The adtech industry’s unlawful data flows

By Thomas Vink, 2nd June 2021

The online advertising industry (adtech) is built on the trade of personal data, including intimate and sensitive details about individuals. Information about individuals is shared and sold across thousands of online advertising companies without users’ informed consent or knowledge about who has access to their data or how it is used. This process is known as real time bidding. ORG, Liberties and Panoptykon are concerned adtech is insufficiently regulated and that real time bidding breaches European data protection and privacy laws.

The adtech industry’s unlawful data flows

Organisation Name

Open Rights Group (ORG), Civil Liberties Union for Europe (Liberties) and Panoptykon

Country/Jurisdiction

EU-wide

Amount Granted

Pre-litigation: EUR 20,462

Litigation Track: EUR 135,007

Current Status

Research complete; litigation ongoing

Grant type #1

Pre-Litigation Research

Grant type #2

Single Instance Litigation Support

Description

The online advertising industry (adtech) is built on the trade of personal data, including intimate and sensitive details about individuals. Information about individuals is shared and sold across thousands of online advertising companies without users’ informed consent or knowledge about who has access to their data or how it is used. This process is known as real time bidding. ORG, Liberties and Panoptykon are concerned adtech is insufficiently regulated and that real time bidding breaches European data protection and privacy laws. In 2018, ORG joined Dr. Johnny Ryan of Brave & Michael Veale of University College London in the first joint complaints against Google and IAB about real time bidding.

DFF’s support began in 2019 with a pre-litigation research grant to ORG, who hosted a workshop and developed a plan for further co-ordinated complaints to data protection authorities across the EU.

Building on the plan developed, ORG, Liberties and Panoptykon received a new grant in 2020 supporting their joint work to take co-ordinated litigation, advocacy, and campaigning activities. They aimed to put pressure on data protection authorities across Europe to investigate and take enforcement action against the online advertising industry. Complaints were made to 21 data protection authorities across the EU.

In late 2020, ORG took the UK Information Commissioner’s Office (ICO) to court for failure to act on one of the initial complaints filed in 2018. ORG lost this appeal.

In 2022, the Belgian DPA ruled that cookie banners implemented by the online advertising industry’s trade body “IAB Europe” are illegal. This ruling meant that all data collected through the cookie banners must be deleted by  more than 1,000 companies, including Google, Amazon and Microsoft.

In February 2024, ORG submitted complaints to the ICO and the Commission Nationale de l’informatique et des libertés (CNIL) about LiveRamp, an online advertising and data broking company. The complaints were submitted on behalf of Jim Killock, ORG Executive Director, as well as French digital rights activists Noémie Levain and Benoît Piédallu.

ORG argue that LiveRamp’s new system, which is being presented as a viable alternative in the face of growing regulatory pressure against online advertising, fails to address or even improve upon any of the substantive issues raised by previous complaints.

"In 2022, the Belgian DPA ruled that cookie banners implemented by the online advertising industry’s trade body “IAB Europe” are illegal. This ruling meant that all data collected through the cookie banners must be deleted by  more than 1,000 companies, including Google, Amazon and Microsoft."

Strategic Goal

A ruling from a data protection authority that forces a transformation of how online advertising works in the EU so that it is human rights respecting, including by giving users effective control over how their data is used for advertising.

Organisation Name

Women’s Link Worldwide

Image credit: ev on Unsplash