Our fight against Adtech gets bigger

Two years ago, complaints against real time bidding (RTB) were lodged by Jim Killock of Open Rights Group, Michael Veale of UCL, and Johnny Ryan. RTB is a technology which is used to sell and buy advertisement online, and involves a massive and uncontrolled sharing of your browsing history and profile data.

Many things have changed since then. Open Rights Group is taking the Information Commissioner’s Office to Court over their failure to act upon our complaint; the Irish Data Protection Commissioner is still MIA, despite the looming threat of an infringement procedure for their failure to implement EU law; and the Belgian Data Protection Authority found that tracking and consent pop-ups used by Google and other major websites and apps are unlawful.

What hasn’t changed, however, is the growing concern for an industry which is broken by design. On December 10, human rights organisations from Cyprus, Croatia, Greece, Malta, Portugal, and Romania lodged complaints before their national Data Protection Authorities against privacy abuses in RTB processing. This makes up for what’s possibly the largest cross-border complaint in Europe, with 21 countries involved under our coordination and that of Liberties and the Panoptykon Foundation.

But why is real time bidding so controversial? And why are we still lodging complaints at the very setting of 2020?

What’s the issue with RTB?

Every time you visit a website, hundreds if not thousands of hidden trackers are taking note of what we do, read and watch. Your browising history and profile data is then shared all across the globe, and sold in auctions where countless advertisers and middlemen can access our data and bid for their adverts to be shown in the websites we visit.

It is worth noticing that this information is collected and traded away without any security in place. Dodgy intermediaries could participate to an auction with no intention to bid or to show you adverts, but only to grab your data and use it for any reason they like — such as to manipulate your political views, check your compliance with coronavirus restrictions, or track protesters of the Black Lives Matter movement.

It is little surprising then that RTB must rely on coercion (cookie walls) and deception (dark patterns) to gain your consent. Who would ever say yes to advertising under these terms?

Why more complaints?

Cooperation among authorities in the handling of GDPR cross-border complaints has been slow. These six new complaints took notes of this experience: this time, DPAs are being asked to refer the case to the leading authorities as well as to help them throughout the course of the investigation.

Furthermore, it is worth mentioning that Ireland — which is the leading authority in our complaint against Google — is still silent. These complaints will hopefully add further pressure for the DPC to enforce against one of the biggest player in the RTB sector.

Is it working?

Issues regarding the slow enforcement of data protection rules across the EU have been pointed out by others, and acknowledged by the European Commission. Our project had the (unpleasant) privilege of encountering all these barriers along the way, but we were never expecting it to be an easy ride.

On the other hand, results are starting to come in. With the proceeding in Belgium, authorities started to do the first steps in the right direction. Lawmakers are showing strong support for pulling the plug of online tracking, and pressure on the industry is on the rise with the European Commission proposals for a Digital Services Act and a Digital Markets Act. On top of that, the ad tech sector is gaining the attention of antitrust authorities, such as in the UK, Germany and Italy.

In other words, the GDPR is working, slowly but inexorably. It is now upon authorities and lawmakers to do their part, and make sure that the ad tech sector changes for the good of us all.

But you don’t need to sit down and wait for something to happen. Support our action against the ICO or join us, and help us defending your digital rights.