EU court clarifies auctioning of personal data for advertising
The European Court of Justice recently provided crucial clarification on the General Data Protection Regulation (GDPR) rules regarding the auctioning of personal data for advertising purposes. This process, known as Real Time Bidding, involves companies and advertising platforms bidding in real-time to secure advertising space on websites or applications, aiming to display targeted advertisements based on the user’s profile. However, the Court emphasized the necessity of obtaining the user’s prior consent for the collection and processing of their personal data, such as location, age, and browsing history, for marketing or advertising purposes.
IAB Europe, a non-profit association representing digital advertising and marketing sectors in Europe, proposed a solution to align the auction system with GDPR requirements. This involves the use of a ‘Transparency and Consent String’ (TC String) combined with a cookie, to encode and store users’ consent preferences. This approach allows data brokers and advertising platforms to understand the user’s consent status. Nevertheless, the Belgian Data Protection Authority identified IAB Europe as a data controller under GDPR, highlighting its failure to fully comply with the regulation’s mandates, leading to the imposition of corrective measures and a fine.
The Court of Justice’s ruling confirmed that the TC String, especially when linked with identifiers like an IP address, constitutes personal data as it can be used to profile and identify users. Moreover, it recognized IAB Europe as a ‘joint controller’, responsible for the initial recording of consent preferences in the TC String. However, the Court delineated that IAB Europe’s role as a controller does not extend to subsequent data processing operations unless it influences the determination of their purposes and means.
This landmark judgment underscores the stringent requirements of the GDPR in the realm of digital advertising, particularly the imperative of user consent and the responsibilities of entities like IAB Europe in managing personal data. It serves as a critical reminder for all stakeholders in the digital advertising ecosystem to ensure full compliance with GDPR to avoid legal repercussions.
