The General Data Protection Regulation, or GDPR, the European legislation that passed last month, represents not only sweeping protections for consumers but also a sea change for how companies conduct business. Putting the onus more squarely on brands and publishers goes a long way toward rectifying below-board practices that led to ad fraud and brand safety issues, but it also puts many companies in the uncomfortable position of pivoting their consumer targeting, effectively compelling them to re-learn how to do business.

Not all brands are planning to adhere to the guidelines outlined by GDPR, in spite of the severe penalties: 20 million euros or four percent of a company’s worldwide annual revenue. Questions remain about the enforceability of these penalties outside of the European Union, and exposure to GDPR varies. If you’re based or operate in the EU or if EU citizens form a large contingent of your customer base, you’ll clearly face stiff GDPR penalties if you don’t comply. But if you’re a US-based company with a marginal customer base from the EU, your exposure is considerably lower. I’d be remiss if I didn’t mention that Facebook and Google were leveled with $8.8 billion worth of lawsuits on the first day GDPR came into effect.

Also Read: What Does GDPR Mean For Martech?

Even if your exposure is limited, however, you should work toward GDPR compliance for a few reasons. One, it’s a sign of things to come. It’s no surprise that the EU is the tip of the spear for this kind of regulation, which will represent a framework of best practices that will be adopted in some way, shape or form around the world. Two, you don’t want to get hit with those penalties. It’s not worth the risk if there is any doubt about your exposure. Three, even if you are a US-based company, we’ve already seen what the Cambridge Analytica scandal meant not only to Facebook but to the industry as a whole in terms of the privacy issues it brought up.

Without one-to-one consumer data, can you still measure your advertising’s efficiency?

In advertising, there have been typically two main approaches to measuring performance: There are two main buckets of measuring advertising performance: top-down and bottom-up. Marketing Mix Modeling (or MMM) is one of those top-down approaches that use more aggregate-level data about ad spending and other external variables to understand their impact on the business. Multi-touch Attribution (or MTA) goes the opposite way, relying on user-level granular data to understand their digital journeys and paths to conversion.

With GDPR in place, user-level data will become more limited and its use restricted, hindering our capabilities to measure in such level of detail our user’s behavior. And while collecting and using user-level data wasn’t a problem in and of itself, it was the over-reliance on it which opened the floodgates for selling consumer information to third parties without their permission and other unsavory methods.

Also Read: Customer Experience in the Age of GDPR: Privacy vs. Personalization

A top-down approach, however, still provides a way to learn about media effectiveness without the need for granular user-level data. It’s also important to note that the top-down approach is not what it used to be. Machine-learning and newer approaches such as Bayesian modeling have made the process much more efficient, which enables you to glean meaningful insights into business drivers even in the absence of substantial data. This is made possible by employing advanced mathematical models, which are able to fill in the blanks and understand the impact of every variable considered to accurately predict outcomes of different scenarios.

The bottom line is that both top-down and bottom-up approaches have their advantages and disadvantages, but a widespread dependence on the latter led to an imbalance and abuse in the use of personal information. GDPR should help restore that balance by urging companies to be more circumspect with their data usage, which should, in turn, encourage those companies to reevaluate how to measure media performance from another perspective, which might seem more limited due to not knowing individual behaviors, but in reality it’s not if the true purpose is to maximize your marketing ROI. While MTA will by no means become obsolete, a modern version of MMM will serve not only to help companies comply with GDPR requirements but also to more effectively reach and influence their target consumers with all the methods now available to them.

Recommended Read: GDPR Will Open the Door for Data Transparency