24 Nov 2023
A new era of Digital Advertising
The online world is thriving due to the constant evolvement of technological innovation. The landscape for digital advertising is in the after math of all the events, with growing sensitivity amongst public on data sharing and tight data regulations and policies.
A new era of digital advertising is on the rise -one that is more consensual, transparent, and more importantly a time where users are in charge of their own data. This shift in data policies, growing foresight and prudence on data issues, demonstrates a change in the landscape of digital advertising in the years to come thus forcing market that thrived for so long on personal user data on a look out for new compliance strategies in digital marketing.
One of the most critical areas of concern is the relationship between users and online service providers and, subsequently, tensions between online service providers and data protection supervisory authorities. The demanding nature of the General Data Protection Regulation (GDPR) has forced businesses to re-think the way they conduct their activities when using personal data. Marketing is certainly not an exception, especially in the digital environment. Whether an organisation conducts data analysis concerning its customers’ online activity or whether it simply uses a mailing list to send electronic marketing, such activities need to be framed within the context of the stricter obligations imposed under the GDPR.
An unprecedented shakeup in the advertising technology space
This is evident after the latest developments of 27th of October 2023, regarding European Data Protection Board (EDPB) urgent binding decision, on processing of personal data for behavioral advertising by Meta. The Board issued an urgent binding decision to ban Meta's data processing for behavioral advertising. The decision applies to Meta's Facebook and Instagram users across EU member states and European Economic Area countries. The impact of the decision is prominent considering that Facebook and Instagram have over 250 million active users in the EU/EEA. It originated from a request by Norway's data protection authority, Datatilsynet, to render a previously-issued interim ban in Norway permanent. The Norwegian Data Protection Authority is very concerned about the illegal tracking, monitoring and profiling that takes place on Facebook and Instagram. The EDPB's decision is an instruction to the Irish Data Protection Commission to issue a permanent ban to Meta Ireland, Meta's European headquarter. Once this has been carried out, the ban will come into effect. On October 31st, the Irish Data Protection Commission (DPC) officially communicated the Urgent Binding Decision from the EDPB to Meta.
Behavioral Advertising Concerns
Behavioral advertising is considered one of the most invasive types of online advertising. It refers to the practice of collecting and analyzing user online behavior data to deliver advertisements that are more relevant to their interests.
This type of advertising targets ads based on a user’s web-browsing history, search history, and other online activities. The goal is to create a more personalized experience for the user, but it also raises privacy concerns as it involves tracking a user’s online activities and collecting personal data. Online advertising raises multiple privacy-related concerns regarding: tracking behavior and the potential for profiling and discrimination, data collection and sharing with third-party advertisers and the potential for the misuse of personal information, potential for data breaches and the exposure of inaccurate data or sensitive information, overall lack of control an unawareness of the extent to which personal information is being collected and used.
Meta’s proposed Consent Mechanism and Legal Concerns
Meta came up with a proposed ‘consent’ mechanism, often dubbed ‘pay or okay’, as a solution in order to comply with the GDPR. Meta, is “willing to offer” people in the EU, EEA, and Switzerland the option to pay a monthly subscription to use Facebook and Instagram without any ads. Alternatively, people in these countries can continue to use the sites for free, but with ongoing behavioral advertisements shown as they deal with now. Admittedly, the subscription fee is substantial. Privacy expert and activist Max Schrems writes on the noyb.eu site:
“Fundamental rights cannot be for sale. Are we going to pay for the right to vote or the right to free speech next? This would mean that only the rich can enjoy these rights, at a time when many people are struggling to make ends meet. Introducing this idea in the area of your right to data protection is a major shift. We would fight this up and down the courts.”
Consent one of the legitimate bases that businesses can rely on for processing personal data as stated in Article 6(1) GDPR. The basic requirements for the effectiveness of a valid legal consent are defined in Article 7 and specified further in recital 32 of the GDPR. Consent must be freely given, specific, informed, and unambiguous. In order to obtain freely given consent, it must be given on a voluntary basis. The element “free” implies a real choice by the data subject. Any element of inappropriate pressure or influence which could affect the outcome of that choice renders the consent invalid. The Norwegian Data Protection Authority strongly doubts whether Meta’s proposed consent solution, which means that those who do not consent to behavioral marketing must pay a fee, will be legal. The EDPB’s decision is therefore important to avoid Meta’s infringement continuing while the company is exploring its options. The business action taken raised expressed skepticism about whether Meta's new solution meets these requirements, partly because the end-user is obliged to pay if he eventually does not "consent." The Norwegian Data Protection Authority is monitoring Meta's new solution.
Consumers are now asked if they want to pay to release ads or use a free version on Facebook or Instagram. The European Data Protection Authorities are in the process of working with Meta and are monitoring developments. With more enforcement actions being taken, such as the recent Irish DPC fines against Meta, we can expect to see an increase in legal battles over the use of online advertising and Ad-tech and behavioral advertising to be a priority enforcement area in the following year.
More transparency in Advertising and Google’s Requirements
Google, one of the five technological goliaths in the world, announced on May 16, 2023 new Consent Management Platform requirements for serving advertisements in the EEA and UK. Google will require all partners using its publisher products — Google AdSense, Ad Manager, or AdMob — to use a Google certified CMP that integrates with the newly reformed Transparency & Consent Framework (now on version 2.2.) when serving ads to users in the European Economic Area or the UK.
A consent management platform is a technological tool that websites use to obtain the legal consents from users to process their personal data, typically through cookies and trackers in operation on the domain. Consent management platforms assist ad-publishers be in compliance with data protection laws when integrating advertisements into their services, by obtaining user consent before activating targeted advertising cookies that process personal data.
Google require CMPs to add additional technical functionality to allow it to work with their ‘additional consent specification’ and that they adopt Google’s EU User Consent Policy. The latter means that they shall always use consent as legal basis (and not legitimate interest) when they will use Googe Ad Products & Services for users in the EEA and the UK, in accordance with the GDPR and the e-Privacy Directive.
Transparency and Consent Framework (TCF), new version 2.2
The decision to require Google’s publishers to adopt the IAB TCF follows on from IAB Europe’s announcement that TCF V2.2 has been finalized, which further supports consistency in the online advertising consent experience. The IAB Europe has released a new version of the TCF Policies (Version 2023-05-15.4.0), which establishes technical specifications and policies for CMPs, Vendors and Publishers. The TCF v. 2.2 aims to respond to the changes and needs of the advertising industry and introduce a number of iterations that relates to the Action Plan submitted to and validated by the Belgian Data Protection Authority.
For reference, the latter was the main catalyst responsible for the reform. In the case DOS-2019-01377, the Belgian DPA issued a decision on the merits, against Interactive Advertising Bureau Europe (IAB Europe) for breaching various provision of the GDPR in relation to large-scale processing of personal data, concerning the conformity of the Transparency & Consent Framework (TCF) with the GDPR and ePrivacy Directive and, specifically, the responsibility of IAB Europe and others various actors involved. The Interactive Advertising Bureau Europe (IAB Europe) is the regional branch of the Interactive Advertising Bureau (IAB) that specifically serves the European focuses on the advertising and marketing industries in the digital advertising space. It operates in coordination with the global IAB organization but has a particular focus on issues and developments relevant to the European market. IAB Europe, as IAB Global, aims to support and promote the growth of the digital advertising ecosystem through research, education, technical standards, and various industry initiatives. It plays a significant role in setting guidelines and best practices for online advertising.
The intention is for the TCF to be developed within 2024 as a GDPR Code of Conduct under Articles 40 and 41 of the GDPR. This approval is contingent upon receiving a positive opinion from the EDPB and the issuance of an implementing act by the European Commission.
As a result of the feedback received from TCF Participants, the Transparency and Consent Framework Steering Group (TCF SG) has voted to extend the previously announced date of transition to TCF 2.2 from September 30, 2023 to November 20, 2023. CMPs are now required to review and update their respective TCF implementations to transition serenely to TCF v2.2. Beginning January 16, 2024, publishers and developers using Google AdSense, Ad Manager, or AdMob will be required to use a Consent Management Platform (CMP) that has been certified by Google and has integrated with the IAB's Transparency and Consent Framework (TCF) when serving ads to users in the European Economic Area or the UK.
How Privacy Minders can help
It is likely that online advertising will continue to evolve as technology advances and privacy concerns are addressed. The industry will need to strike a balance between delivering relevant, effective advertisements while also protecting user privacy. Privacy Minders stands ready to offer its specialized expertise, providing professional consultations tailored for diverse business stakeholders. Our aim is to assist in aligning advertising practices with the evolving TCF Framework, ensuring seamless integration that meets the unique requirements of each business efficiently.
By Loukas Mavris