UK: ICO Investigates Adtech Awareness Through Fact Finding Forum

The Information Commissioner's Office (ICO) recently published a summary report of its fact finding forum on data protection issues arising from advertising technology (adtech). Adtech is a term commonly used to refer to all technologies, software and services used for delivering and targeting online advertisements.

The ICO compiled responses from over 2,300 participants in an online survey, and conducted fieldwork with more than a hundred stakeholders (publishers, advertisers, start-ups, adtech firms, lawyers and citizens). The ICO highlighted three key challenges of adtech: (i) transparency, (ii) lawful basis and (iii) security.

One of the key findings of the forum was the consumers' lack of understanding of online advertising and Real Time Bidding (RTB). Most respondents were unclear about how RTB works, how their data is used and how adverts are funded. This was evident when comparing their answers before and after they were provided with a description of adtech.

One of the questions in the online survey was "How acceptable is it that some websites display adverts in return for the websites being used for free?" Before explaining adtech, 63 per cent of users responded that it was acceptable how adverts fund contents, and 54 per cent preferred to see adverts that are relevant to them. However, half of the respondents did not recall seeing any explanation on websites on how adverts are personalised (this would normally appear as a 'cookies' notice to be accepted to continue browsing on a webpage).

The respondents then received an explanation of how adtech works, clarifying that when you visit a website, certain information may be collected by the website and merged with other information about you. This will then be shared (via third party intermediaries) with advertisers who then bid against each other to display their advert to you. This process will happen in an instant. Unsurprisingly, upon receiving this explanation, the number of respondents considering the acceptability of how their data is shared fell dramatically to 36 percent.

The lack of transparency also became clear as the majority of respondents thought that their browsing history, purchase history and location were the main types of information used to generate adverts when, in fact, gender, device identifiers, IP addresses, year of birth and unique user ID codes are also shared with advertisers.

The lawful basis required under GDPR to process personal data in the RTB process was also debated, in particular the reliance on consent. Publishers argued that the more visible the consent mechanisms, the more this encouraged users to click 'no'. This would tilt the balance in favour of bigger industry players, who obtain consent through social media platforms, to then "sweep up the revenue". On the other hand, consent ought to be treated with caution as not many users usually understand what they are really consenting to.

Stakeholders also considered the importance of preserving security between the various controllers and processors in an RTB bid request, especially given the lack of control over where personal data is shared. Others also pointed to data in RTB being used for negative targeting, hence more needed to be done to protect data subjects, especially vulnerable groups such as children.

Comment – change on the horizon?

Despite the obvious tensions between adtech and data protection, stakeholders appear prepared to have constructive discussions to reach a consensus to improve the system, especially for consumers. The ICO is set to use the findings of this investigation and take imminent action to align the increasingly sophisticated advertising technology with today's legislative framework.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.