data. So, for example, the lowest threshold is something where you'd buy a third-party audience for digital retargeting, via display advertising — there are thousands of these audiences, dog owners, Democratic voters, a lot of different things you purchase from a third party, and frequently, in that interaction, you never take custody of the actual identity of the audience itself — you go into your buying platform and say, "I want to use this audience," and the advertising exchange does the work around targeting those audiences, and you never take custody of them, so there's much less compliance required there, and you're also not, when doing display advertising, reaching out proactively to someone directly, all you're saying is, of the impressions available, "I want my impression to show up to this particular person." And, for anybody who doesn't understand what "taking custody" means, it literally means you won't be accessing a spreadsheet of columns — first name, last name, address, city, state, zip, phone number, gender, race, age — for digital audiences, in the way they're traditionally created, the end client, the advertiser, does not actually ever have that spreadsheet.

Matt Taverna: Correct, so you have much less compliance risk there, because you don't actually know who the people are, you're just targeting them as a group. This is something commonly done — you'd see a similar thing if you've ever advertised on Facebook or Google, they've got dropdowns, you don't get to know who those people are, you just know they may match some feature you want in your campaign. That's display advertising — the other channels where third-party data is utilized can be for direct outreach, email, phone calls, and text messages, and each of those channels has its own best practices, but also its own set of laws — what you're allowed to do via email versus text versus calling are all very different, and, in some cases, different in different legislative areas, California specifically has the CCPA, a more stringent set of laws, other states are adopting similar ones, you've got CAN-SPAM, CASL, and then there's state-level regulations that regulate the age of the universe you're targeting — this applies to cannabis, alcohol, tobacco, sports wagering, at different levels, because there are also just laws in general about advertising to anyone under 13, and then specific laws around controlled substances or regulated products, and category-specific rules — if you're doing anything with housing, for example, you can't target based on income or ethnicity, because of the Fair Housing Act. So there are a lot of different ways you can run into this, but let's focus mostly on cannabis, since that's the topic here.

Why You Should Never Buy a Third-Party Email List

Jake Litke: Let's go through what you were talking about, email, third-party email.

Matt Taverna: From a legal perspective — again, none of this is meant to be legal advice, we can advise based on our experience — I would never use a third-party email list, ever, and if you're planning on going to a data provider to ask for emails of people you don't know, I'd advise strongly against that, for legal reasons, but also it's a horrible best practice, and a horrible ROI. If you have 100,000 people, and get the email address for those, you're going to get a delivery rate somewhere between 25 and 40%, so you're down to 35,000 emails, and then the actual click-through rate is going to be around 3% of that, so it just dwindles your actual target audience down, and the return on 100,000 emails from a third party is usually less than an average of one conversion, and you will get negative conversions, in addition to those people being upset with your brand — there's a thriving ecosystem of lawyers and law firms that litigate against this type of behavior, and companies that will ban your URL from email platforms, and other parts of ad tech.

Jake Litke: Yeah, there's an active community of lawyers out there that will start writing legal letters, "we received this email, we're not on your list, why did you send it," and if you don't have some way of proving that person opted in, you can find yourself in trouble.

Third-Party Phone Numbers and the Politics Exception

Matt Taverna: So, third-party emails, that's a definite no. Third-party phone numbers — I worked in politics for a long time before I got into cannabis and the other retail work I'm doing, and phone calls remain a really big part of the political data industry, and that's because, out of all the robo-dialing and other laws associated with phone numbers, politicians made it their goal to exclude themselves from those laws. So, for politics, third-party phone numbers work well, there are a couple studies that say they can have that negative conversion Jake talked about, specifically around someone's willingness to give money, or make a commitment to a campaign, to volunteer, but the research also shows that could be overshadowed by the fact that voter turnout is largely enhanced by contact from unsolicited phone calls and texts — but other industries —

Jake Litke: Yeah, I don't know how many dispensaries or brands are calling customers up.

Matt Taverna: Yeah, but I think we can put SMS in the same category, you can't just get — outside of politics, it is inadvisable, at least, and illegal at worst, and against the law, to actually be buying third-party cell phone lists and sending unsolicited text messages, so it's a bad legal practice, a bad business practice, and it's why you should also keep your current SMS lists up to date, because if you start texting many of the wrong people, if you have a list that's two or three years old, and those numbers have gone stale, you could be getting in trouble, because you're now using what would be a third-party phone number on a person you thought you knew, but now don't, because that phone number belongs to someone else.

Jake Litke: There are also thresholds that occur when you're sending, in many platforms — you generally need to keep your unsubscribe rate under a certain threshold when sending texts, so if you grabbed a list of phone numbers you didn't have ownership of, and sent out a bunch of messages that resulted in a large number of unsubscribes, that'll create problems with your texting platform, because they have their own quality levels they need to maintain to keep their connections alive with the carriers. There's a whole separate conversation about 10DLC and short codes and what you can and can't do with text, and I know there's a lot of struggles with that in the cannabis space, and it continues to get worse, but we're not going to dive into that now, maybe a future conversation.

Third-Party Direct Mail

Jake Litke: Let's circle back to third-party audiences — now we're not talking about just phone numbers or emails, we've covered that buying those isn't a good practice necessarily, but let's talk about the ways third-party data is used, and how people see success with it.

Matt Taverna: Yeah, I think the first way is traditional direct mail — third-party direct mail is legal, it's federally legal, legal in every state, there are certain regulations around direct mail, you can't be mailing people misinformation and disinformation, can't be sending pyramid schemes or financial schemes, but that's more related to fraud and crime than the mail itself. So, using third-party data for mail is tried and true, it's a good use of your dollars if you know what you're doing, because it's based on something the United States government has a 250-year history of investment in, residential addresses and the Postal Service, it's a very accurate way of reaching the person you want to reach, if they'll read the mail.

Building Digital Audiences: Geo-Retargeting and Purchaser Data

Matt Taverna: And then the last is creation of digital audiences, and there are kind of two ways this is done, at least from the work Statera does with MediaJel and other digital advertising agencies — there's third-party data that lives in digital data marketplaces, and, Jake, do you want to talk about how those audiences are created and displayed?

Jake Litke: Yeah, so there are a few different broad categories we use — we use audiences every day for our advertisers, serving millions of impressions, so a lot of different tactics depending on what you're doing. The larger, more obvious categories, I'd say, are geospatial retargeting — we have the ability to draw polygons or circles based on locations where mobile devices have been seen in the past, the on-the-nose version of this is we have every dispensary in the country geofenced, so we can build an audience of devices seen at a dispensary, and then target them with ads. Here's an example of no one having custody of this information — the data itself is aggregated from thousands of applications where users have opted in to share their location information anonymously, when we set up the campaign we say, "these are dispensary visitors," or yoga studio visitors, or whatever specific retail locations you want. That's Geo retargeting, rather than what a lot of people call "geofencing," just for clarification, usually geofencing refers to where the ad is being served at the time of impression, "I want to serve ads in a 10-mile radius around my retail location," that's a geofence, versus a historical Geo audience, where someone was seen in the past. Another common one is purchasers — there's data available from companies like New Frontier Data, among others, where they have anonymized audiences of people who've purchased vapes, or CBD products, or edibles, by category, and if you're running a campaign, launching a new edible line, you can serve impressions to people who've purchased those products in the past. The other large category, and we do a lot of this with Statera, is the demographic stuff we talked about earlier, targeting people of a specific income range, or with specific interests.

Probabilistic vs. Deterministic Data

Jake Litke: One of the downsides to anonymous third-party audiences is that, frequently, you have no idea where that data came from — you can go into any demand media platform and buy ads, pick an audience that says "these are dog lovers," but generally there's nothing underneath that to understand where they got that data from. If you're working with some specific companies, it's good to understand where the data came from, and how they came up with those numbers — one of the reasons we partnered with Statera is they have all this demographic information, and maybe you can talk about how that data gets built.

Matt Taverna: Yeah, I think what Jake is making is the distinction between what's called probabilistic data, based on probabilities of someone being, say, a dog lover, versus deterministic data, which is a known piece of information about someone. In the case of a known cannabis purchaser list, that New Frontier and others produce, that piece of known data is a deterministic data point, even if it's a third-party list — even if you don't know this person, you at least know they bought cannabis, you're going to advertise to them compliantly. On your first-party data, that's absolutely a deterministic data point, you can even have a SKU number attached to that. But for the majority of digital audiences on data marketplaces and in DSPs, most of that data is based on probabilistic data, or modeled data, compiled with certain behaviors or indicators an ad tech company would know about someone — this information comes from things like surveys, if you fill out a warranty card, a lot of that data is sold on open marketplaces from data brokers, if you use your CVS card or those loyalty programs, that data is sold, not in a nefarious way, in ways that can enhance consumer brands — if I shop somewhere frequently, the model data is that I have a propensity to shop there, but it might not be based on my known visits. All that model data gets put into audiences available to target online. What Statera does is a little different — we base our targeting on known elements about people we have on that big database, we ingest a lot of purchaser data, we do really robust surveys that are always in field, creating those data elements, and we also do heavy scraping and acquisition of government data sets that tell all sorts of demographic information on individuals, which can be used, in certain use cases, for compliance and targeting of those individuals. And then, like I mentioned at the beginning of the call, there's a spreadsheet at some point — Statera acts as a third-party processor, but we actually have that spreadsheet of targets, with certain identifiers and IDs, that can sync up to software like MediaJel's ad tech, that can be served to that deterministic audience — and we sit on an identity graph that's able to make that sync from our offline data set to the online data set, in a way that cuts through some of the black box around other audience building.

From CRM Data to Addressable Audience: A Round Trip

Jake Litke: Let's walk through a scenario, because your data set can translate into different categories — I'll give you an example of a full chain: one of the things we can do now is take your CRM data, your customer data — let's say you've got a list of 10,000 emails that are your customers of your dispensary or retail location — you can onboard that into a platform, and it can take the email addresses and hash them into something encrypted and anonymized. That hash value can then go — and that's your first-party data at this point, but now we're going to send it to a third party, in this case, Statera — those hashed email addresses turn into an addressable audience you could retarget ads to, on phones, while people are reading the news or playing games. So that's a round trip, where you, as the advertiser or customer owner, never took possession of that information, that happened in a clean room, inside Statera's data warehouse, which sends an anonymized audience to your advertising provider, in this case us, and then we're able to serve ads to them.

Lookalike Audiences Explained

Jake Litke: Another use case is taking that same original CRM data, putting it into the identity graph, and getting a lookalike audience — what happens in that transaction is, because those identities can be measured across all the demographic scoring, age, gender, there's like 500 of these things, you can say, "these are people in my market buying my products, I want you to return me a list of other people in that same market who are not my current customers, but also have, let's say, a 95% scoring rate in terms of the characteristics of the people purchasing things."

Matt Taverna: Which is, in the dumbest version possible, like if you have a certain SKU you want to sell more of, you can look at that SKU, and see your customer list of the 30,000 people who bought it in the past six months, and see what they all have in common — I'm just looking at Jake, and let's run the cliché, these are all 40-year-old men, most of the people that buy the SKU are 40-year-old men, and those are your known customers. So then you'd take that list, and, through much more sophisticated analysis than I just gave, the ad tech company running your ad could not only target your current customer list, but find all the other 40-year-old men living near your dispensary, or near another retailer that has your brand on their shelves — a lookalike model is looking like your customer, using first-party data to create what is a third-party data element, expanding your prospective customer base.

Jake Litke: Great, thank you for that — I do want to mention, for those of you on Zoom, there's a Q&A section, if you have questions for Matt, feel free to type those in, and we'll get to those in a few minutes. All right, let's see what our next topic is.

Age Verification and Cannabis Compliance

Matt Taverna: I think, if you want to shift to the compliance around cannabis specifically, and how data plays heavily into that — taking our example, you've noticed you want to target a certain group of prospective customers because they look like your current customers, you want to make sure that when targeting the new group, you're complying with your state's regulations around advertising in cannabis, which, for what we're talking about with demographics and third-party data, is really about age, number one, but also concerns geography, because of the "no advertising in school zones" thing, and a lot of state regulations aren't prescriptive on what that truly means, so I'll dive into ways we've solved that, and what can be done.

Jake Litke: Sounds good, go for it.

Matt Taverna: So, we compile age data from government sources, from testing we do, from different third-party brokers we work with, to make sure we're only cutting lists that contain individuals over the age of 21, who can be compliantly advertised to for cannabis, and, because of the identifiers we have, we make sure to have a one-to-one link from our identifier to the digital identifier, so the intent is that we're only advertising to people who are 21-plus. This is important because, going back to what Jake was talking about with digital audience creation, and the black box that surrounds that audience creation — if a digital audience has an age of 21, there's really no great way to know, in a deterministic way, how that audience was assigned that age. There are algorithms that assign age, indicators that assign age, but there's no deterministic data element, a government source, a tested source, or survey source, that goes back to why that person was assigned that age — at least, not one that you can see, and not one you'll have ready access to if a state regulator asks about your advertising. That's a data practice I — shamelessly being salesy here — we built our entire cannabis data practice on, it's one that's near and dear to my heart as a policy matter, I worked on data policy and age data policy for a while in tobacco control.

The History of LDA and Publisher-Based Compliance

Jake Litke: A lot of people probably aren't aware, unless you're deep in the weeds of the advertising industry and its history — a lot of the ways advertisers would say, because there's something called LDA, widely used, legal drinking age, this predates cannabis being legal at all, used a lot by the alcohol industry, and other categories not supposed to be targeted towards children — largely, that effort was being done by the publishers, meaning the TV network, the website, determining that their audience was a certain makeup, mostly adults, and some of this would be as simplistic as, "this is a website with content children generally aren't interested in, so they're not going to be here" — that's, in some cases, as far as that compliance went. Traditionally, when you go into a digital media buying platform, some of those things still exist, the IAB has categories, health and wellness, alternative medicine, which sometimes cannabis falls into, cigars, which encompasses tobacco, alcohol, and others — but largely what's happened is publishers have said, "this is my audience, mostly over 21, so you're safe to advertise, assuming we accept your ads" — and, with the amount of legislation around cannabis, relying on that as your compliance protection layer is just not good enough anymore, especially with states like New York wanting 90% of your audience to be 21 or over, there aren't many ways a publisher can actually verify that's true. So, while there hasn't been a lot of litigation or fines levied to date, mostly because I think state boards are busy doing other things, it's a potential risk to you as an organization.

Matt Taverna: I think it's even a little more real than that — the risk of fines and regulators coming after you is real, that's first and foremost as a business and legal practice, but there's something a little more existential — if you think about the hundred-year history of consumer products in the United States, there's a debate over whether cannabis should be inviting federal legislation and regulation, do we want that or not, in certain areas — once we're inviting federal oversight, once the market matures, the scrutiny against products and how they're advertised is going to be greater and greater.

Lessons From Tobacco and Vape Regulation

Matt Taverna: If you look at the hundred-year history of consumer products, it's based in alcohol, tobacco, vapes, all had their moments of real doom for those industries at certain times. The regulation around alcohol was largely self-regulated, strict laws from the end of Prohibition to probably the late '80s, early '90s, alcohol wasn't advertised on TV, self-regulated because they were terrified of Prohibition coming back. And you have these cigarette laws, I worked in tobacco control the first part of my career, that were reactive from the federal and state governments, a lot based on lawsuits, and it's essentially put the cigarette industry out of business in the United States, at least a shell of its former self. In a speed-reading way, the same thing happened to vapes, at least the mainstream nicotine vape brands, in the past five years, from a booming industry to a pariah.

The Cautionary Tale of Text Message Subscriptions

Jake Litke: As you mentioned earlier, a lot of the advertising regulations, as we call them, are really put in place by the advertising industry itself, proactively, saying, "we understand the risks, and what we should and shouldn't be doing, and we're enforcing that as an industry," so the federal or state governments don't need to come in and start creating laws, because they're not domain experts, and they largely overreach — like what happened in California, a bill was passed intended to protect minors from advertising deemed targeted at children, some of this coming from brands like Cookies, but the net effect, the way it was written, basically banned any cannabis company from putting any photos or illustrations in ads at all, which is overreach, and that's what happens when people who aren't domain experts try to write laws around a business category. I'll give you an example, coming back to text messaging, where there's an entire category of product that just doesn't exist anymore — in the mid-2000s, you used to be able to subscribe to things via text message, it would show up on your carrier, "subscribe to 88888 or whatever it was."

Matt Taverna: Crazy Frog ringtone.

Jake Litke: Yeah, so, what was happening is marketers were selling largely content at the time, ringtones and wallpapers, subscriptions, and they were targeting those subscriptions to children, who were signing up on their parents' cell phone bill, creating a $10-a-month subscription that was largely going unnoticed, because you weren't just opting into the subscription, you're opting into a monthly bill, $9.99, $5.99, whatever it was — games, remember the interactive emojis on a Samsung phone — you'd just get it showing up as a line item, "here's your unlimited calling, here's your text messaging plan," it just kind of was in there. There were, I think, six state attorneys general that banded together and sued all the companies doing this, I forget the names, but they all got sued completely out of existence, and there was a long court case, but the eventual thing that happened is nobody subscribes to things on their cell phone bills anymore, that's done, because it was abused so much.

Matt Taverna: So, there's 50 states, it only takes one or a handful of state AGs to decide they want to go after something, and it can make everyone's life a lot more difficult if we're not proactive as an industry.

School Zone Exclusions

Jake Litke: Yeah, and so we've actually put a couple other best practices in place — I said earlier there's rules around advertising in school zones, but state regs don't really make it clear whether that means you can't mail into a school zone, or put a digital ad into a school zone, even if it's a residential home. We partnered with Niche, which does school rankings and reviews, to use their location data on schools, to exclude homes that border schools, and also within a thousand feet of a school — and that's something not prescribed in state regulation, but the more we, as an industry, do these things to lead the way in compliance, the more we can be at the table when the feds come knocking, because we'll have set the tone for what regulation should look like, hand in hand with state regulators, rather than being chopped up at the table, having our advertising rights and free speech limited because people say we were bad actors.

Leading the Industry on Compliance Before Regulators Do

Matt Taverna: So data governance, data compliance is a huge part of that, largely because we'll have the receipts on what we've done.

Jake Litke: We're just about up on time here, let me see if there are any other topics — I guess, on that note, let's all be good citizens, pay attention to what we're doing, and try to be proactive about using data compliantly, and using data, not just third-party data for targeting, but to make sure we're interacting with adults, the people we should be, in the cannabis industry.

Closing Remarks

Matt Taverna: And, to that end, this is only — I try to end with a sweaty salesman pitch — Statera is offering, between now and MJBiz, a free data quality assessment, we'll look at your first-party data and tell you the number of addresses we could update that are out of date, the number of phone numbers we could update that are out of date, we can help with formatting your lists, help merge lists from multiple CRMs and dedupe them — sales@statera.com, reach out, we'll give you a data quality assessment and help you with these best practices.

Jake Litke: Can you do a data quality assessment on just all the things in my cell phone, like my personal address book, because I think some things are out of date on that.

Matt Taverna: Probably, probably.

Jake Litke: All right, in all seriousness, you can reach out to sales@statera.com if you want to hear more, or get a hold of Matt on LinkedIn, and myself as well, I can be reached on LinkedIn, Jake Litke, and MediaJel, if you want to do compliant digital advertising for cannabis brands, reach out and we can take a look at it. So, appreciate everyone's time today, this has been Cannabis Marketing Live, Matt Taverna of Statera, and Jake Litke, thanks everyone.

Matt Taverna: Thanks everybody.

‍