$273bn behavioural ad industry 'is in breach of GDPR'

Behavioural advertising might be the mainstay of many brands’ marketing strategies – estimated to be worth $273bn this year – but the way it uses consumers’ personal data is in direct breach of GDPR.
That is the crux of a new official complaint – filed with the Irish Data Protection Commissioner and the UK Information Commissioner’s Office – on behalf of tech start-up Brave, the Open Rights Group and University College London, aimed at triggering an EU-wide investigation into the practice.
The complainants argue that when users search on Google, personal information on their online behaviour is broadcast to multiple companies interested in targeting them with ads without users’ consent.
In doing so, they claim, Google violates the GDPR’s requirement for personal data to be “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss”.
It added: “The sheer number of recipients of such data mean that those broadcasting it cannot protect against the unauthorised further processing of that data, nor properly notify data subjects of the recipients of the data… data breaches are inherent in the design of the industry”.
As well as Google, the complaints target all ad tech companies which broadcast online users’ personal data widely in real-time bid requests for programmatic ads.
The complaint claims the adtech industry can process users’ information, including such data as the content being viewed, location, type of device, unique tracking IDs, or a “cookie match,” and IP address.
This data can help reveal highly personal details, such as income, age and gender, habits, social media influence, ethnicity, sexual orientation, religion, political leaning and other sensitive information, it states.
The complaint is being legally assisted by Ravi Naik, a partner at ITN Solicitors, the firm which previously helped draw up a complaint by US academic Professor David Carroll to the ICO against Cambridge Analytica.
Naik said: “We have been instructed by clients in numerous jurisdictions to file complaints concerning the behavioural advertising industry. We are confident that any proper appraisal by the authorities of the concerns will lead to a fundamental shift in our relationship with the Internet, for the better.”
In response, Google has said that it has already implemented strong privacy protections in line with the requests of European regulators, reaffirming its commitment to GDPR.
However, in July it was claimed that Google’s failure to get to grips with GDPR is leaving many firms which use its advertising services high and dry by targeting ads to users who have not given adequate consent.

Share with friends and colleagues

Related Articles