Personal data and digital advertising

Personal data and digital advertising

Since the first digital ad was published in 1995, the digital advertising market, as a consequence of the accelerating globalisation and consolidation of the internet, has undergone significant and regular transformations. As of today, digital advertising is the largest advertising channel in the European Economic Area (hereafter “EEA”), generating more revenue than all other offline advertising channels combined, reaching 0.3 % of EEA GDP by 2021. 

However, the truth is that digital advertising is often based on profiling methods that can have unpredictable consequences for data protection rights, security and democracy.

How is your personal data used in digital advertising?

A recent study by the European Commission concludes that the most popular methods of digital advertising are based on the use of large amounts of personal data and profiling for advertising targeting purposes. Through the use of common identifiers, companies can get an idea of a person’s online behaviour.

What regulations protect personal rights in digital advertising?

According to the European Commission, there is an important regulatory framework at the European level that must be respected in any case. 

Firstly, the GDPR stands as the basis or main pillar of current privacy regulation. Through the provisions of Article 21.2, the GDPR gives data subjects the right to object to the processing of their personal data for digital advertising purposes at any time. This being the case, those responsible for digital advertising addressed to a user must ensure that they implement specific and easily accessible tools for the exercise of this right. 

In practice, the implementation of a tool that allows users to “opt-out” of behavioural advertising is the most common practice to comply with the aforementioned provisions of the GDPR. However, the European Commission considers that this method is only optimal if it is implemented through the use of tools that are easily accessible and sufficient information is provided on the actions that the company takes to carry out the “deactivation”. 

Secondly, the current e-privacy Directive, expected to be repealed when an agreement on the e-privacy Regulation is reached, is responsible for requiring internet service providers that make use of cookies to implement a cookie notice that makes it as easy to reject cookies as it is to accept them.

Thirdly, compliance with competition law is of particular importance in the area of digital advertising. Examples include the recent sanction imposed by the European Commission on Google for using restrictive clauses in contracts with third party websites to prevent rivals from placing ads on those websites, or the investigations launched against Google and Meta by the European Commission to determine whether these platforms benefit from information provided by their advertising clients to compete with them. 

The truth is that through Articles 101 and 102 of the Treaty on the Functioning of the European Union, the legislator has generated a proactive regime with respect to anti-competitive agreements and practices that may develop in digital advertising. 

In addition, the recently adopted Digital Markets Act (hereinafter “DMA”), which became fully applicable on 2 May, includes provisions designed to “further improve the fairness, transparency and contestability of online advertising services”, such as the right of advertisers and publishers to have free access to the performance measurement tools of digital platforms, as well as the data necessary for them to carry out their own verification of the provision of the relevant online advertising services.

How does the use of personal data in digital advertising affect users?

One of the major concerns about the development of digital advertising techniques is that the most common processes for delivering behavioural advertising work in a fully automated way, i.e. without any human intervention whatsoever. This being so, their outcome is entirely dependent on an algorithm that has been trained in a completely confidential manner and about which little information is provided to stakeholders. 

In other words, despite the significant effect that behavioural advertising can have on the individual, whether consciously or unconsciously, neither the competent authorities nor the data subjects themselves are fully aware of the mechanisms by which these decisions are made, with the consequent risk of being subject to biased trained algorithms.

This being the case, the recently passed Digital Services Act (hereinafter “DMA”) imposes obligations on the authorities to promote transparency towards stakeholders.

What do I need to consider as a digital advertiser? 

In any case, providing useful tools to users so that they can control the use of their personal data in digital advertising, including how to avoid unwanted targeting, is a key issue. 

In addition, it is important to implement measures to improve the transparency of the inner workings of personal data processing methods.