Last update: February 2 2020
You can read the Traditional Chinese version of this post here, courtesy of OCF Lab.
Lawmakers and online users increasingly see how some forms of targeted content, such as advertising based on online tracking, harms human rights. Fortunately, we have a new opportunity to address these systemic issues in Europe. On December 15 2020, the EU unveiled the Digital Services Act and the Digital Markets Act. These two key pieces of legislation will impact the future of digital policies and rights online, specifically in relation to online platforms and competition, including the regulation of online advertising.
In this blog post, we unpack some of the most intrusive methods deployed in the context of online advertising, namely behavioural targeting and cross-sites tracking. We then propose alternative models and recommendations on the best way forward.
What is wrong with online advertising?
Online advertising is an umbrella term that involves many different actors and includes many different techniques. Some techniques entail invasive tracking, while others do not. The different methods of online advertising are often conflated or misunderstood. To develop effective policies and legal responses to the problems targeted advertising creates, we must 1) understand these complex methods and techniques, and 2) put the systemic threat they pose to human rights at the centre of any current or future regulation.
Every day, a large number of online actors openly or silently connect the dots about our behaviours, likes, chats, and preferences to deliver ads and increase their profits. The data harvesting business models of large online platforms enable the advertising industry to develop data-driven targeting strategies. Through this approach, companies identify and exploit our behavioural patterns and characteristics.
Online platforms record our digital footprint and collect information about us almost constantly. Then, often without our awareness, they build profiles on us based on this data. This information is used for delivering tailored services that, arguably, make our online experience more enjoyable and convenient.
But this personalised experience infringes on our rights. Indeed, hidden behind the convenient recommendations lurks a dark side of sophisticated manipulation. This shadow puppet-master negatively impacts our personal autonomy, right to privacy, and our ability to freely form an opinion. And it’s not just about us. What we do online impacts others, and what others do online, impacts us. Content distribution decisions hidden behind algorithms are determining which ads and content we may see. Our online activities not only feed into our own profiles but also determine other people’s online experiences.
While this data-harvesting business model thrived unchecked for a long time, its externalities and impacts are increasingly visible. From discriminatory ads on housing and job markets, to domestic and foreign interference in elections and untraceable money flowing into politics online, the consequences are tangible. We cannot undo the result of the Brexit referendum or the interference in the elections in Kenya. But we can, or rather the EU can, help combat the pernicious online advertising ecosystem.
The European Union is reaching a new crossroad as it launched a new legislative package. The European Parliament’s Legal Affairs Committee (JURI) recently adopted a report on the upcoming Digital Services Act calls for regulating targeted advertising, including a phase-out leading to a prohibition. Access Now fully supports calls for better regulation of online advertisement. Some practices may require a ban while others may not, but before moving forward, we need to unpack the online advertising techniques that create societal harm.
Behavioural targeting: shadow actors crafting the rules of the game
In practice, publishers — a website or a mobile app that delivers service or content — provide a space for placing ads on their platforms and/or access to data about their users. Their trading partners are marketers, companies that are eager to sell their products to the most valuable customers. But third-party vendors and online ad exchanges stand in between these actors. They operate in the shadows, do not have any direct relationship with users, decide which ads will be placed on which sites, and receive a part of the transaction. This complicated advertising network collects, analyses, and merges extensive amounts of personal data without people’s knowledge. Neither publishers nor marketers are able to fully control this process.
Due to their market dominance across the advertising ecosystem and their access to unprecedented amounts of users’ data, major online platforms, such as Google, are holding all three roles simultaneously: publishers, marketers, and third-party vendors. This creates an enormous power imbalance that fuels unfair competition in the EU Digital Single Market and a risk of systemic human rights abuse.
The invasiveness of online targeting
Through different targeting methods, marketers can decide to target only certain groups of people and not others. People may appreciate the advantages of more personally relevant advertisements or personalisation of content based on their interests. For instance, we may enjoy personalisation in Zalando when we are looking for that perfect pair of shoes.
But, what is the limit to this personalisation? Where do we draw the line? After all, similar methods of online targeting also help identify and exploit particular characteristics to increase the persuasiveness of a message. In the same vein, this technique helps manipulate people into making decisions they would have otherwise not have made.
Once platforms collect our information, third-party vendors step in to analyse and use the data to create profiles about us and make assumptions about our preferences. Profiles are based on so called behavioural data, otherwise known as our habits, preferences, dislikes, interactions with friends. These profiles may even draw conclusions from when we are most active online. Both the creation and subsequent use of this profile are privacy invasive because these activities intrude into our lives, make assumptions, and can lead to discrimination.
The rationale behind this technique is the notion that the more companies know about us, the greater the likelihood that they can successfully manipulate us. This logic is then used to deliver specific content “at the right time and in the right context,” and incite us to buy certain products, services, or watch certain videos.
You can read more about the ad-tech ecosystem in the Panoptykon Foundation’s report.
How is online targeting regulated right now
In the EU, we already have rules that apply to behavioural targeting and other forms of tracking online (that can be found under the General Data Protection Regulation and the ePrivacy Directive). All actors of the ad-tech industry must comply with these privacy and data protection rules when using our personal information and placing trackers on our device(s). However, far too often actors do not properly comply with these rules and regulators are slow to enforce them.
When you browse on a site, you see banners pop up, asking you to agree to the use of trackers. You often do not have the opportunity to reject this tracking, nor are you provided a clear explanation as to why this is happening. The ad-tech industry has been very vocal in claiming that people are “experiencing consent fatigue” with online notices. Yet, they continue to refuse to address the fact that these notices often do not include sufficient information nor do they provide the appropriate avenue to express consent.
All of which is to say, we are still in the dark about how we are being tracked and to what we consent online. European lawmakers are discussing requirements for online actors to respect people’s privacy by default and design in the context of the ongoing reform of the ePrivacy Regulation. These rules would help implement proper control mechanisms and complement the GDPR. If the EU adopts these rules, online platforms could not place trackers automatically on our devices. Instead, through changing settings (that are turned-off by default), we would be empowered to decide if, when, and how trackers are placed.
What more can the EU do?
The EU has been negotiating the ePrivacy reforms for nearly four years now, and the finish line is still not in sight. Meanwhile, intrusive tracking practices continue to negatively impact people’s rights and democracy in the EU. Should lawmakers take a step further and ban pernicious practices of online advertisement under the DSA?
Access Now believes that not all types of online advertisement should be banned. In fact, the EU should invest in the development of innovative forms of contextual advertising that relies on minimum personalisation and no individual targeting. Several media actors in the US and the Netherlands have successfully transitioned to such a model, leading to a growth in ad revenue and greater privacy to their readers. The EU should, however, ban practices that adversely impact people’s rights to privacy and freedom of expression. This includes targeted behavioural tracking and individual cross-party tracking.
Despite industries’ claims that there is no turning back from online tracking, we need to remember that the internet was not built on a “creepy ad” business model. Quite the opposite, in fact.
Lawmakers must not protect business models that stand at odds with EU fundamental rights. Ending abusive models also means opening the door to privacy-friendly alternatives. This will make it easier for new players to enter the online ads markets.
Beyond ads
Online targeting – whether to sell goods, entertainment, or a political idea – has far reaching impacts on our personal interactions, consumer choices, and participation in democratic debates. Measures intended to increase transparency can help us better understand the scale of the issues, but these are not enough to prevent and mitigate the abuses. The individual and societal harms created by intrusive targeting and personalisation require a systematic response. It is crucial that the EU puts human rights at the centre of how it addresses tracking and targeting. From privacy violations to content curation, invasive tracking harms our rights to freedom of expression and opinion in tangible ways.