Real-time bidding condemned by UK privacy watchdog

The multibillion-dollar adtech industry has been severely criticised by the UK’s data protection regulator, which has ruled that real-time bidding (RTB) uses people’s data unlawfully.

In an update to its review of programmatic advertising, the Information Commissioner’s Office (ICO) said it recognised RTB as an “innovative” means of ad delivery, but that it “presents a number of challenges to good data protection” in its current form.

It warned that the adtech industry “appears immature in its understanding of data protection requirements” and that there are general and systemic concerns about RTB’s level of compliance.

There are two main areas of concern for the ICO – the processing of special category data without explicit consent and the complexity of the data supply chain – both of which it said will require further analysis.

“Under data protection law, using people’s sensitive personal data to serve adverts requires their explicit consent, which is not happening right now,” said Simon McDougall, the ICO’s executive director for technology and innovation, in a blog post.

“Sharing people’s data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, raises questions around the security and retention of this data,” he added.

The detailed report warned that any processing of special category data “is taking place unlawfully” because explicit consent is not being collected. This information could include a person’s race, sexuality, health status or political opinions.

It added that there appears to be a lack of understanding among adtech companies about data protection laws, such as the EU’s General Data Protection Regulation (GDPR).

“The profiles created about individuals are extremely detailed and are repeatedly shared among hundreds of organisations for any one bid request, all without the individuals’ knowledge,” the report said in one of its many criticisms.

According to McDougall, adtech companies should spend the next six months making changes to they way they operate, based on the conclusions of the IPO review.

“If you operate in the adtech space, it’s time to look at what you’re doing now, and to assess how you use personal data,” he said. “Towards the end of the year we will review our position, consider whether our concerns still hold and evaluate whether further action is required.”

Source: ICO and WARC