After Third Party Tracking - Regulating the harms of behavioural advertising through consumer data protection
Clicking on consent options, such as ‘accept all’, ‘save my preferences’ or ‘reject all’, has become a constant feature of our online lives when accessing websites or using mobile apps. As many internet users are aware, these apparently simple, clickable choices lead to complex and opaque uses of our personal information. Digital services, including social media and consumer sales, ask consent to use our personal data not just for their own purposes, but also to give innumerable third parties access to that data to enable behavioural advertising (also known as targeted advertising or adtech). While contributing significantly to the funding of free online services, behavioural advertising’s reliance on cross web and cross app tracking to profile the behaviour and interests of internet users has provoked widespread public opposition as well as a global regulatory backlash.
This research project concerns the future of behavioural advertising in the face of rising legal and technical barriers to third-party cross web and cross app tracking of internet users. Examining data protection law across the UK, EU, US and China, the study identifies a similar ‘informed consumer choice’ approach to the regulation of behavioural advertising. In each of these jurisdictions, data protection laws primarily rely on user 'notice and consent' models to legitimate personal data collection for profiling purposes. This, however, raises difficult questions about the limited capacities of consumers to make informed, reasoned choices in complex digital environments and what alternative approaches may be necessary to protect them from intrusive and potentially harmful commercial surveillance. As the globalised advertising industry looks for ways to replace third party tracking, this study examines the frailties of ‘notice and consent’ based regulation, which present a key challenge for regulators in the United Kingdom.
Desk based research - legislation, regulatory rules and guidance, research reports, academic commentary, trade news reports.
Summary of Findings
- Behavioural advertising operates in similar ways across the four jurisdictions under discussion – the UK, EU, United States and China.
- Behavioural advertising has significant potential benefits and risks of harm, although the perception of these benefits and harms varies significantly with differences in cultural, social and political perspectives.
- In all four jurisdictions, behavioural advertising in the midst of major structural changes brought about by regulatory pressures as well as changes to operating systems, browsers and platform rules in relation to third party cross web and cross app tracking.
- Despite legal and policy context differences, consumer related data protection laws across the four jurisdictions all rely on notice and consent / choice frameworks as the basic mechanism for legitimising the sharing of personal data for advertising purposes.
- This key shared feature means that all four regulatory regimes face similar challenges in delivering genuinely informed and meaningful choice to consumers in complex digital environments, including behavioural advertising.
- These challenges are exceptionally important as new personalised services, devices and environments, many featuring integrated advertising, will operate on the basis of the basis of current legal and regulatory decisions regarding consumer choice and personalisation.
- While consumer data protection in the United States and China operates in distinctively different legal and policy contexts, there are clear similarities with the UK and EU in their regulatory focus on repairing the conditions and mechanisms of notice and consent / choice (‘opt ins’ and ‘opt outs’).
- Across the four jurisdictions, data protection regulators are facing the increasing problem of consumer incapacities in complex digital environments, which is evident not only in the commercial exploitation of online notice and consent / choice interfaces, but also in regulatory interventions that implicitly recognise that genuinely informed, deliberative decision making for the average consumer in these environments has become increasingly unlikely.
- Legislative, judicial and regulatory pressures, in combination with operational changes introduced by major tech platform and system providers, are now breaking down Real Time Bidding systems. The push to introduce one click online consent refusal or opt out solutions to cross web and cross app tracking has played a major part in this growing success, empowering consumers to act on their dislike of RTB’s crude and ubiquitous tracking.
- In the next behavioural advertising era, the mechanisms of data extraction, profiling and targeting will be better designed to navigate notice and consent / choice requirements and better adapted to exploit increasing consumer incapacities in complex digital environments. In this dawning era, legislative and regulatory management of online notice and consent / choice interfaces is unlikely to be a viable long-term strategy.
- Across the four jurisdictions discussed in this study, there is a broad awareness of this problem as well as an evident emergence of alternative harms based regulatory approaches to behavioural advertising, including use of principles of fairness and reasonableness, the creation of protective regimes for vulnerable groups, especially children, and the introduction of risk based regulation for artificial intelligence. Given consumer data protection law’s structural commitment to notice and consent / choice frameworks, these harms based solutions will surround and overlay with rather than replace those frameworks.
- It is apparent that the future regulation of behavioural advertising harms will occur through overlapping regulatory measures that operate both inside and data protection law. To be effective, this needs to be carefully planned and coherently applied rather than developing as an ad hoc series of responses to the weaknesses of notice and consent / choi
The project produced two revised reports in May 2022:
Both reports were delivered to the Information Commissioner's Office. On 20 June 2022, the Competition and Markets Authority (CMA) requested the PI Perry Keller to provide an in-house CMA seminar based on the final report.