Why has this Opinion been published?
The ICO published a report on adtech and specifically real time bidding back in 2019 (which we summarised in our previous article) and launched an investigation into such techniques in the advertising eco-system. Active investigations were put on hold as a result of Covid and this Opinion addresses developments since then. In particular, it sits alongside the work that the ICO has been doing with the Competition and Markets Authority (CMA) and considers the work undertaken by various bodies and organisations in recent years to develop alternative solutions to real time bidding that remove reliance on third party cookie tracking.
The Opinion carefully reserves any judgement on any particular new solutions and is far from a decision focused on the sandbox or any other programme but instead it sets out a reminder to all of what data protection law requires in developing any new solution involving the processing of personal data. In this respect, it acts as a warning shot that organisations should not assume that just removing third party or indeed any cookies from an advertising solution will circumvent privacy concerns.
Is it Binding?
No. The document is an Opinion issued under its advisory powers in the UK Data Protection Act and provides the ICO’s view but not is not a decision or official guidance. As such, it is still very useful and important in guiding industry participants on what the regulator’s views and expectations are. However, the Opinion stresses that it is the ICO’s view at the time of publication and may be subject to change.
What are the key points of the Opinion?
The Opinion doesn’t offer much by way of surprises unlike perhaps some other draft guidance issued previously from the ICO such as its draft code on marketing which has still not get progressed further.
In large part, it is most useful in providing an overview for those who have understandably been confused by the rather frantic pace of regulatory and industry developments in adtech in scene setting what these are. In this respect, it covers a lot of ground including the evolution of cookie and browser and mobile software technology, standards body initiatives, the IAB’s transparency and consent framework (noting here that the ICO is following the Belgian regulator’s current investigation) as well as other specifications such as Global Privacy Control and Advanced Data Protection Control which have received less attention to date.
The Opinion does acknowledge that many of the industry developments in adtech are positive. Specifically, initiatives that focus on more control for users, better transparency and valid consent where required. However, it contains a bold warning:
“The use of cookies evolved from their original purpose into a vehicle for gathering and processing significant volumes of both device information and data of a highly personal nature. The evolution of cookies and their use for targeted advertising is a cautionary tale of the risks of repurposing technology without also building in safeguards to protect against misuse and harm. Their deprecation is a positive step. However, this does not mean that their proposed replacements are inevitably better.”