The adtech industry’s unlawful data flows
Open Rights Group (ORG), Civil Liberties Union for Europe (Liberties) and Panoptykon
Privacy and data protection
Research complete; litigation ongoing
The online advertising industry (adtech) is built on the trade of personal data, including intimate and sensitive details about individuals. Information about individuals is shared and sold across thousands of online advertising companies without users’ informed consent or knowledge about who has access to their data or how it is used. This process is known as real time bidding. ORG, Liberties and Panoptykon are concerned adtech is insufficiently regulated and that real time bidding breaches European data protection and privacy laws.
In 2018, ORG filed complaints about real time bidding to the data protection authorities in Ireland and the UK. In 2019, with the support of a pre-litigation research grant, ORG hosted a workshop and developed a plan for further co-ordinated complaints to data protection authorities across the EU.
Building on the plan developed, ORG, Liberties and Panoptykon received a new grant in 2020 supporting their work together to take co-ordinated litigation, advocacy and campaigning activities. They aim to put pressure on data protection authorities across Europe to investigate and take enforcement action against the online advertising industry. So far complaints have been made to 21 data protection authorities across the EU.
Additionally, in late 2020, ORG took the UK Information Commissioner’s Office to court for failure to act on one of the initial complaints filed in 2018.
In August 2020, the Belgian data protection agency released an investigation report finding that the Interactive Advertising Bureau’s framework for getting user consent for online advertising violates the European General Data Protection Regulation. The findings still need to be validated by the data protection agency’s enforcement section, and will likely be contested. But this is still a major step towards getting a ruling that would force changes to the current online advertising business model.
"Information about individuals is shared and sold across thousands of online advertising companies without users’ informed consent or knowledge about who has access to their data or how it is used"
A ruling from a data protection authority that forces a transformation of how online advertising works in the EU so that it is human rights respecting, including by giving users effective control over how their data is used for advertising.