Digital advertising raises billions each year. But the industry involves widespread lawbreaking, privacy violations, and the concentration of power among a few large tech companies, according to a recent report conducted on behalf of the European Commission.
Since the first banner ad appeared nearly thirty years ago, digital advertising has come to dominate the web. Now tech companies share hundreds of data points about the average person every day across a complex ecosystem of buyers, sellers, and intermediaries.
“Towards a more transparent, balanced and sustainable digital advertising ecosystem” is a 274-page report by law firm AWO, published on 30 Jan. The report explores many of the problems in digital advertising and recommends three solutions to rebalance power in the system.
Here’s a look at the report and an outline of the recommendations—followed by a reminder that no individual company has to remain a part of the problem.
The Scale of the Problem
The report notes myriad issues with digital advertising, many of which relate to data protection and privacy.
The authors note that there is a “robust” EU framework for regulating the processing of personal data under the GDPR and strict requirements around cookie consent under the ePrivacy Directive.
Taken together, these two laws should—in theory—ensure that advertising companies only use personal data for limited purposes and with people’s informed, freely-given and unambiguous consent.
But the “rapidly changing and complex nature of personal data processing” in the digital advertising context can present “barriers to effective enforcement”.
There have been numerous EU court and regulatory decisions against players in the digital marketing industry. Despite this, the report suggests that unlawful and harmful advertising practices remain common.
Impact on People
Digital advertising has significant implications for people’s privacy, autonomy, and self-determination, according to the report.
The authors cite a 2022 study by the Irish Council for Civil Liberties (ICCL), which suggested that “real-time bidding” (RTB) in online advertising exposes the average European’s personal data 376 times a day.
This ICCL report also found that over a thousand European companies receive personal data from Google and that there is “no way to restrict the use of RTB data after it is broadcast”. Advertising data has been used to profile Black Lives Matter protestors and enable warrantless surveillance by the US government.
The use of “special category” (sensitive) data is common in digital advertising. Information about people’s sexuality, philosophical beliefs, and medical history is commercially available to advertisers.
A particularly stark example is the dating app Grindr, which was fined €6.5 million by the Norweigan data protection authority (DPA) for sharing special category data for advertising purposes without properly requesting consent.
As well as requesting consent in an invalid way, publishers and intermediaries often rely on their “legitimate interests” to process personal data without permission.
Relying on legitimate interest for some processing purposes is recommended under an ads industry standard known as the Transparency and Consent Framework 2.0 (TCF 2.0), published by the Interactive Advertising Bureau (IAB). The Belgian DPA declared this practice unlawful last February.
But even when giving consent, people can suffer “consent or privacy fatigue”. The report highlights a study by the Norweigan Consumer Council, which showed how Meta, Google, and Microsoft employ manipulative design to increase consent rates.
People might also consent to the use of their data for digital advertising without appreciating the consequences. Few people understand the complex and large-scale data processing techniques used to generate ads and trade advertising space.
Intermediaries, Platforms, Advertisers, and Publishers
The report explores the interrelated roles of intermediaries, platforms, advertisers and publishers in delivering ads.
In simple terms:
- Publishers sell space to display ads on properties they own.
- Advertisers pay to have their ads published.
- Intermediaries supply advertising technology (adtech) to help buy and sells ads and measure effectiveness.
Big platforms such as Google and Meta can act both as publishers and intermediaries, providing both the technology to facilitate advertising and the media via which to display it. Around 40-60% of ad spend reportedly goes to such platforms.
The dominance of “big tech” in the digital advertising ecosystem can have harmful effects on advertisers, publishers, and smaller intermediaries.
According to the report, in 2020, Alphabet (Google’s parent company) advertising revenues for the Europe, Middle East and Africa region were higher than the EU’s top 12 publishers combined.
The power of these big players in the advertising ecosystem means that advertisers and publishers feel a “sense of dependency”, describing an “abusive”, “aggressive” or “love/hate” relationship with big tech firms.
Big Changes Ahead
There are many upcoming changes to the digital advertising landscape, both in terms of the EU’s legal framework and the practices of big platforms.
Google’s “Privacy Sandbox” initiative proposes to eliminate third-party cookies from the ad ecosystem altogether, which could further consolidate the company’s market dominance.
Apple’s “App Tracking Transparency” framework forced third-party developers to request consent for cross-contextual tracking of users and had a major impact on many other market participants (most notably Meta).
This trend indicates that the industry is beginning to move away from cookies and mobile advertising IDs.
A suite of new and upcoming EU legislation could also have a major impact on digital advertising, including the Digital Service Act (DSA), Digital Markets Act (DMA), and the ePrivacy Regulation.
However, the report suggests that digital advertising will likely remain problematic without further legislative changes.
Three Recommendations to Fix Digital Advertising
The report suggests that three changes should be considered to solve the problems in the digital advertising ecosystem.
Legitimate Interests for Advertisers
The first proposal is to allow publishers and advertisers to rely on “legitimate interests” to collect their customers’ personal data.
There are some caveats:
- Advertisers and publishers would only be allowed to rely on legitimate interests in the “limited circumstances” that they have a direct relationship with the customer.
- The principles of purpose limitation and proportionality would apply.
Such a move would enable some companies to use personal data for advertising without consent. But the report also recommends the creation of a “single interface” to enable people to indicate their preferences across the entire web.
Such global consent interfaces exist already—for example, the Global Privacy Control (GPC), recognition of which is already mandatory under California law.
Intermediaries as Processors Only
The second proposal is to limit the role of intermediaries to data processors—to prohibit them from acting as controllers.
Intermediaries do not have a direct relationship with customers. This means customers can’t realistically learn who is processing their personal data and how to exercise their rights.
If forced to act only as processors, intermediaries would only be able to act on the instructions of publishers and advertisers.
Under this system, intermediaries would only be entitled to process personal data to help meet a publisher or advertiser’s objectives, in a manner determined by the publisher or advertiser.
This could help rebalance power within the digital advertising industry.
New Rules for Gatekeepers
The third proposal would restrict the activities of “gatekeepers”.
Gatekeepers are defined under the EU Digital Markets Act (DMA) as companies with at least €7.5 billion annual EU turnover providing core platform services to at least 45 million monthly EU users (for the previous three calendar years in each case).
(Think Google, Amazon, Meta, Apple, and Microsoft.)
The report notes that there is a clear imbalance of power between gatekeepers and individuals. Gatekeepers can unilaterally change their terms and can process data in a non-transparent manner.
This suggests that “consent” might never be an appropriate legal basis for processing by gatekeepers. As such, the report suggests considering a ban on “tracking for the purposes of advertising by gatekeepers”.
This move could fundamentally change the nature of digital advertising.
The Solution Already Exists
The systemic solutions described above would help reshape the digital advertising industry.
But many of the digital advertising issues identified in the report relate to non-compliance and under-enforcement.
Yet enforcement is increasing. Most of the largest GDPR and ePrivacy fines of all time concern cookies and consent. Several EU DPAs have taken proactive “cookie sweeps” to root out advertising non-compliance.
And the public is increasingly uncomfortable with the status quo. For example, a study by the consumer group Which? found that “the vast majority of participants were ‘not comfortable’ with the idea of third-party cookies collecting data without explicit consent”.
Proper implementation of the existing rules would give people real transparency and choice about how their personal data is used.
No company is forced to participate in the harmful ecosystem described in this article. Any organisation can take action today to better respect people’s privacy and data rights.
