As the General Data Protection Regulation approaches its two-year anniversary, it has been disappointing to see a lack of strong enforcement against adtech privacy violations.

While it seems that data protection authorities have found many violations too big to handle, NGOs have gathered forces, among other things at DFF’s strategy meeting in February.

In January 2020, the Norwegian Consumer Council published a report called “Out of Control – How consumers are exploited by the online advertising industry”, covering how apps on our phones share personal data with potentially hundreds of obscure companies. These companies harvest data to create profiles on individuals, which are then used for serving targeted advertising. Additionally, they are used for purposes such as discrimination, manipulation, and exploitation.

These companies harvest data to create profiles on individuals, which are then used for serving targeted advertising

Alongside the report, we filed complaints against six companies for breaching the GDPR, including five large adtech companies.

However, we were far from alone. We published ‘Out Of Control’ all across the world, together with a large number of other consumer, digital rights, and civil rights groups in Europe and the United States. The consumer rights umbrella in Europe, BEUC, coordinated the European action and many of the organisations are members of the Transatlantic Consumer Dialogue (TACD), Consumers International and the human rights umbrella Liberties. A total of 43 organisations in 20 countries participated, sending letters to several data protection authorities. Together we have achieved media coverage in more than 70 countries.

Our research was inspired by a vast digital rights network, including previous work done by Privacy International, Panoptykon Foundation and Open Rights Group. Additionally, many organisations have given important input in the research and we worked together with the cybersecurity company Mnemonic, the digital rights organization None Of Your Business (NOYB) and the researcher Wolfie Christl of Cracked Labs in particular.

Based on discussions at events such as the DFF strategy meeting in February, it is clear that many of the issues reach beyond privacy violations. In the future, we need to push for enforcement, looking across silos to address the combination of competition, privacy and consumer rights violations.

…it is clear that many of the issues reach beyond privacy violations. In the future, we need to push for enforcement

Another important topic is how we can address the responsibilities of publishers and advertisers. Publishers, advertisers and consumers/citizens are all cheated by the adtech industry in different ways. This means that we might have common interests.

Karolina Iwańska from the Panoptykon Foundation describes the dilemmas facing legitimate media in the article “10 reasons why advertising is broken”. Since a large portion of advertising funds go to adtech intermediaries, and because the adtech industry is dominated by only a few monopolistic actors, legitimate media are locked into a less-than fruitful business relationship with companies such as Google.

There are also widespread issues with ad fraud, where advertisers are paying large sums of money to adtech companies, but end up having their ads shown to bots instead of human beings.

We have seen some advertisers address the problematic aspects of adtech, both in dialogue with NGOs and in industry forums. For example, the head of the Norwegian branch of the World Federation of Advertisers recently published an opinion piece in the industry magazine Kampanje, predicting that advertisers will demand higher privacy standards from the adtech industry in the future. He calls for advertisers to become “the change you wish to see” – using their purchasing power to create room for alternative business models to grow. In other words – these issues can be addressed both through enforcement and from industry pressure.

The adtech industry should look out, because when the NGO sector stands together, we are a force to be reckoned with

In the meantime, we hope that further collaborative work will help push relevant authorities to protect consumers from commercial surveillance. By extension, this may help bring about a better and safer digital world, a world that is no longer driven by all-consuming tracking and profiling.

The adtech industry should look out, because when the NGO sector stands together, we are a force to be reckoned with.

Gro Mette Moen is the acting director of digital policy in the Norwegian Consumer Council.