Belgian DPA fires a warning shot at adtech, what’s next?

In 2018 we lodged complaints in UK and Ireland against real time bidding (RTB), a technology which powers commercial tracking on the Internet. At first, the complaints were filed by Jim Killock from Open Rights Group, Micheal Veale from UCL, and Johnny Ryan — now Senior Fellow at the Irish Council for Civil Liberties.

The initiative grew rapidly: similar compliant were submitted in 17 other EU jurisdictions, possibly one of the biggest tests to the GDPR and its mechanisms to handle cross-border complaints. ORG is now working closely with these complainants, together with the Panoptykon Foundation, Liberties.eu and lawyers at AWO in a joint Europe-wide project to Fix Adtech.

Of course, not every Data Protection Authority has taken the necessary steps, for instance we are bringing the UK Information Commissioner’s Office to Court for their decision to drop our complaint.

Nevertheless, the Belgian Data Protection Authority recently took the first step and, following the release of a preliminary report by their inspection service, transferred our case to the Litigation Chamber. This is a welcome step in the right direction, and the first significant step on the road for our collective efforts to bring this industry into line with the law.

What is real time bidding, and why it hurts

Every time you visit a website, hundreds or possibly thousands of hidden trackers are taking note of what we do, read and watch. This information is broadcast to thousands of adtech companies — for instance, data brokers — to build a profile of who we are and what we like. Our profile is then sold in an auction where countless advertisers and middlemen can access our data and bid for their adverts to be shown in the websites we visit.

As you may have read between the lines, this is a very intrusive approach. Even worse, it is the founding element of illegal profiling, that phenomena which allows Governments and corporations to discriminate based on behaviours you have revealed on the internet — for instance, this is what allows scandals such as LGBT profiling in Poland, or tracking Black Live Matters protesters in the USA.

What did the Belgian DPA said, and why it matters

In their preliminary report, the Belgian DPA found the Interactive Advertising Bureau (IAB) to have violated the principles and duties of lawfulness, fairness, transparency and security. These findings relate in particular with their Transparency and Consent Framework, which powers those annoying but now ubiquitous cookie banners.

This is good news for our privacy: Regulators are (finally) starting to sharpen their teeth, and we expect them to bite. On top of that, this sheds a light on how the IAB clogged the internet with cookie banners which made your Internet experience worse, in the attempt to hide their responsibility for the privacy violations occurring underneath.

Also, a decision by the Belgian DPA would set a precedent for the Irish DPA to consider in our parallel case against Google. It is worth mentioning that the biggest RTB frameworks are OpenRTB (developed by IAB) and Google Authorised Buyers.

What happens now

If you listen to the IAB, enforcement by the Belgian authorities could lead to disaster, locusts and possibly turn Europe into a wasteland. They said something similar about Apple’s plan to ask for your consent before allowing third parties to track your activities on your phone.

Needless to day, we have our doubts concerning their forecasts. Indeed, the CEO of a major adtech company already warned that personalisation is slow, inefficient, and in contrast with the desire to build customers relationships. On top of that, publishers have been experimenting advertisement which does not involve the use of personal data, and their revenues skyrocketed. This should come with little surprise, given that users are actively boycotting RTB with adblockers and privacy-minded browsers.

Of one thing we are sure though. Open Rights Group will will make every effort to hold IAB to account, and for the Belgian complaint to succeed. Alongside our work with EU partners, we are also bringing the ICO to court over their failure to do the same thing that the Belgians are doing.

Want to help us? Support our court case for an effective regulator in the UK or join us, and help us protect our rights in these turbulent times.