The adtech industry’s unlawful data flows
The online advertising industry (adtech) is built on the trade of personal data, including intimate and sensitive details about individuals. Information about individuals is shared and sold across thousands of online advertising companies without users’ informed consent or knowledge about who has access to their data or how it is used. This process is known as real time bidding. ORG, Liberties and Panoptykon are concerned adtech is insufficiently regulated and that real time bidding breaches European data protection and privacy laws.
The adtech industry’s unlawful data flows
Organisation Name
Open Rights Group (ORG), Civil Liberties Union for Europe (Liberties) and Panoptykon
Country/Jurisdiction
EU-wide
Thematic Area
Privacy and data protection
Current Status
Research complete; litigation ongoing
Grant type #1
Pre-Litigation Research
Grant type #2
Single Instance Litigation Support
Description
The online advertising industry (adtech) is built on the trade of personal data, including intimate and sensitive details about individuals. Information about individuals is shared and sold across thousands of online advertising companies without users’ informed consent or knowledge about who has access to their data or how it is used. This process is known as real time bidding. ORG, Liberties and Panoptykon are concerned adtech is insufficiently regulated and that real time bidding breaches European data protection and privacy laws. In 2018, ORG joined Dr. Johnny Ryan of Brave & Michael Veale of University College London in the first joint complaints against Google and IAB about real time bidding.
DFF’s support began in 2019 with a pre-litigation research grant to ORG, who hosted a workshop and developed a plan for further co-ordinated complaints to data protection authorities across the EU.
Building on the plan developed, ORG, Liberties and Panoptykon received a new grant in 2020 supporting their joint work to take co-ordinated litigation, advocacy, and campaigning activities. They aim to put pressure on data protection authorities across Europe to investigate and take enforcement action against the online advertising industry. So far complaints have been made to 21 data protection authorities across the EU. Additionally, in late 2020, ORG took the UK Information Commissioner’s Office to court for failure to act on one of the initial complaints filed in 2018.
In August 2020, the Belgian data protection agency released an investigation report finding that the Interactive Advertising Bureau’s framework for getting user consent for online advertising violates the European General Data Protection Regulation. The findings still need to be validated by the data protection agency’s enforcement section, and will likely be contested. But this is still a major step towards getting a ruling that would force changes to the current online advertising business model.
"Information about individuals is shared and sold across thousands of online advertising companies without users’ informed consent or knowledge about who has access to their data or how it is used"
Strategic Goal
A ruling from a data protection authority that forces a transformation of how online advertising works in the EU so that it is human rights respecting, including by giving users effective control over how their data is used for advertising.