In a ruling in principle, the Court of Justice of the European Union has ruled that the most widely used system in Europe to sell online advertisements and place them on websites and apps falls under privacy legislation (GDPR).
The ruling revolves around an essential element of that system of online advertising: the cookie consent popups. This asks users for permission to track their online behavior in order to tailor targeted advertisements accordingly.
The information that users provide about their preferences in such a pop-up window is stored in numbers and strings of characters that are shared with large numbers of data brokers and advertising platforms. A cookie is also placed on the user’s computer or telephone.
The highest European court has now ruled that these series may contain information about identifiable users (for example by linking to a user’s IP address), and must therefore be considered personal data. This means that the information falls under the strict European privacy rules (GDPR). National supervisors of privacy rules, such as the Dutch Data Protection Authority, had previously determined this.
Boundaries set
According to the digital civil rights organization Bits of Freedom, the Court’s ruling represents a setback for the advertising world, especially when it comes to targeted advertising. “This clearly shows that the current system, in which people are tracked and profiles are created, is not sustainable,” says Rejo Zenger, privacy expert at Bits of Freedom.
Jef Ausloos of the Institute for Information Law at the University of Amsterdam also endorses this. “This is an important step that sets limits on the collection of personal data, so that your computer can no longer be completely drained.”
Like Bits of Freedom, Ausloos also supported the Belgian Data Protection Authority, which is leading the legal battle against the designer of the online advertising system, the Belgium-based association IAB Europe.
The advertising sector interprets the Court’s ruling differently and sees no threat to its revenue model. The industry disputes that personal advertising is now impossible due to the Court’s ruling. “The system has already been adjusted and will be further adjusted,” says Saskia Baneke, director of VIA Netherlands, a network for companies in marketing, communication and advertising. Her organization is a licensee of the controversial system in the Netherlands.
“The internet must remain affordable,” says Baneke, referring to publishers’ income from targeted placement of advertisements. Advertisers prefer to serve their advertisements to Internet users whom they know enough to expect will be interested in their products. “With adjustments”, advertisements aimed at personal surfing behavior will remain possible in the future, without conflicting with the GDPR, Baneke assures.
Of course, advertising on websites and apps must remain possible to ensure free access, Ausloos acknowledges. “But that advertising must also be possible without a whole surveillance infrastructure behind it. That is the internet that I and many others want.”
Breakneck pace
The complex system of online advertising that the Court examined takes place largely out of sight of the internet user. Everything is happening at breakneck speed.
When someone visits a website or an app where advertising space is available, the Court stated, all kinds of companies, data brokers and advertising platforms representing thousands of advertisers can “instantly bid for that advertising space behind the scenes in order to show advertising tailored to it.” on that user’s profile”. That’s the so-called real-time bidding.
But before those ads can be shown, the user must agree to the sharing of various personal data (such as location, search history, recent purchases) with advertising providers. IAB Europe has designed the system with consent cookies for this purpose. That system has been controversial and litigated against for years. It is unclear whether users who click ‘yes’ or ‘agree’ also realize what exactly they are agreeing to and that they are providing widespread insight into their behavior online.