During negotiations within the European Parliament on the Digital Services Act, an upcoming piece of EU legislation designed to rein in the tech giants, the possibility arose of a total ban on personalised advertising being put into law.
The idea gained traction in several parliamentary committees, driven by the efforts of a group of MEPs called the Tracking-Free Ads Coalition. But the proposal ultimately looked to have been killed off in December when the Internal Market and Consumer Protection Committee, the lead committee for the DSA, chose not to support it.
It’s not impossible that similar proposals could emerge further down the line. Changes will be made to the draft law as Parliament and the European Council reconcile their versions of the bill, so a new anti-tracking clause could be inserted. This looks unlikely, since the idea doesn’t appear to have mainstream support in either body.
But some, including trade body IAB Europe, remain concerned about what will end up in the DSA, following this month’s plenary vote which set out the European Parliament’s position on the bill. One amendment introduced in the plenary vote would completely ban use of personal data in targeting of minors. If clumsily implemented, the IAB says this could effectively amount to a complete ban on targeted advertising.
Devil in the details
A ban on targeting minors is a new addition to the DSA, and wasn’t included in the original text proposed by the European Commission.
The amendment, which was passed in the plenary vote earlier this month, says the following:
“Online platforms should also not use personal data for commercial purposes related to direct marketing, profiling and behaviourally targeted advertising of minors. The online platform should not be obliged to maintain, acquire or process additional information in order to assess the age of the recipient of the service.”
Few argue against the amendment in principle. But the difficulty comes in exactly how online platforms should determine if they’re interacting with a minor or not, which isn’t specified in the text of the amendment.
The total impact of the amendment would largely hinge on how strict platforms have to be in judging whether they’re targeting a minor or not.
European law already prohibits targeting of gambling ads towards minors, posing a similar dilemma for gambling brands. But guidelines mostly ask that betting brands simply do everything they can reasonably be expected to do to avoid targeting children. This includes being mindful of the sorts of websites they’re placing ads on and which influencers they’re working with, as well as using age restriction tools provided by social platforms.
But Tim Geenen, managing director of addressability in Europe for LiveRamp, said in an IAB Europe roundtable discussion earlier this month that these methods often aren’t effective.
“As LiveRamp, we don’t want to process minors’ data,” said Geenen. “But sometimes we work with publishers and it’s not exactly clear whether it’s a website geared towards adults or minors.”
Geenen gave the example of game review websites – which could be seen as either targeted at adults or minors.
And since these new laws are directed at platforms themselves, rather than at advertisers, expectations could well be higher than with the gambling ad laws.
Big social platforms, where users are logged in, can claim they have a good idea of who is a minor and who isn’t based on age and date of birth data they collect when users register. Companies on the open web however don’t necessarily have this same login data (although some will given publishers’ recent efforts to register users and keep them logged in).
So one possible outcome is that only websites with logged-in users, where audiences have self-identified as not being minors, can use personalised data for ad targeting.
Even this might not be enough though. If the bar was set even higher, and online platforms had to verify the age of their logged-in audiences, for example by requesting a scan of a form of identity, the addressable audience for most platforms would fall even further.
“In my view, I don’t have the slightest idea [how you’d verify age],” said Fernando Parreira, business director at Portuguese media company SAPO in the roundtable discussion. “And I hope the regulators bring us a solution! My first thought was that you’d have to have a login platform in place to have a provable ID of the user. But still, there are global platforms with login systems in place and they’re not 100 percent bulletproof.”
Geenen added that the only truly reliable solution would likely be for users to verify their identity every time they browse the internet, which obviously runs counter to the aims of the privacy-focused amendment.
Thus, if this sort of extremely strict requirement was placed on online platforms, personalised advertising would essentially become unworkable.
A matter for the courts?
A recurring theme from those concerned about the amendment is that they’d like more clarity from the law itself.
And more clarity could come further down the line. The plenary vote set out the European Parliament’s position on the DSA, but this still needs to be reconciled with the European Council’s version of the bill. So further re-writes could give more guidelines of the EU’s expectations.
If this isn’t the case and the amendment passes in its current form, the matter will likely end up being decided in courts, or by regulators tasked with enforcing the DSA. Online platforms will make their own judgements on what’s expected of them, privacy advocates will file suits against those who’ve taken more lax stances, and precedent will be set by the decisions of judges and regulators.
This would be far from ideal for businesses engaged in data-based targeting. The choice would be to either take a relaxed stance and risk being handed a chunky fine, or be as cautious as possible, with the risk being that they shut down their own targeted ad offerings while their competitors don’t, putting them at a disadvantage.
