Retail uses tool that makes customers ‘anonymous’, but may come up against LGPD

It is possible to send an advertisement for frozen lasagna to the social network of a customer who buys ham, cheese and pasta every month, even if that customer has not provided his username to the retailer that holds his purchase data. In addition, to know if the strategy was successful, it is possible to map whether the customer who saw the advertisement on the social network went to the store and bought the product. The key to this is the terms of use of loyalty programs. Experts assess, however, that this new market of data sharing for targeted advertising has sensitive points in light of the General Data Protection Law (LGPD).

In Brazil since 2021, the company Live Ramp, listed in the United States, works with data ‘anonymization’, but it does so in a way that allows it to find the same audience in different databases. Among its best-known partners is Carrefour, which has already conducted advertising campaigns with brands such as Heineken, Coca-Cola and Qualy through the platform.

The LGPD requires that companies responsible for customer data do not share sensitive information from their databases, such as names, CPFs or any other information that could identify individuals. Thus, Live Ramp’s business involves making retailers’ data anonymous, which preserves important consumer habits for retailers and their suppliers in advertising campaigns.

The company’s technology transforms sensitive data into an identifying code, making it possible to separate a specific audience based on their purchasing habits: potential customers who buy Heineken beer at Carrefour, for example. The retailer is able to select the audience that buys a specific item, even determining their preference for larger or smaller containers.

Once this group of identifiers is selected, LiveRamp can search for this group of consumers on social media. The secret is that the database of this second platform can be anonymized using the same technology, or identifiers that use the same principle. Therefore, there is a high chance that the IDs selected by the retailer will be found on the social network. In this way, advertising campaigns find selected Carrefour customers outside the brand’s online environment.

This data matching isn’t always perfect, as people can provide different information on different platforms. However, if a customer uses common information like an email address, for example, the data company’s technology will assign it the same ID pattern in both databases.

In Brazil, the CPF ends up being used a lot as a ‘matching point’, because you usually give your CPF for everything in Brazil. What we do is anonymize the databases where they are. We create the ‘Ramp ID’ (company identification code). We take several points of contact and transform them into the ‘Ramp ID’, explains Thaissa Gentil, responsible for the company’s operations in the retail sector in Brazil. She says that this ID is capable of finding the same user through different keys, be it email, CPF or name. The difference is that, when data is shared between companies, this information is hidden under the ID code.

Lawyers specializing in data security, however, warn of a fine line between what the LGPD says and the work of companies in this niche. “If data is anonymized, it cannot be reversed, that is, it is no longer possible to reach the person. If the company somehow manages to reach the client’s page on the social network, there may be a problem,” says Klaus Kiessling, partner at Risk Consulting.

Tertullyano M. Sousa, the lawyer responsible for the privacy and data protection area at MTA Advogados, argues that the moment you anonymize data, but when you cross-reference other information, you can identify a person, this is not anonymization. He believes that it is important that this use is clear, for example, in the terms of use of retailers’ loyalty programs.

This is one of Live Ramp’s legal arguments. Thaissa says that, by agreeing to the terms of use of points programs and providing their CPF when making purchases, for example, customers agree to the use of their data for advertising purposes under these terms. In addition, she argues that information that allows identification, protected by the LGPD, is not shared between companies. Since the data is matched using common anonymous identifiers. In addition, she says that the company works with large audiences, precisely to reduce the chances of identification.

A certain brand wants to reach diaper customers (through advertising). We were able to find 1 million people (with this purchasing characteristic), but not a specific person. Then we put these 1 million people (in the Instagram database) and let’s say we have a ‘match rate’ of 50%. So we found 500 thousand people there?, says Thaissa. She also says that, later, the retailer can find out how many of these customers who received the advertising returned to a store in its chain and bought the product in question within 15 days, since these consumers are identified at the time of purchase by providing their CPF or using loyalty programs in some other way.

In any case, in its latest earnings release in the United States, Live Ramp listed the possibility of a breach of confidentiality among the risks of its international operations. “The risk of a significant breach of the confidentiality of information or the security of our data or that of our customers, suppliers or other partners and/or computer systems could be harmful to our business, reputation and results of operations,” the company states.

For the president of the Brazilian Society of Retail and Consumption (SBVC), Eduardo Terra, this ability to deliver personalized offers in a way that customers actually receive the company’s communication is very important for retail. He points out that, before this, companies need to have an organized database. Through this, it is possible to identify potential buyers of certain products, based on the consumption habits of these customers.

From there, the question was: how to engage this customer? “Giving discounts can be a strategy,” says Terra. However, he explains that retailers have been finding it very difficult to take the next step. “Marketing emails go to spam folders. Sending messages on messaging apps is usually expensive. Therefore, the solution of reaching this customer on social media, which is where people are, makes this advertising more efficient,” he explains. Ultimately, Terra says that this process, which is currently offered by few companies, reduces the cost of customer acquisition, since the campaigns are more effective.