Business practices of Google and other players in the digital advertisement market are reportedly under the lens of the Belgian privacy regulator. The country’s Data Protection Authority (DPA) has found that the consent-seeking mechanism with which these companies collect personal data of users is not compliant with the European Union’s General Data Protection Regulation (GDPR), the Wall Street Journal and TechCrunch reported.

The Belgian DPA had been acting complaints about the use of personal data to target users with “behavioural ads”. The complaints were made against the real-time bidding (RTB) bidding component of the advertising system. RTB tools like Google Ad Manager allow advertising buyers to buy ads on the basis of impressions — the tool automatically places bids to buy ads on a publisher’s website, which, if won, are immediately displayed there. The DPA was investigating whether the RTB component, with its high velocity personal data trading, is compatible with EU law.

Consent-seeking framework of ad industry body isn’t cutting it

Just a month after the GDPR came into effect in May 2018, an advertising industry body Interactive Advertising Bureau (IAB) Europe came up with a framework called the Transparency and Consent Framework (TCF) to comply with all regulations. TCF was revised in 2019 with tightened rules on seeking user consent. Google, possibly the largest player in the global adtech market, adopted the revised framework TCF 2.0 in August this year.

However, the Belgian DPA’s investigation is reported to have revealed that TCF does not, in fact, comply with GDPR principles on transparency, fairness and accountability. Additionally, it found that TCF allows market players to process sensitive data such as health information, political affiliation and sexual orientation without actually having adequate rules for them. 

Furthermore, IAB Europe was found to have not appointed a data protection officer — required under GDPR rules — nor did it have a register of its own data processing activities.

Concerns around RTB systems: RTB systems have been flagged in the past by multiple observers in Europe. For instance, the Irish Council of Civil Liberties (ICCL) had published a report last month that adtech companies compliant with IAB Europe’s framework had used RTB systems to target LBBTQ+ people during the Polish parliamentary elections in 2019, profiled users based on health issues such as substance abuse, chronic pain, sexual abuse and depression.

Both the ICCL and the Belgian DPA’s findings raise alarming questions over the functioning of RTB systems function in the world. Readers should note that these are the findings of a regulator in the European Union, which has extensive personal data protection laws and regulations like the GDPR. India, on that other hand, still doesn’t have a law — the Personal Data Protection Bill, 2019 is currently being considered by a Joint Parliamentary Committee.

IAB Europe disagrees with Belgian DPA’s report

The IAB Europe, in a statement, said said that the Belgian DPA’s report is only a preliminary one, and has no binding effect. It said that TCF is a voluntary standards which hopes to assist companies in the digital advertising ecosystem to ensure compliance with EU regulations. “It contains a minimal set of best practices seeking to ensure that when personal data is processed, users are provided with adequate transparency and choice. Its policies do not assist or seek to assist the processing of special categories of data. It does not intend to replace legal obligations nor enable practices prohibited under the law.”

IAB Europe has essentially tried to refute the DPA’s argument that it is legally liable for any shortcomings in TCF.  It added: “If upheld, the [DPA’s} interpretation would have a chilling effect on the development of open-source compliance standards that serve to support industry players and protect consumers.”

Google’s dominance in adtech market facing probe in the US

Google’s has been under the lens of the US government for its business practices in the digital advertising market. Late August, authorities had reportedly started investigating how Google might be using its dominance in the market to keep pout competitors. Earlier during the deposition of Google CEO Sundar Pichai in front of the the House subcommittee on antitrust, Representative Pramila Jayapal pointed out how Google controlled 50-60% of the ad exchange market. Jayapal had contended that Google rigged the entire online advertising market by controlling both the buy- and sell-sides via its Ad Exchange marketplace.

EU is teaming up against Big Tech

The Belgian DPA’s investigation of business practices of adtech players such as Google is part of Europe’s assertion over Big Tech companies. Members states of the EU have been training their eyes on Big Tech players like Facebook, Google, Apple, and Amazon. For instance, recently the Irish data protection regulator recently told Facebook that its current data-transfer mechanism between EU and the US is no longer valid, meaning Facebook could essentially have to stop offering its services in the EU.

Earlier this week, France and Netherlands, prominent members of the EU, jointly issued a call for the breaking up of Big Tech companies. The two countries called on EU Regulators to take swift action against emerging technology giants. The Digital Services Act (DSA), which will be discussed in the European Parliament next week, is a complete overhaul of internet regulation in the region. The DSA, too, has several anti-competition provisions that  aim to put a check on Big Tech in areas of data sharing, digital marketplaces and so on.

Also read: