C3 Metrics initially became the only measurement company to achieve “Google compliance” — the ability to work with Google when the EU’s GDPR went into enforcement at the end of May.

It required C3 to change its modeling processes and query data directly along with other changes. It took nine months to complete the initial tasks, but the changes are ongoing.

Google made significant changes in the data it would make available to advertisers in compliance with the General Data Protection Regulation (GDPR). The restrictions were placed on media buyers using its data transfer service and DoubleClick ID, mainly on YouTube.

C3 Metrics, which turns 10 years old on Saturday, was the first attribution company to become Google certified. Jeff Greenfield, chief executive officer at C3 Metrics, discovered last summer that the C3 tracking tags Google approved to run on YouTube were being phased out due to GDPR — not just C3’s tags, but all companies, globally. 

“Google wants us to be able to do our job, but we need to do it without running tags,” he said. “Every week we have a standing call with them that our CTO joins, along with our chief developer.”

C3’s budget to comply with Google’s certification sits at close to $2 million, Greenfield admits — basically because it’s an ongoing project.

“You can see some of the grumblings from the agencies and holding companies, because I think people just didn’t believe it would happen, which shocks me,” he said.

A white paper published recently by Sequent Partners highlights the changes Google made ranging from the inability to track digital purchases, view scheduled reach and frequencies, and frequency capping, to making it more difficult to do schedule optimization, according to Alice Sylvester, partner at Sequent Partners, a consulting agency.

“The walled garden got a little thicker,” she said, referring to data and some companies even view the changes as a threat to their business model.

Sylvester says “the threat” produced few options. For marketers, continuing to do business with Google either means becoming “Google certified” or allowing Google to do all the attribution work.

Attribution companies felt like the light went out, added Jim Speath, partner at Sequent Partners.

Consumers want companies to do more to protect their data. Findings from a study focused on data privacy, published Thursday, revealed that nearly 60% of the 2,000 consumers surveyed believe the U.S. government should regulate how companies use their data.

The study, released Thursday from marketing company Sailthru, also found that about the same don’t believe companies should sell their personal data. Breaking down the more conservative states from more liberal states, consumers in New York are more comfortable with the notion than Texans, but consumers in both states generally don’t trust brands not to sell or share their data.