The adtech industry’s unlawful data flows
By Thomas Vink, 2nd June 2021
The online advertising industry (adtech) is built on the trade of personal data, including intimate and sensitive details about individuals. Information about individuals is shared and sold across thousands of online advertising companies without users’ informed consent or knowledge about who has access to their data or how it is used. This process is known as real time bidding. ORG, Liberties and Panoptykon are concerned adtech is insufficiently regulated and that real time bidding breaches European data protection and privacy laws.
The adtech industry’s unlawful data flows
Organisation Name
Open Rights Group (ORG), Civil Liberties Union for Europe (Liberties) and Panoptykon
Country/Jurisdiction
EU-wide
Amount Granted
Pre-litigation: EUR 20,462
Litigation Track: EUR 135,007
Current Status
Research complete; litigation ongoing
Grant type #1
Pre-Litigation Research
Grant type #2
Single Instance Litigation Support
Description
The online advertising industry (adtech) is built on the trade of personal data, including intimate and sensitive details about individuals. Information about individuals is shared and sold across thousands of online advertising companies without users’ informed consent or knowledge about who has access to their data or how it is used. This process is known as real time bidding. ORG, Liberties and Panoptykon are concerned adtech is insufficiently regulated and that real time bidding breaches European data protection and privacy laws. In 2018, ORG joined Dr. Johnny Ryan of Brave & Michael Veale of University College London in the first joint complaints against Google and IAB about real time bidding.
DFF’s support began in 2019 with a pre-litigation research grant to ORG, who hosted a workshop and developed a plan for further co-ordinated complaints to data protection authorities across the EU.
Building on the plan developed, ORG, Liberties and Panoptykon received a new grant in 2020 supporting their joint work to take co-ordinated litigation, advocacy, and campaigning activities. They aimed to put pressure on data protection authorities across Europe to investigate and take enforcement action against the online advertising industry. Complaints were made to 21 data protection authorities across the EU.
In late 2020, ORG took the UK Information Commissioner’s Office (ICO) to court for failure to act on one of the initial complaints filed in 2018. ORG lost this appeal.
In 2022, the Belgian DPA ruled that cookie banners implemented by the online advertising industry’s trade body “IAB Europe” are illegal. This ruling meant that all data collected through the cookie banners must be deleted by more than 1,000 companies, including Google, Amazon and Microsoft.
In February 2024, ORG submitted complaints to the ICO and the Commission Nationale de l’informatique et des libertés (CNIL) about LiveRamp, an online advertising and data broking company. The complaints were submitted on behalf of Jim Killock, ORG Executive Director, as well as French digital rights activists Noémie Levain and Benoît Piédallu.
ORG argue that LiveRamp’s new system, which is being presented as a viable alternative in the face of growing regulatory pressure against online advertising, fails to address or even improve upon any of the substantive issues raised by previous complaints.
"In 2022, the Belgian DPA ruled that cookie banners implemented by the online advertising industry’s trade body “IAB Europe” are illegal. This ruling meant that all data collected through the cookie banners must be deleted by more than 1,000 companies, including Google, Amazon and Microsoft."
Strategic Goal
A ruling from a data protection authority that forces a transformation of how online advertising works in the EU so that it is human rights respecting, including by giving users effective control over how their data is used for advertising.
Media and related links
» 2024, “ORG submits complaints about intrusive LiveRamp adtech system” (ORG)
» “Ending illegal online advertising” (ORG)
» “New privacy complaints filed against invasive online advertising” (Liberties)
» “10 Reasons Why Online Advertising is Broken” (Panoptykon)
» “Strategising on GDPR complaints to take on the AdTech industry” (Martha Dark – DFF blog)”