ICO Opinion on Data Protection and Privacy Expectations for Online Advertising Proposals
Published: 25 Nov 2021
Executive summary
Online advertising enables advertisers to reach individuals with their products and brands, while helping organisations to generate income to fund their online services. It supports a large ecosystem of advertising technology (adtech) providers, publishers, and advertisers. It also generates a significant proportion of the revenues of major technology companies.
The concept is simple: advertisers want to show adverts to individuals who are likely to buy their product, and individuals want to see adverts that are relevant to them. Behind it stands a complex web of data processing involving the profiling, tracking, auctioning, and sharing of personal data. The reliance on personal data means data protection law has an important role to play in building trust and confidence, and in protecting the public from personal data misuse.
Technologies used in online advertising, and the way they are deployed, have the potential to be highly privacy intrusive. The Commissioner’s 2019 update report into adtech and real-time bidding sets out the concerns about the adtech ecosystem. In particular, it covers the significant role cookies and similar technologies play in enabling the gathering and processing of personal data to target and profile1.
2 https://ico.org.uk/media/about-the-ico/documents/2619797/cma-ico-public-statement-20210518.pdf
Since 2019, industry has developed several initiatives that seek to address the risks adtech poses and shift towards less intrusive tracking and profiling practices. These include proposals from Google and other market participants to phase out the use of “third party cookies” (TPCs) and other forms of cross-site tracking and replace them with alternatives.
The Commissioner has been collaborating with the Competition and Markets Authority (CMA) in assessing these developments and ensuring they meet the requirements of data protection and competition law. The Information Commissioner’s Office (ICO) and CMA joint statement of May 2021 outlined that the interest of consumers is best served when the objectives of both competition and data protection are achieved2. The ICO and the CMA will continue to work closely together so that developments in the adtech industry operate in a data protection compliant way that ensures an appropriate level of competition.
The proposals from both Google and other market participants are not yet fully realised. There is a window of opportunity for proposal developers to reflect on genuinely applying a data protection by design approach. The Commissioner therefore encourages Google and other participants to demonstrate how their proposals meet the expectations this Opinion outlines.
New initiatives must address the risks that adtech poses and take account of data protection requirements from the outset. Any proposal that has the effect of maintaining or replicating existing tracking practices (such as those described in the 2019 Report) is not an acceptable response to the significant data protection risks that the Commissioner has already described.
The Commissioner expects any proposal to:
• engineer data protection requirements by default into the design of the initiative;
• offer users the choice of receiving adverts without tracking, profiling or targeting based on personal data;
• be transparent about how and why personal data is processed across the ecosystem and who is responsible for that processing;
• articulate the specific purposes for processing personal data and demonstrate how this is fair, lawful and transparent; and
• address existing privacy risks and mitigate any new privacy risks that their proposal introduces.
The Opinion represents the Commissioner’s view at the time of publication. The Commissioner may form a different view based on further findings or engagement with key stakeholders.
Categories: Industry News
