The Digital Services Act and Digital Markets Act were formally unveiled in December last year as the European Commission’s big legislative efforts to bring the international tech giants to heel.
But it’s not just GAFA who could face massive new restrictions once these laws are passed. EU politicians are currently debating amendments to these proposals which would introduce a blanket ban on use of personal data in targeted advertising.
Broadly speaking, the Digital Markets Act hopes to prevent anticompetitive practices from the very biggest platforms. The Digital Services Act meanwhile sets ground rules around users’ rights and online harm prevention, which all digital services must follow.
But these proposals have only completed the first step in the European Union’s legislative process. The Commission’s proposals have been passed to the European Parliament and European Council which can each propose changes to the Commission’s draft law. These two bodies must debate and vote on amendments internally, and eventually agree upon one final version to pass into law.
The two proposals are still in this debate stage. And the amendments that would introduce a complete ban on personalised advertising have started to gain traction. If one of these amendments is approved in both the European Council and European Parliament, it would spark unprecedented disruption to the entire digital advertising industry.
What exactly is being proposed?
There are a number of proposed amendments to the DSA covering targeted advertising. This is partly due to the EU’s legislative process, whereby committees and members are fairly free to table proposals – there have been 2,297 amendments proposed according to consumer rights advocacy group EDRi.
But the main push to outright ban use of personal data in targeted advertising has come from the Committee on Civil Liberties, Justice and Home Affairs (LIBE).
Early draft amendments from LIBE members proposed a complete ban on all forms of targeted advertising that use personal data. This would be a marked difference from current privacy approaches, which allow use of personal data so long as the user gives informed consent. Earlier proposed amendments took user consent out of the equation.
However the final opinion issued by LIBE in July was rather watered down. LIBE argued that personalised advertising should be entirely phased out for political and non-commercial ads, as well as for any ads directed at children. LIBE also said that use of sensitive data should be completely phased out, and not left up to user consent.
For commercial advertising, LIBE says that personalised advertising should only be possible “where users have freely opted in, without exposure to ‘dark’ patterns or the risk of being excluded from services, and without being fatigued by consent banners if they have already made a clear choice in their browser/device settings”.
But that’s not to say a complete prohibition of personalised advertising is off the table. The idea is still being brought up in debates and discussions in the European Parliament, and the nature of the EU’s legislative process means there’s still time for a total ban to be incorporated into EU law.
If a total prohibition were to be included, what’s less clear is exactly how it would be enforced, or how quickly personalised advertising would be phased out in the EU.
Who is supporting it?
As mentioned above, the LIBE parliamentary committee has been one of the driving forces behind the idea, and many members of that committee drafted their own amendments to the DSA which would have totally banned personalised advertising. But the final opinion delivered by LIBE doesn’t actually call for a complete prohibition.
A separate coalition of MEPs, the Tracking-Free Ads Coalition, continues to push for a comprehensive ban. Many of its members are among those who supported LIBE’s earlier amendments which would have pushed for a total ban. Just recently, the coalition sent an open letter to Europe’s 100 largest advertisers, asking them to stop using personal data in targeted ad campaigns.
The idea has also picked up support from a number of other influential EU politicians. The European Data Protection Supervisor, an EU body responsible for making sure the EU itself respects privacy rights when processing personal data, has added its support. A summary of its opinion early this year called for “a phase-out leading to a prohibition of targeted advertising on the basis of pervasive tracking”.
Meanwhile Christel Schaldemose, the MEP leading deliberation for the European Parliament’s Committee on the Internal Market and Consumer Protection, has argued that personalised advertising should be “set off by default”, though she still believes consumers should be allowed to opt-in to targeted ads.
And the cause has managed to gain traction across the European Parliament as a whole. Last year a narrow majority supported a motion to ask the European Commission to consider phasing out personalised advertising completely.
Outside of parliament, the idea has unsurprisingly won support from consumer privacy advocates. Amnesty International’s tech branch Amnesty Tech, for example, has called for a ban on “surveillance advertising”.
But not all privacy advocates support the notion. Notably last week Frances Haugen, the whistleblower who leaked documents suggesting that Facebook prioritised profits over cracking down on harmful content, declined to support a complete ban on personalised advertising.
What are the arguments for?
A lot of the arguments made in the opinions and proposals submitted by MEPs reference the idea that transparency and consent haven’t ever really worked as a solution to invasive tracking.
Much of what the privacy advocates want should already be provided by current EU law in theory. But in practice, it’s very hard for consumers to give informed consent to use of their personal data. It’s next to impossible for a consumer to really understand how their data is used in digital advertising. And they’ll have never even heard of the majority of companies who use that data.
A blanket ban simplifies the equation.
Plus, proponents argue that the sensitivity of the data involved means it’s too dangerous to be used in online tracking and targeting, even with user consent.
“The data about our online activities and behaviour that is being gathered is extremely sensitive,” says Patrick Breyer, MEP and member of the Tracking-Free Ads Coalition. “It allows you to infer information on the likely personality traits of people including their sexual orientation, psychological problems, all that sort of stuff. And that information can be used to manipulate people into buying things, but also for political purposes.”
The coalition also argues that personalised advertising has fuelled the growth of Google and Facebook at the expense of news publishers, harming journalism and fuelling disinformation.
“Surveillance-based advertising has implications for society as a whole, especially when it comes to political manipulation,” said Breyer. “That’s why it’s not sufficient to let every individual decide, as they don’t necessarily understand all the implications, and it’s a matter for society as a whole to be concerned about.”
What are the arguments against?
Opponents of the idea meanwhile say a complete ban on personalised advertising would be a significant overreach from the EU, doing significant damage to a number of businesses and stifling innovation.
Industry trade group IAB Europe has emerged as one of the leading opponents to the proposal. IAB Europe released a paper earlier this year laying out some of the harms a total ban could cause.
In that paper, IAB Europe’s chief economist Daniel Knapp laid out a number of potential harms, should the proposals be passed.
Firstly, Knapp argues that SMEs would be harmed, since they tend to rely on the ability to find their customers with targeted ads in order to be able to compete.
“SMEs often run their business based on the principle of ‘advertise or perish’ as they lack the cash resources to navigate a period without sales,” says Knapp. “But SMEs need to diligently measure advertising return-on-investment. They require targeted advertising strategies to minimise wastage and reach relevant consumers more than any other type of business.”
Some contest this notion. Augustine Fou, a cybersecurity and anti ad-fraud consultant, argues that personal data is “entirely unnecessary for good digital marketing”.
Fou points to studies which suggest that data collected from online tracking is often not accurate anyway, and that use of personal data doesn’t necessarily lead to more relevant ads. He added that SMEs which are most bought into personalised advertising are also most at risk of falling victim to ad fraud.
Daniel Knapp also argues that cutting back on personalised ads would threaten publishers’ revenue streams, stifling important journalism. Some have made a success of subscription-based models, but Knapp highlighted the importance of free access to quality news.
Privacy advocates also often point to examples like the New York Times or Dutch broadcast sales house STER, which have made a success of focusing on contextual targeting.
However it’s unclear that these select few examples demonstrate contextual targeting could work for all premium publishers. Both the New York Times and STER are very well established in their markets, and would likely attract interest from advertisers regardless of targeting capabilities.
But newer, less well established publications might struggle to compete, based solely on contextual targeting. And it’s not been proven that contextual targeting could replace microtargeted advertising across all premium publishers, without a loss of revenue.
What happens now?
There’s no real timeline for exactly when we’ll know if the proposals get incorporated into the DSA or not. The EU had initially hoped to reach a final agreement on the DSA by spring 2022, according to Bloomberg. But given the extensive debate over the legislation, it looks less and less likely that this will be the case.
As we’ve seen with the ePrivacy Directive, internal wrangling can hold up these sorts of projects for years. The ePrivacy Directive, which would introduce harsher privacy restrictions in the EU, was originally designed to come into force alongside the General Data Protection Regulation in 2018. Three years on, the finish line still isn’t in sight.
But progress on the DSA has been made. Many of the major parliamentary committees have already submitted their opinions, and work has been in progress in the European Council to agree upon a common position, with the most recent draft document submitted in December.
Once all the back and forth is over, how likely is it that a blanket ban on personalised ads will be included in the DSA? Johnny Ryan, a well known privacy advocate and senior fellow at the Irish Council for Civil Liberties, said he’s hopeful that the stricter amendments will make it through to the final draft.
Patrick Breyer meanwhile said that he’s not sure a total prohibition on ads personalisation will be adopted, he’s hopeful that the final version of the DSA will have stricter privacy protections than the first draft, and that we’ll see prohibitions over user of sensitive data introduced.
