The Information Commissioner’s Office (ICO) has warned the adtech industry it needs to comply with data protection law and stop the “excessive” collection and use of people’s data.
Announced today (25 November), the privacy standards published in a Commissioner’s Opinion come as a warning and reminder to companies – such as Google – that are designing new methods of online advertising.
Information Commissioner Elizabeth Denham states: “Digital advertising is a complex ecosystem that grew quickly with the e-commerce boom and without people’s privacy in mind.
“What we found during our ongoing adtech work is that companies are collecting and sharing a person’s information with hundreds, if not thousands of companies, about what that person is doing and looking at online in order to show targeted ads or content. Most of the time, individuals are not aware that this is happening or have not given their explicit consent. This must change.
“That is why we want to influence current and future commercial proposals on methods for online advertising early on, so that the changes made are not just window dressing, but actually give people meaningful control over their personal data.”
Currently, one of the “most significant” proposals in the online advertising space is the Google Privacy Sandbox, which aims to replace the use of third party cookies with alternative technologies that still enable targeted digital advertising.
In an update in June, Google noted that “it’s become clear that more time is needed across the ecosystem to get this right”.
Google explained that subject to its engagement with the Competition and Markets Authority (CMA), Chrome could then phase out third-party cookies over a three month period, starting in mid-2023 and ending in late 2023.
The ICO says it has been working with the CMA to review how Google’s plans will safeguard people’s personal data.
It’s not just about Google. Other industry players have been developing different initiatives so people’s preferences are taken into account. The Commissioner’s Opinion is its desire to provide clear data protection expectations for any developers in this area.
The Opinion makes it clear that companies designing new adtech should offer people the ability to receive ads without tracking, profiling or targeting.
If people choose to share their data, all companies within the adtech supply chain must ensure there is “meaningful accountability”, and give people control over their data and the ability to exercise their information rights.
Denham adds: “I am looking for solutions that eliminate intrusive online tracking and profiling practices, and give people meaningful choice over the use of their personal data. My office will not accept proposals based on underlying adtech concepts that replicate or seek to maintain the status quo.”
The ICO began intervening in the adtech industry in 2019, when it identified “key privacy issues” on real time bidding and on the use of cookies and similar technologies. It asked the industry to assess how they used personal data and to start changing their practices.
Since then, companies have been developing solutions to address its concerns and are moving towards less intrusive tracking practices. The Opinion published today will “help companies shape their proposals”.
In other news, and reported in September, the UK government was aiming for better security and innovation in data with an overhaul of the ICO and an open consultation.
The government launched a consultation on proposed changes to the UK’s data landscape. As part of this, a new governance model is planned for the ICO, including an independent board and chief executive to mirror the governance structures of other regulators such as the CMA, Financial Conduct Authority and Ofcom.
