The Information Commissioner, Elizabeth Denham, notes that online advertising supports a large ecosystem of adtech providers, publishers, and advertisers. It also generates a significant proportion of the revenues of major technology companies. Behind online advertising stands a complex web of data processing involving the profiling, tracking, auctioning, and sharing of personal data. The reliance on personal data means data protection law has an important role to play in building trust and confidence, and in protecting the public from personal data misuse.

Technologies used in online advertising, and the way they are deployed, have the potential to be highly privacy intrusive, Ms Denham says. Her 2019 update report into adtech and real-time bidding set out the concerns about the adtech ecosystem. In particular, it covered the significant role cookies and similar technologies play in enabling the gathering and processing of personal data to target and profile.

Since 2019, industry has developed several initiatives that seek to address the risks adtech poses and shift towards less intrusive tracking and profiling practices. These include proposals from Google and other market participants to phase out the use of “third party cookies” (TPCs) and other forms of cross-site tracking and replace them with alternatives. Ms Denham has been collaborating with the Competition and Markets Authority (CMA) in assessing these developments and ensuring they meet the requirements of data protection and competition law. The regulators published a joint statement in May 2021 stating that the interest of consumers is best served when the objectives of both competition and data protection are achieved. The regulators say that they will continue to work closely together on this.

Given that the proposals from both Google and other market participants are not yet fully realised, Ms Denham notes that there is a window of opportunity for proposal developers to reflect on genuinely applying a data protection by design approach. Ms Denham therefore encourages Google and other participants to demonstrate how their proposals meet the expectations outlined in the Opinion.

Ms Denham says that new initiatives must address the risks that adtech poses and take account of data protection requirements from the outset. Any proposal that has the effect of maintaining or replicating existing tracking practices (such as those described in the 2019 Report) is not an acceptable response to the significant data protection risks already described.

The Commissioner expects any proposal to:

• engineer data protection requirements by default into the design of the initiative;
• offer users the choice of receiving adverts without tracking, profiling or targeting based on personal data;
• be transparent about how and why personal data is processed across the ecosystem and who is responsible for that processing;
• articulate the specific purposes for processing personal data and demonstrate how this is fair, lawful and transparent; and
• address existing privacy risks and mitigate any new privacy risks that their proposal introduces.

Ms Denham said: “I am looking for solutions that eliminate intrusive online tracking and profiling practices, and give people meaningful choice over the use of their personal data. My office will not accept proposals based on underlying adtech concepts that replicate or seek to maintain the status quo.” To read the ICO’s press release and for a link to the Opinion, click here.