How has this come about?
This report is not coming out of the blue. The ICO has held various outreach sessions on adtech with business over the last year, was very clear in its GDPR anniversary report that adtech would be a focus for the year ahead. Further, specific complaints against Google and programmatic advertising practices are being investigated in both Ireland and the UK and both regulators have talked about this. We were expecting and even hoping for more clarity on the ICO’s stance therefore, so this is not a surprise. The only thing which is perhaps surprising is that the ICO has only focused on RTB in this report. It is separating out practices that are at the more complicated end of adtech for specific attention but many of the points they raise can also be applied to wider technologies and processing.