Regulators Find Europe's Ad-Tech Industry Acted Unlawfully

After a years-long process, data protection officials across the European Union have ruled that Europe's ad tech industry has been operating unlawfully. Engadget reports: The decision, handed down by Belgium's APD (.PDF) and agreed by regulators across the EU, found that the system underpinning the industry violated a number of principles of the General Data Protection Regulations (GDPR). The Irish Council for Civil Liberties has declared victory in its protracted battle against the authority which administers much of the advertising industry on the continent: IAB Europe. At the heart of this story is the use of the Transparency and Consent Framework (TCF), a standardized process to enable publishers to sell ad-space on their websites. This framework, set by IAB Europe, is meant to provide legal cover -- in the form of those consent pop-ups which blight websites -- enabling a silent, digital auction system known-as Real-Time Bidding (RTB). But both the nature of the consent given when you click a pop-up, and the data collected as part of the RTB process have now been deemed to violate the GDPR, which governs privacy rights in the bloc.

The APD has ruled that any and all data collected as part of this Real-Time Bidding process must now be deleted. This could have fairly substantial implications for many big tech companies with their own ad businesses, including Google and Facebook, as well as big data companies. It may also have a large impact on many media platforms and publishers on the continent who will now need to address the fallout from the finding. Regulators have also handed down an initial fine of 250,000 euros to IAB Europe and ordered the body to effectively rebuild the ad-tech framework it currently uses. This includes making the system GDPR compliant (if such a thing is possible) and appoint a dedicated Data Protection Officer. Until now, IAB Europe has maintained that it did not create any personal data, and said in December that it was a standards setter and trade association, rather than a data processor in its own right. IAB Europe says the ruling did not ban the use of Transparency and Consent Frameworks, adding that it's looking to reform the process and "submit the Framework for approval as a GDPR transnational Code of Conduct."

According to Engadget, [I]t may launch a legal challenge to fight the accusation that it is a data controller, a decision it says will "have major unintended negative consequences going well beyond the digital advertising industry."

It can't be!

[Gravis Zero]

No, it can't be true! It just can't! We all know that advertisers are the most ethically inclined professionals in the technology business and now you expect me to believe they went and broke the law knowing it was illegal?! I cannot and will not accept it... until it's in an advertisement on Facebook.

Re:

[sconeu]

Came here to find a comment like this. 5/5 would read again

Re: It can't be!

[TuballoyThunder]

I know, shocking. It supports my hypothesis that the online advertising industry is populated with sociopaths.

Re:

[luvirini]

Leadership. maybe. But most people just work there, like in many other jobs.

Re: It can't be!

[TuballoyThunder]

I think the software developers and the staff putting together the hardware must be experiencing some serious cognitive dissonance.

Re: It can't be!

[rantrantrant]

Yes. Completely trustworthy & should self regulate. This is gubbermint intereference & they're repressing free speech! Well, paid for free speech for ckick-baity anti-vax, neo-Nazism, & anti-environmental messages. Oh what joys the advertising industry brings to us, all day, every day, intrusively & relentlessly. They're making the world a better place. Making the world a better place...

Re:

[splutty]

Bend over comrade!

The decision is fairly readable

[Drishmung]

I dipped into the decision linked in the description. It's quite readable. Until now, IAB Europe has maintained that it did not create any personal data. Err, it creates a persistent individual identifier for each user, with details about their preferences, which it (IAB) holds in a data store, and which it sends to all the bidders as part of the real-time bidding process.

I don't see how they are going to succeed in any claim that they are not a data controller, but hey, IANAL.

Re: The decision is fairly readable

[rantrantrant]

Have you ever tried to have a reasonable conversation with people who work in PR & marketing? They have no idea what facts are. Words fall out of their mouths that sound plausible until you think about what they're saying. Then you realise it's all meaningless to them. They really don't care if it's true or not, just that it has an effect on people.

Re:

[AmiMoJo]

While I welcome this, I still think that their consent banners are not compliant with the rules. Recital 34 states that consent must be freely given and no coerced by default opt-in or by making declining more difficult than accepting. Their banners clearly don't meet those criteria.

Re:

[Drishmung]

Yeah, that's covered in the decision too. They claimed that they weren't a data controller; that their cookies were essential (nope); that their cookie didn't need separate disclosure (when you accept or reject advertising you are not informed that IAB is also holding your data). They were also sanctioned for not having a way to withdraw consent that is at least as easy as giving it.

They've been hit with a modest fine (as per the EU legislation which essentially says it needs to be big enough to dissuade ju

Re: The decision is fairly readable

[rantrantrant]

The system can easily be redesigned. I suspect that it's their business model that cannot. Essentially, we're moving towards banning 'targeted advertising' because it doesn't work & it's a national security & human rights nightmare. Only PR & marketing people could ever believe this stuff is OK.

Re:

[Drishmung]

I agree with you. Given that any redesign would probably requiring starting from scratch, I'm not sure 'easy' is the right adjective, but as you say, I doubt that there even is any way that they can make their business model GDPR compliant.

Enough already

[ddtmm]

Users would likely access the feature through a monthly subscription, he noted.

Well I guess that's out of the question for me. Enough with the subscriptions already.

IAB is cancer

[Sharlos]

I worked at one of the largest digital marketing firms in the world in 2021, in a team central to their 'post cookie' data collecting strategy. location tracking, apps downloaded, and IAB where by far the most useful tools in our toolbox for creating cookie-less fingerprints (apart from age and gender). I guarantee to you, IAB was the most useful and predictive variable we had. This is major news.