Adtech and the law

Answer

Behind the scenes, in the milliseconds that it takes for a website to load, an advertising space on the page you are viewing has been auctioned – most probably using your personal data – and sold to the highest bidder (ie, an advertiser looking to market to someone like you).

This process, which happens billions of times a day, is adtech in practice, or more particularly, the process of real-time bidding (RTB).

What is adtech?

Adtech (or advertising technology) is a broad term used to describe technology which analyses and manages data (including personal data) in relation to online advertising.

This technology is routinely used by online advertisers to automate the advertising process. However, it usually makes its way into the headlines when it is used in this way to enable direct advertising to specific users, sometimes based on their preferences (from politics to what they do at the weekend) or browsing habits.

Adtech, and its relationship with privacy and data protection, has recently come under scrutiny by the UK's Information Commissioner's Office (ICO) and RTB is one use which has been the focus of the ICO's attention.

What is RTB?

Websites will store data, often personal data, about you, usually in the form of cookies. This data is processed and analysed by multiple companies, operating different types of adtech software that combine to build a picture of you as an individual (which is usually anonymised). Your profile is then offered to advertisers, who will engage in the real-time bidding process; bidding on the opportunity to advertise to you.

The highest bidder will win the space to advertise on the webpage you are currently browsing. This explains why the trainers from your online shopping basket appear on an unconnected website the next day.

Adtech and data protection

According to Ofcom and the ICO, the average British adult spends over three hours online each day. It is no surprise that individuals are becoming more concerned with how their personal data is collected, stored and used.

The ICO has been increasingly interested in the adtech industry's approach to 'self-regulation' in respect of how it uses personal data and, in particular, how it is used within RTB. The ICO issued a full report this year condemning the industry's lack of compliance with data protection legislation and apparent failures to put in place adequate safeguards for individuals' personal data.

The issues raised by the ICO included the fact that special category data (for example, racial or ethnic origin, political affiliation and religion) is often processed without your explicit consent.

The report is likely to raise public awareness of adtech and the very serious privacy concerns that exist within the adtech ecosystem, resulting in further pressure on businesses operating in the sphere to justify their use of personal data. The ICO expects businesses to re-evaluate their approach to privacy policies, use of personal data and lawful bases for processing such data for advertising purposes.

The industry will be under review for the foreseeable future and businesses are likely to rely heavily on lawyers' advice to ensure that their operations are in line with data protection legislation. 

Abbey Smith is a solicitor in the commercial team at Michelmores LLP.