Dr Johnny Ryan responds to a statement from IAB Europe regarding its failure to answer the Irish Data Protection Commission. Four months on, both I and the Data Protection Commission are still waiting for the first explanation of how “IAB Europe is confident that the way it obtains consent for the use of cookies on its website complies with the requirements of the law”.
Tag: consent
IAB Europe fails to answer Irish Data Protection Commission
IAB Europe fails to answer questions from Irish Data Protection Commission arising from formal GDPR complaint by Brave's Dr Ryan against IAB Europe's "forced consent" and consent walls.
Brave answers US Senators questions on privacy and antitrust
Brave answers Senators Whitehouse, Booker, Graham and Leahy’s questions for the record from the US Senate Judiciary Committee hearing on privacy and anti-trust.
Formal GDPR complaint against IAB Europe’s “cookie wall” and GDPR consent guidance.
A formal complaint has been filed with the Irish Data Protection Commissioner against IAB Europe, the tracking industry’s primary lobbying organization.
French regulator shows deep flaws in IAB’s consent framework and RTB
French regulator's decision against Vectaury confirms that IAB “Transparency & Consent Framework” does not obtain valid consent, and illustrates how even tiny adtech companies can unlawfully gather millions of people’s personal data from the online advertising “real time bidding system” (RTB).
Brave Writes to All 28 EU Member States, Defending ePrivacy Regulation’s “Privacy By Design and By Default”
A ruling of the European Court of Justice this month in the “Facebook fan page case” exposes marketers to severe legal risk from programmatic advertising.
Europe’s top court signals new risk for marketers from ad tech
A ruling of the European Court of Justice this month in the “Facebook fan page case” exposes marketers to severe legal risk from programmatic advertising.
Facebook and adtech face a turbulent time in Europe’s courts: the Brussels case.
This note examines a Belgian court ruling against Facebook's tracking and approach to consent. Facebook and adtech companies should expect tough sanctions when they find themselves before European courts - unless they change their current approach to data protection and the GDPR. Facebook is playing a dangerous game of “chicken” with the regulators. First, it has begun to confront users in … Continue reading Facebook and adtech face a turbulent time in Europe’s courts: the Brussels case.
Risks in IAB Europe’s proposed consent mechanism
This note examines the recently published IAB “transparency and consent” proposal. Major flaws render the system unworkable. The real issue is what should be done with the vast majority of the audience who will not give consent. Publishers would have no control (and are expected to blindly trust 2,000+ adtech companies) The adtech companies[1] who drafted … Continue reading Risks in IAB Europe’s proposed consent mechanism
Adtech must change to protect publishers under the GDPR (IAPP podcast)
The follow up to the International Association of Privacy Professionals' most listened to podcast of 2017. Angelique Carson of the International Association of Privacy Professionals quizzes PageFair's Dr Johnny Ryan on the crisis facing publishers, as they grapple with adtech vendors and attendant risks ahead of the GDPR. The podcast covers: Why personal data can not be used without … Continue reading Adtech must change to protect publishers under the GDPR (IAPP podcast)
PageFair’s long letter to the Article 29 Working Party
This note discusses a letter that PageFair submitted to the Article 29 Working Party. The answers may shape the future of the adtech industry. Eventually the data protection authorities of Europe will gain a thorough understanding of the adtech industry, and enforce data protection upon it. This will change how the industry works. Until then, we are in … Continue reading PageFair’s long letter to the Article 29 Working Party
GDPR consent design: how granular must adtech opt-ins be?
This note examines the range of distinct adtech data processing purposes that will require opt-in under the GDPR.[1] In late 2017 the Article 29 Working Party cautioned that “data subjects should be free to choose which purpose they accept, rather than having to consent to a bundle of processing purposes”.[2] Consent requests for multiple purposes … Continue reading GDPR consent design: how granular must adtech opt-ins be?
Can websites use “tracking walls” to force consent under GDPR?
This note examines whether websites can use "tracking walls" under the GDPR, and challenges the recent guidance on this issue from IAB Europe. This week, IAB Europe published a paper that advises website owners that tracking walls (i.e., modal dialogs that require people to give consent to be tracked in order to access a website) will be … Continue reading Can websites use “tracking walls” to force consent under GDPR?
Research result: what percentage will consent to tracking for advertising?
This note presents the results of a survey of 300+ publishers, adtech, brands, and various others, on whether users will consent to tracking under the GDPR and the ePrivacy Regulation. In early August we published a note on consent, and asked whether people would click "yes". We would like to thank the 300+ colleagues who … Continue reading Research result: what percentage will consent to tracking for advertising?
How the GDPR will disrupt Google and Facebook
Google and Facebook will be disrupted by the new European data protection rules that are due to apply in May 2018. This note explains how. Google and Facebook will be unable to use the personal data they hold for advertising purposes without user permission. This is an acute challenge because, contrary to what some commentators have assumed, they cannot use a “service-wide” opt-in for … Continue reading How the GDPR will disrupt Google and Facebook
Here is what GDPR consent dialogues could look like. Will people click yes?
THIS NOTE HAS NOW BEEN SUPERSEDED BY A A MORE RECENT PAGEFAIR INSIDER NOTE ON GDPR CONSENT DIALOGUES. PLEASE REFER TO THE NEW NOTE. This note presents sketches of GDPR consent dialogues, and invites readers to participate in research on whether people will consent. [x_alert heading="Note" type="info"]It is important to note that the dialogue presented … Continue reading Here is what GDPR consent dialogues could look like. Will people click yes?
Why the GDPR ‘legitimate interest’ provision will not save you
The “legitimate interest” provision in the GDPR will not save behavioral advertising and data brokers from the challenge of obtaining consent for personally identifiable data. As previous PageFair analysis illustrates, personally identifiable data (PII) will become toxic except where it has been obtained and used with consent once the General Data Protection Regulation is applied in May 2018. Even so, many advertising intermediaries believe that they can continue to use PII data without consent because of an apparent carve-out related to “legitimate interest” contained in the GDPR. This is a false hope.
Europe’s new privacy regime will disrupt the adtech Lumascape
In a year and a half, new European rules on the use of personal information will disrupt advertising and media across the globe. Here are the three biggest impacts. Since 1996 when cookies were first repurposed to track users around the Web there has been an assumption that gathering and trading users' personal information is the essence of advertising online. This is about to change.
Dr Johnny Ryan FRHistS 