Advertising Week Q&A: The Hidden Cost of "Yes," with Usercentrics CEO Donna Dror

Every brand I work with wants a yes. Yes to the cookie banner, yes to the loyalty program, yes from the Wall Street Journal. We talk far less about what that yes costs the person giving it, and what it costs the brand when the yes isn't real.

At Advertising Week, Usercentrics shared findings from its State of Digital Trust research, which surveyed 11,000 consumers across seven markets. According to the report, only 29% of people now accept everything just to move on, and 53% actively limit what they share. 57% say risking their personal data is simply part of everyday life. As Usercentrics VP Maureen Prado Roberts put it on stage, "That's not a yes you've earned, that's resignation."

That resignation has a price tag, and increasingly it's literal. In an August op-ed in The New York Times, former FTC chief technologist Stephanie T. Nguyen described how discounts and offers are often calculated from your location, browsing history, and other personal data to estimate what you're willing to pay. She pointed to a former Washington Post reporter who requested his Starbucks data and found that the more often he visited, the fewer discounts he received. Her proposal is a "real price" law: one simple, public price, with discounts allowed below it. It's also one of the rare issues with support from both parties: Senators Richard Blumenthal and Josh Hawley held a hearing on it together, where Hawley noted, "It's working people who are going to be paying more."

But there’s something I find even more interesting: Usercentrics' research found that when a company tells people plainly how it uses AI and gives them a say, half of them say they'd pay more. People will pay more when they choose to. They walk away when they find out they were charged more without being asked. In fact, 66% of U.S. consumers have already stopped using a company over how it handled their data.

I spent time with Usercentrics CEO Donna Dror during Advertising Week to dive a bit deeper into this data and also discuss other hot topics swirling around, from consent and surveillance pricing to what happens when AI assistants want access to everything.

For someone outside our industry, what does Usercentrics do?

When you visit a website or app, it collects information about you. Because of data privacy laws, that website or app has to tell you what it's collecting, what it wants to do with it, and which other services it will send the data to. That usually shows up as the familiar but slightly annoying cookie banner. The simplest way to explain what Usercentrics does is that we help enforce these data privacy laws through website and app interfaces. With our acquisition of MCP Manager, an AI gateway, we're bringing that same work to AI systems.

Who buys it, and why?

Our customers are honestly everyone. I like to say there are four good reasons to use our solutions. Number one, it's the law. Number two, it's the moral thing to do. Now let's say you don't care about either of those things. It lets you collect better-quality data, and better-quality data means better monetization. And more and more, consumers care about this because they vote with their dollars and euros.

Many people still think of privacy as a European issue. Is it?

If you operate a website that gets traffic from the EU, you are beholden to EU laws, so it is a topic for everyone. Every business is a global business just by being online. The U.S. is our fastest-growing market, and 20 U.S. states now have data privacy laws; if you look at that list, they don't skew one way or the other. That tells you this is becoming a top-of-mind priority for everyone.

What's the biggest difference between how Europe and the U.S. handle this?

Data privacy laws in Europe are opt-in, and in the U.S. they are opt-out. If you visit a website in Europe, the company can't collect anything about you until you accept. In the U.S., companies can collect everything about you unless you opt out. That difference matters, including for surveillance pricing, because surveillance pricing only works when certain conditions are met, and opt-out is a big part of that puzzle.

What are your thoughts on surveillance pricing?

It's something I'm very passionate about. When Consumer Reports ran an experiment with two advocacy groups on Instacart, they found price differences of up to 23% on certain items… that's no small adjustment. I believe businesses have the right to make money. I also believe in consumers' right to transparency and choice, and surveillance pricing, as it's run today, gives you neither. Why would the same product cost up to 23% more without any transparency or choice?

New York already requires companies to disclose when a price is based on personal data. Is that enough?

Disclosure is a good first step, but it doesn't suffice. Disclosure without alternatives is a box-ticking exercise. If the notice said, "This price has been adjusted based on your data," and you could answer, "I don't want that, I want the default price," that would change behavior. We see the same thing in our world. When the only option is to accept all cookies, people accept cookies. When people have alternatives, they reject them. That choice, as annoying as it can be, matters, and I'd like to see it applied to pricing.

There's also a patchwork problem. Maryland's law applies only to grocery stores. New York's applies to all retailers. Connecticut and New Jersey are next. Each of these laws is slightly different, and regulation without enforcement can only take you so far. I don't think anyone has changed their business practices because of a Maryland law that applies only to grocery stores.

Should the U.S. get a federal privacy law rather than state-by-state?

I think the strength of 20 states should create pressure that eventually leads to a federal law. What matters is what consumers care about, and if they care enough, change will come.

Is data privacy a threat to big tech's business model?

For a really long time, we've lived in an economy where data is king and more data is better. Companies like ours effectively say you get less data because you're giving users the choice to say, "Don't collect data about me." Data privacy isn't here to make big tech more money. It's here to protect consumers.

That said, we don't think it's either/or. If you're a brand that prioritizes data privacy, you can build more trust with your users and monetize higher-quality data instead of collecting everything about everyone for the sake of it. Think about seat belts. Car companies didn't want to roll them out, but once it became law and everybody did it, it didn't hurt their ability to make money, and it saved lives.

Muse is all the rage right now. What worries you, and what excites you about AI personal assistants?

There's something positive in them. Technology can be an equalizer, and you don't want a world where only people from a certain background or a certain job get the benefits of AI. Free, easy-to-use assistants lower that barrier. The flip side is that these assistants are only as good as the access they get, and they want a lot of access: your inbox, your calendar, your files. The bigger risk isn't whether an assistant sells your information. It's what happens when it learns so much about you that it finds ways to hook you and monetize you in harmful ways. Regulation needs to account for that, because without enforcement, it is just a piece of paper.

How is AI changing who you hire?

The labor market is changing, and I think we all have to be honest about that. Somebody still needs to manage the AI, prompt it, and check its results. What I enjoy is the intersection of human intelligence and artificial intelligence, because together, they accelerate intelligence. We're still hiring engineers, product managers, and salespeople, with different expectations. Analysts are moving from data to insights to action. We even hired our first go-to-market engineer, a role that didn't exist a couple of years ago. And we're testing for curiosity about technology, because the people who succeed are the ones willing to get their hands dirty with something new, even when it's scary. I'm more excited than I am scared.

What I'm taking back with me

What Donna and Maureen said about disclosure has me thinking. If no one can act on it, then it's impossible to build trust, and if the yes is out of resignation, it isn't worth much. The brands that become the consumer’s “choice” will be the ones that make that choice real. That’s how you earn the kind of yes people are happy to give.

‍