Abstract
Behaviourally-targeted online advertising plays a major role in financing the modern internet economy. Yet, its core business model relies on user surveillance and data sharing between opaque partnerships of multitudinous industry partners. This report interrogates the compatibility between the technical and organizational underpinnings of behaviourally-targeted advertising and the legal requirements of European Union data protection law. The juxtaposition of real-time bidding and online tracking on one hand and the requirements of the General Data Protection Regulation (GDPR) on the other reveals fundamental issues in delineating and regulating controller-processor relationships, securing an appropriate standard of consent as a legal basis for data processing, and maintaining appropriate levels of security and transparency. This report concludes that these issues are largely inherent in the technological and organizational structure of the behaviourally-targeted advertising industry, and only further exacerbated by pervasive noncompliant conduct on the part of the industry. Currently proposed technical solutions for the data protection gap in behaviourally-targeted advertising fall short of achieving harmony with European Union law, indicating the need for a regulatory push toward personal datafree and privacy-friendly technologies.
Les hele utgivelsen CompLex 2022-01 (pdf)