A cookie system that over 80 percent of websites and apps in Europe use to collect consumer data is illegal. The Belgian privacy watchdog established this last week after complaints from, among others, the Netherlands.
The complaints concern the system of the online advertising organization IAB Europe, a key player in this market. The data collected with its system is used to draw up profiles of consumers. On this basis, internet users are presented with advertisements that match their presumed interests.
IAB has been fined 250,000 euros by the Belgian regulator. The company has two months to adjust its system.
Targeted advertising
The complaint was filed by a group of organizations and individuals, including the Dutch privacy organization Bits of Freedom and the Belgian researcher Jef Ausloos of the Institute for Information Law of the University of Amsterdam.
Since IAB Europe is based in Brussels, the Belgian Data Protection Authority has looked into the complaint. She has shared her insights with other national supervisors, including the Dutch Data Protection Authority. These have agreed with the Belgian judgment.
The core of the indictment is the so-called Transparency and Consent Framework (TCF), which IAB Europe has set up to obtain consent from web users for the collection of their surfing data. This system forms the basis of automated auctions, in which surfing behavior on websites, processed in profiles with interests, activities and behaviour, is immediately linked to targeted advertising. Anyone looking for new shoes will then see a shoe store advertisement on a news site, for example.
According to the Belgian regulator, this system is not transparent, because consumers have no idea that they are giving permission for their data to be used by thousands of advertising companies that they do not even know. For example, they cannot exercise their right to control the use of their data and are therefore insufficiently protected.
Also read: Regulators: Ban online tracking and personal ads
In the Netherlands, DPG Media, publisher of Nu.nl, Volkskrant and Libelle, Mediahuis Nederland (Telegraaf, regional newspapers) and RTL (with advertising auction SpotX), among others, use the TCF system of IAB Europe. They convert tens of millions of euros in advertising via TCF and have to look for another method. They can opt for advertising that matches the content of articles: ‘context-related’ advertisements. NRC Media previously did this voluntarily.
Incidentally, the disapproval of the IAB Europe system is beneficial for the largest parties in online advertising, Facebook and Google, which are allowed to continue extensive profiling of consumers. Their systems for obtaining consent for cookie use do meet the conditions of the GDPR privacy law for the time being
‘Opaque and manipulative’
The European consumer organization BEUC speaks of a completely justified decision, which could have major consequences. Deputy Director Ursula Pachl: “This decision could curb the entire way of online advertising with tracking technology. That should have happened much earlier. Online advertising companies often use consent mechanisms that are opaque and manipulative and do not give consumers a real choice to say ‘no’.”
Pachl thinks the fine imposed is far too low, because billions are involved in this trade.
Dutch lawyer Christiaan Alberdingk Thijm, who specializes in this matter, confirms Pachl’s interpretation: “This could mean the death blow for the use of tracking cookies for data processing and targeted advertising.”
Lauren Wakefield, marketing director of IAB Europe, does not see a total ban on the application of the TCF system in the opinion of the regulator. After all, it can be adjusted. However, her company has serious objections to the view of the regulators that IAB Europe is responsible for the data processing, and not the websites that ask the consumer for permission on the screen. IAB is therefore considering legal action. That would mean a case before the European Court of Justice.
‘Inherently rotten’
Jef Ausloos of the Institute for Information Law, co-author of the complaint against IAB Europe, considers successful adaptation of the TCF almost impossible. “The whole structure and the revenue model have in fact been rejected by the regulators. It is inherently rotten.” Nevertheless, he expects that IAB Europe will pull out all the stops to be able to use the system for as long as possible.