Response to the Competition & Markets Authority study into the digital advertising market

Open Rights Group (ORG) is a UK-based digital campaigning organisation working to protect fundamental rights to privacy and free speech online. With over 3,000 active supporters, we are a grassroots organisation with local groups across the UK.

Our comments below address the CMA’s proposed Theme 2: Consumer control over data collection practices.
————————————————————————————————————

1. We welcome the inclusion of Theme 2 in this study, noting how profile-based online advertising practices which revolve around data collection and aggregation negatively impact consumer choice and control. The presently dominant model of real-time bidding (RTB) for online ad spaces in particular has obscenely poor outcomes for consumer rights and urgently needs regulatory investigation and action.
2. Consumers entirely lack control over how their data is processed in RTB operation. Every time a person visits a website that uses RTB systems to show users behaviourally targeted adverts (which is the vast majority of websites), intimate personal details about them are broadcast to tens or hundreds of intermediary adtech companies. These companies then bid on behalf of advertisers for the opportunity to show that specific person an advert. The personal data broadcast in RTB is extensive. It can include the person’s exact location, what they are reading, watching and listening to online, inferred religious, sexual and political views, and unique codes that allow a long-term profile on them to be built up over time. This data sharing happens hundreds of billions of times each day and there are no limits on what the intermediary adtech companies, which have no direct relationship with consumers, can do with consumers’ personal data once they receive it. [1] The consumer harm this entails is colossal, and entirely unacceptable.
3. We encourage the CMA to more explicitly consider RTB within Theme 2, and, as an integral part of this, to consider not just online platforms but also the wider ecosystem of adtech companies – since their operations critically interconnect with issues of competition and consumer choice/consent.
4. In terms of paragraph 70 of the proposed scope, to comprehensively consider and report on how best to address/improve consumer control, the CMA must also look at how industry standards around data use are set. Standard-setting is an integral part of market operation: it structures how data processing takes place and thus almost entirely shapes consumers’ online experience. We urge the CMA to expand the scope of its study in this regard: to consider how current RTB marketplace standard-setting impacts consumers and organises the market. This includes understanding the paradoxical effects of market concentration despite apparent diversity in the chaotic adtech ecosystem. We also recommend exploring what the potential impact on competition would be if existing standards were more rigorously enforced, and/or if new standards or new methods of adopting standards were mandated.
5. For RTB, industry standards are set by Google, through its Authorized Buyers framework, and the Interactive Advertising Bureau (IAB), through its Transparency and Consent Framework. Google and the IAB are presently under scrutiny from the Information Commissioner’s Office (ICO) and other Data Protection Authorities (DPAs) across Europe. [2] Whilst the CMA is right to be careful about mandate overreach and mission creep, in order for its study to benefit from horizontal expertise and have holistic industry application it should be conducted in close communication and collaboration with other regulators – notably the ICO, Ofcom and Electoral Commission – and bodies such as the Centre for Data Ethics and Innovation. [3] This will be especially important if regulatory solutions are likely to be proposed, in order to ensure that regulation complements rather than contradicts.
6. In relation to paragraph 65, concerning “informed choice”, we would expect the CMA in this regard to examine issues of cookie tracking and coerced consent through so-called “cookie walls”. The forthcoming EU e-Privacy Regulation, to which the UK may or may not be bound, has relevance in this regard. [4] The debates about “cookie walls” in this policy development process are informative of the shortcomings of approaches based on informing consumers and providing choice, instead of simply minimising data collection and limiting the purposes for which it is processed.
7. In relation to paragraph 67, concerning “other practices”, we would add “dark patterns” to the included list of issues. These influence how options are presented to consumers and can limit or manipulate free decision-making.[5]
8. While welcoming the CMA initiative to investigate online advertising, we are concerned about the CMA’s framing of this study in terms of consumers getting “insufficient compensation” or “poor value” for their data. Personal data is not a commodity; rather, it goes to the heart of individuals’ identity. Data protection rights, most notably those provided for in the General Data Protection Regulation 2018 (GDPR), protect consumers through a fundamental rights-based framework.
9. There is a growing recognition of the overlap between data protection and competition law. The European Data Protection Supervisor has advocated that competition law enforcement should consider the data protection rights of consumers and intervene to control market power in the digital economy.[6] The European Commission and national competition authorities have also begun considering whether competition law should incorporate data protection and privacy concerns, particularly with a focus on ‘big data’.[7] Orla Lysnkey and Francisco Costa-Cabral of London School of Economics has argued that the two areas of laws have significant “family ties” with both aiming to achieve market integration and sharing a concern for the welfare of the individual.[8]
10. Enabling consumers to exercise more and better control over how online platforms collect and use their data would reduce the power imbalance between users and platforms. This in turn would empower consumers to hold online platforms accountable for rights-violating data abuse, misuse and exploitation practices, protecting their rights and improving their online experience. We strongly recommend that the CMA reframe the study such that the desired benefit to consumers lies in upholding fundamental rights.

[1] See Information Commissioner’s Office, Update Report into adtech and real time bidding, 20 June 2019 <https://ico.org.uk/media/about-the-ico/documents/2615156/adtech-real-time-bidding-report-201906.pdf>
[2] We have an ongoing complaint to the ICO about RTB system operation. This complaint has also now been submitted to data protection authorities across the EU, with 20 complaints filed to date. Complaint and surrounding information/documentation is available at <https://fixad.tech/september2018/Fixad.tech>
[3]We have also recently submitted a response to the Centre for Data Ethics and Innovation call for evidence consultation on online ad targeting. Submission of 14 June 2019 available here: <https://www.openrightsgroup.org/assets/files/reports/report_pdfs/Centre_for_Data_Ethics_Online_Targeting_Consultation_Response.pdf>
[4] The e-Privacy Regulation is currently in trialogue in Brussels. ORG and other groups have raised concerns with some of the proposals relating to cookies and consent made by member states in the Council. See: <https://www.openrightsgroup.org/about/reports/e-privacy-regulation-areas-of-concern-for-the-open-rights-group>
[5]Norwegian Consumer Council, Deceived by Design, Report at: <https://www.forbrukerradet.no/undersokelse/no-undersokelsekategori/deceived-by-design/>
[6] European Data Protection Supervisor Opinion 8 / 2016, On the coherent enforcement of fundamental rights in the age of big data, 23 September 2016
[7] Commissioner Vestager, Competition in a Big Data World, 17 January 2016, accessible at <https://ec.europa.eu/commission/commissioners/2014-2019/vestager/announcements/competition-big-data-world_en>
[8] Costa-Cabral, F. & Lynskey, O. (2017) Family ties: the intersection between data protection and competition in EU law, Common Market Law Review, 54(1)