ICO urged to act now on adtech or be seen as soft touch

The Information Commissioner’s Office has been warned by industry experts that it risks being seen as “all mouth, no trousers” unless it launches enforcement action against the adtech industry’s mass abuse of consumer data.
Last week, the regulator published a damning report into adtech practices – specifically real-time bidding – which set out nine “systemic concerns” the regulator has with the level of compliance of RTB, programmatic and behavioural advertising systems. The main thrust of the report was that many programmatic practices are illegal under GDPR, which came into force over 12 months ago.
The ICO said it will work closely with the IAB and Google on their GDPR frameworks to help them become fully compliant. But its warning that the sector has six months to clean up its act has been seen as a hollow threat by some, especially since the ICO has only committed to potentially issuing further guidance, rather than enforcement action.
London Media Exchange chief executive Dan Wilson told digiday: “The ICO has punctured the tin but not ripped the lid off. How data is used within RTB-based advertising has been flagged as a systemic risk to privacy. They can’t issue statements like that and walk away.”
Ryan Storrar is senior vice-president and head of media action for the EMEA region at GroupM-owned media agency Essence. He insists warnings alone will not change anything: “A lot of people are talking about it, but only enforcement will bring change. A lot of the report’s findings are unsurprising, but they need to make examples of businesses falling foul.”
And one data industry insider added: “Lets face it, the ICO doesn’t really understand the adtech market, otherwise why would it be taking such as softly, softly approach? It admitted as much by holding that summit back in February to ask the industry how it should best police programmatic advertising.
“Now it’s given companies another six months to change. By then, GDPR will have been enforceable for over 18 months – not even counting the two years’ grace period before that. If the regulator doesn’t act soon, at best it will be seen as all mouth and no trousers; at worst it will be viewed as running scared of big tech.”