Digital advertising in the crossfire of upcoming EU regulations – International Association of Privacy Professionals


The day’s top stories from around the world
Where the real conversations in privacy happen
Original reporting and feature articles on the latest privacy developments
Alerts and legal analysis of legislative trends
Exploring the technology of privacy
A roundup of the top Canadian privacy news
A roundup of the top European data protection news
A roundup of the top privacy news from the Asia-Pacific region
A roundup of the top privacy news from Latin America
A roundup of US privacy news
Talk privacy and network with local members at IAPP KnowledgeNet Chapter meetings, taking place worldwide.
Advisory Board, KnowledgeNet Chapter Chair and Young Privacy Professional applications are now open. (Leadership positions are for members only. Join today.)
Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.
Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.
Locate and network with fellow privacy professionals using this peer-to-peer directory.
Review a filterable list of conferences, KnowledgeNets, LinkedIn Live broadcasts, networking events, web conferences and more.
Understand Europe’s framework of laws, regulations and policies, most significantly the GDPR.
Steer a course through the interconnected web of federal and state laws governing U.S. data privacy.
Learn the intricacies of Canada’s distinctive federal/provincial/territorial data privacy governance systems.
Develop the skills to design, build and operate a comprehensive data protection program.
Add to your tech knowledge with deep training in privacy-enhancing technologies and how to deploy them.
Introductory training that builds organizations of professionals with working privacy knowledge.
Learn the legal, operational and compliance requirements of the EU regulation and its global influence.
Meet the stringent requirements to earn this American Bar Association-certified designation.
The global standard for the go-to person for privacy laws, regulations and frameworks
The first and only privacy certification for professionals who manage day-to-day operations
As technology professionals take on greater privacy responsibilities, our updated certification is keeping pace with 50% new content covering the latest developments.
Recognizing the advanced knowledge and issue-spotting skills a privacy pro must attain in today’s complex world of data privacy.
The first title to verify you meet stringent requirements for knowledge, skill, proficiency and ethics in privacy law, and one of the ABA’s newest accredited specialties.
The IAPP’S CIPP/E and CIPM are the ANSI/ISO-accredited, industry-recognized combination for GDPR readiness. Learn more today.
Mostre seus conhecimentos na gestão do programa de privacidade e na legislação brasileira sobre privacidade.
Certification des compétences du DPO fondée sur la législation et règlementation française et européenne, agréée par la CNIL.
Use the Vendor Demo Center, Privacy Vendor List and Privacy Tech Vendor Report to easily identify privacy products and services to support your work.
On this topic page, you can find the IAPP’s collection of coverage, analysis and resources related to international data transfers.
The IAPP’s US State Privacy Legislation Tracker consists of proposed and enacted comprehensive state privacy bills from across the U.S.
This tracker organizes the privacy-related bills proposed in Congress to keep our members informed of developments within the federal privacy landscape.
Access all reports and surveys published by the IAPP.
Access all white papers published by the IAPP.
IAPP members can get up-to-date information here on the California Consumer Privacy Act and the California Privacy Rights Act.
The IAPP’s EU General Data Protection Regulation page collects the guidance, analysis, tools and resources you need to make sure you’re meeting your obligations.
This chart maps several comprehensive data protection laws to assist our members in understanding how data protection is being approached around the world.
This interactive tool provides IAPP members access to critical GDPR resources — all in one location.
Join DACH-region data protection professionals for practical discussions of issues and solutions. Presented in German and English.
P.S.R. 2022 is the place for speakers, workshops and networking focused on the intersection of privacy and technology.
Europe’s top experts predict the evolving landscape and give insights into best practices for your privacy programme.
Gain exclusive insights about the ever-changing data privacy landscape in ANZ and beyond.
Explore the full range of U.K. data protection issues, from global policy to daily operational details.
Concentrated learning, sharing, and networking with all sessions delivered in parallel tracks — one in French, the other in English.
The world’s top privacy conference. Whether you work in the public or private sector, anywhere in the world, the Summit is your can’t-miss event.
View our open calls and submission instructions.
Increase visibility for your organization — check out sponsorship opportunities today.
Review upcoming IAPP conferences to see which need to be included in your schedule for the year ahead.
Start taking advantage of the many IAPP member benefits today
See our list of high-profile corporate members—and find out why you should become one, too
Don’t miss out for a minute—continue accessing your benefits
Review current member benefits available to Australia and New Zealand members
EU institutions have recently reached a political agreement on the Digital Markets Act and Digital Services Act. These regulations are set to have far-reaching consequences for the digital economy, particularly on how data is collected and processed for online advertising.
The European co-legislators intended to address the online advertising industry, which collects massive amounts of data and bolsters a market imbalance that favors a small number of large technology companies.
“We are optimistic that the DMA and DSA will address the gross imbalance of market power by a few large tech companies. The majority of the impact will be on the ability of these companies to continue profiling and targeting consumers across their digital lives,” said Chris Pedigo, Senior Vice President at Digital Content Next, an association of premium publishers.
The Digital Markets Act is legislation targeting only a few companies with significant market power (Google, Amazon, Meta, Apple, Microsoft and the likes) to make the digital market more contestable and enable the business users to bypass these gatekeepers.
The Big Tech law includes provisions specific to advertising, as companies like Google and Meta will have to provide access to the relevant ad performance tools. So far, advertisers could not know for sure that their campaigns were running on the best value money.
As a result, on measurement, the gatekeepers will have to open up their “walled gardens” to other players in the ecosystem, such as advertisers, adtech and publishers. What remains to be seen is how this obligation will be operationalized, for instance, if the data will be comparable across different gatekeeper platforms.
However, the data provisions of the DMA underwent a last-minute surprise. After a political agreement was reached March 24, the text went back to the technical level for “fine-tuning.” When a new version leaked almost a month later, the article that regulated how gatekeepers manage and process data were turned upside down.
The Irish Council for Civil Liberties lobbied to change this article to clarify that the gatekeepers would have to require consent for each data processing purpose. Instead, the initial text left the door open for a single sign-in option.
At the same time, the ICCL insisted on putting the European Commission in charge of supervising what so far had been a prerogative of Data Protection Authorities.
The initially accepted ICCL amendment was completely changed afterward, prompting the reaction of privacy advocates and competition experts. Publishers from both sides of the Atlantic echoed these concerns, particularly the potential loophole related to digital advertising that could further strengthen the gatekeepers’ dominant position.
A new paragraph was added to prevent gatekeepers from processing the personal data of users who are using a third-party service without their explicit consent for the purpose of providing advertising services.
Critics pointed out that there are dozens of data processing activities behind the display of an ad, where the wording suggested there was only one purpose. Once again, this ambiguity was seen as favoring gatekeepers that could argue for a single opt-in option, while the other companies would have to list all the processing purposes for advertising as required by the EU General Data Protection Regulation.
The leading lawmakers pushed back against this criticism, stressing there was no ambiguity since the DMA was never meant to supersede the GDPR. The commission made a similar point, arguing these concerns are based on a “misunderstanding of the notion of consent as provided for in the GDPR,” and that the DMA complements but does not alter the data protection rulebook.
In spite of this latest spat, many European companies look at the DMA positively as a way to try to rebalance the power relations with the tech giants. The question mark now is to what extent the European Commission will be able to enforce these obligations.
“Gatekeepers do not try to comply with the law — they merely try not to get caught. I therefore do not expect them to change anything of importance by themselves,” said Johannes Kotte, managing director of Visual Meta, an online shopping portal.
Visual Meta is one of the “aggrieved parties” in the Google Shopping case, which criticized Google for leveraging its market-dominant position to favor its shopping unit. Even though the case was upheld by the Court of Justice of the European Union after more than 10 years of litigation, Visual Meta insists that Google is still not complying with the commission’s decision.
One month after the DMA agreement, it was the turn of the Digital Services Act, horizontal legislation that will provide rules on content moderation, platform accountability, illegal products and risk management for all actors operating in the European digital single market.
The DSA includes provisions for the protection of minors, a compromise concession made to left-to-center MEPs who were pushing for a total ban on targeted advertising. In particular, targeted advertising based on the use of the personal data of minors is prohibited.
Moreover, according to the agreement, online platforms accessible to minors will have to put in place a high level of privacy, safety and security for minors, notably in terms of online interfaces, adopting relevant industry standards or participating in codes of conduct.
The debate here focused on how to identify minors while respecting the data minimization principle of the GDPR. Privacy-sensitive lawmakers advocated that the platforms will not have to process additional data to assess that a user is a minor. However, the wording on accessibility is not entirely clear to industry practitioners as, in principle, the web could get flooded with age-gating pop-ups. 
“I’m not entirely sure how this would play out in any clear and executable manner,” said Otto Lindholm, Head of Data and Privacy at Dottir. “My guess is that we will continue insufficient and confusing executions in operationalizing the obligation, rather than seeing the platforms, publishers and advertisers taking the most cautious route and decrease their advertising.”
Progressive MEPs also managed to include in the DSA a ban on advertising based on the profiling of users that employs sensitive data as defined under the GDPR. This concept includes political views, religious beliefs, sexual orientation and racial information.
The proposal was initially resisted by some member states that believe users should be able to choose whether they could get targeted on these bases or not. However, lawmakers insisted on a ban since requesting consent is already covered in the GDPR.
“The ban decided under the DSA will likely have to be enforced by the DPAs considering the direct reference these measures make to the GDPR. The DPAs are familiar with the impact of inferred data, and how they constitute personal data, hopefully, the enforcement of this ban will be comprehensive,” Access Now Global Data Protection Lead Estelle Massé said.
At the same time, privacy advocates have criticized the provisions as “missing the mark.” The criticism is related to the fact that the ban only refers to profiling, whereas most of the targeted ads are based on statistical inference. By contrast, from the industry perspective, civil society is pushing for an interpretation of sensitive data as broadly as possible in order to expand the DSA ban. 
On the eve of the first turn of the French presidential elections, far-right candidate Eric Zemmour tried to mobilize the Jewish community by targeting thousands of Jews with anti-Muslim content. The Commission nationale de l’informatique et des libertés, the French DPA, opened an investigation; it is not clear if the DSA’s sensitive data ban would prevent this sort of aggressive campaigning.
There is currently little guidance by the data protection authorities in relation to sensitive data, but the general trend seems to point out that the determining factors would be the intention and usage of the ads. 
“If you can infer relevant information with a reasonable degree of certainty then it’s likely to be special category data even if it’s not a cast-iron certainty. But if it is just a possible inference or an ‘educated guess,’ it is not special category data (unless you are specifically processing to treat someone differently on the basis of that inference) — even if that guess turns out to be right,” the U.K. Information Commissioner’s Office advises.
What is clear, however, is that the wording limited to profiling was also pushed by Google, as revealed by documents obtained by the NGOs Corporate Europe Observatory and Global Witness. The advertising giant has been working on moving away from individual profiles based on cookies to aggregate data based on groups (i.e. cohorts) or theme-based targeting (i.e., topics).
However, the DSA’s final text has not been circulated yet. Therefore, some last-minute changes to these provisions cannot be excluded.
Photo by Nathan Watson on Unsplash
Submit for CPEs
If you want to comment on this post, you need to login.
The IAPP is the largest and most comprehensive global information privacy community and resource. Founded in 2000, the IAPP is a not-for-profit organization that helps define, promote and improve the privacy profession globally.
The IAPP is the only place you’ll find a comprehensive body of resources, knowledge and experts to help you navigate the complex landscape of today’s data-driven world. We offer individual, corporate and group memberships, and all members have access to an extensive array of benefits.
© 2022 International Association of Privacy Professionals.
All rights reserved.
Pease International Tradeport, 75 Rochester Ave.
Portsmouth, NH 03801 USA • +1 603.427.9200


Leave a Reply

Your email address will not be published.