Advertising products and services has changed significantly since social networks and mobile apps became a reality. For instance, users are tracked throughout the internet, their behaviour is traced, their preferences are stored, they live an online life they are not always aware of.
There has been a lot of comment on the risks associated with online advertising. There are real privacy concerns but that is just the tip of the iceberg. People are influenced by a number of factors and, in particular, by the combination of the promotion of products / services they are interested in, and the websites actually surfed and displaying ads: this is the so called "targeted advertising" and, in short, it is not always clear-cut how online advertising works and who benefits from it.
How does targeted advertising work?
Users are usually "tracked-down" through the dynamic IP addresses of their device and other related information (such as user ID, user agents, etc.). Of course the same device can be used by different people, so the data collected would then be associated with more than one individual and the generated profile would be that of a group rather than of an individual. Yet people usually use their own device, so information associated with the IP address is likely to be representative of the user of it.
By surfing the Internet, clicking a banner, selecting an item, opening a page, the user gets analysed: his/her preferences will be proposed again in the future and they will be associated with specific categories of individuals, as defined by the online advertising product-chain (including publishers, media agencies / centres, web monitoring service providers, etc.).
Website users are monitored mainly by the cookies ̶ markers tracing where the users go and what they do. This is the key tool behind online advertising. To use such information, websites need to comply with the law, in particular with legislation concerning privacy. The users have the right to be informed when advertising cookies are put on their devices and their consent is collected.
Apps are a separate environment that is not able to communicate with other environments without the users' authorization. The users are linked to an ID number provided by the apps store, so the user's behaviour is traced throughout the app. Apps providers usually communicate the user's ID to advertising partners that provide analytics and identify the users as belonging to specific categories of individuals.
The methods of online advertising
To ensure compliance with privacy laws, users are required to express their consent to be traced and to receive targeted advertising: the banner briefly describes to the users the categories of cookies that can be deployed on the users' devices. Consent is provided either by ticking a box or by continuing to use the website. The provision of consent by behaviour such as scrolling down the page will probably be challenged soon as EU Regulation 679/2016 ("GDPR") requires consent to be explicit. It is worth noting that the provision of consent for cookies by such methods is advantageous for publishers as the users are frequently unaware that they are providing consent.
On apps, users receive advertising push notifications or banners; the content of advertising is derived by monitoring the user's behaviour on the app and by collecting further data from external sources. To send marketing communications, as the use of banners and scrolling pages is only permitted on websites, app providers are required to collect user's consent to advertising (e.g. providing a box that describes their marketing activities and methods). Also, to ensure that their products and services are proposed to users (that can be active or prospect), app providers use agencies that create advertising content and publish it in other environments (e.g. social networks). The apps represent a new method and it is worth saying that either the legal framework applying to websites will be extended to the apps or dedicated legislation will be enacted.
The new provisions regarding personal data in electronic communications
The legal framework concerning cookies will be influenced by the Regulation concerning the respect for private life and the protection of personal data in electronic communications (the ePrivacy Regulation), that has not been completed yet. The ePrivacy Regulation will particularise and complement the legal framework applicable to the processing of personal data, mainly regulated by GDPR. The text of ePrivacy Regulation available is not binding at the moment but it is worth noting that a number of provisions, if confirmed, shall need to be taken into account. The text of ePrivacy
Regulation provides that the definitions of the GDPR shall apply and that consent of the user has the same meaning and is subject to the same conditions as the data subject's consent according to GDPR. The GDPR requires that consent is provided by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data. On this regard, the GDPR refers to the actions as ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates the data subject's acceptance of the proposed processing of the personal data. Therefore, it shall be necessary to ascertain whether scrolling down pages (as it is required in many websites) can be considered a valid consent according to the GDPR requirements.
Dentons is the world's first polycentric global law firm. A top 20 firm on the Acritas 2015 Global Elite Brand Index, the Firm is committed to challenging the status quo in delivering consistent and uncompromising quality and value in new and inventive ways. Driven to provide clients a competitive edge, and connected to the communities where its clients want to do business, Dentons knows that understanding local cultures is crucial to successfully completing a deal, resolving a dispute or solving a business challenge. Now the world's largest law firm, Dentons' global team builds agile, tailored solutions to meet the local, national and global needs of private and public clients of any size in more than 125 locations serving 50-plus countries. www.dentons.com.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
