The Data & Marketing Association and the Incorporated Society of British Advertisers have published new guidance to help address the privacy challenges of real time bidding (RTB) in programmatic advertising. It has been produced in consultation with the ICO. The new guidance aims to provide support for UK businesses actively engaged in the programmatic delivery of digital advertising to ensure they protect the rights of individuals.
The reach of RTB within programmatic advertising has grown and evolved rapidly in recent years. It is underpinned by advertising technology that allows advertisers to compete for available digital advertising space in milliseconds, placing billions of online advertisements on webpages and apps in the UK every day by automated means.
The ICO carried out an investigation on adtech and identified a number of concerns relating to the protection of the rights of individuals through the use of RTB in the programmatic delivery of digital advertising:
- Methods for gaining consent are not transparent
- Opportunities to use legitimate interest are limited
- Special category data requires explicit consent for processing
- Widespread profiling is disproportionate and intrusive
- Solely relying on contracts for assurance is insufficient
- Lack of adequately developed data protection impact assessments is a concern
- Appropriate and responsible data protection practices are crucial
- Queries whether data processing achieves the advertising outcome
- Collaboration with key players, such as Google and IAB Europe, is encouraged
The ICO recently advised that it is suspending its action on adtech during the coronavirus pandemic. However, the new guidance addresses the ICO’s concerns. It applies to the UK only, and is divided into seven steps:
- Education and understanding – a comprehensive introduction to cookies and programmatic advertising with a detailed glossary of terms.
- Special category data – the ICO highlighted the importance of treating special category data with care and this section considers its definition and usage.
- Understanding the data journey – a key challenge is being able to track how data is captured and who processes it. This section explains how to complete a record of processing activities as well as introducing the IAB’s Transparency and Consent Framework.
- Conduct a data protection impact assessment – the ICO noted the limited use of DPIAs in Ad Tech. This section sets out to explain what it is, when to use it as well as some pointers to what questions to ask.
- Audit the supply chain – the ICO highlighted that organisations cannot rely on contracts to provide assurance around the use of personal data. This section provides audit check lists and questions that need to be answered when auditing suppliers.
- Measure advertising effectiveness – the ICO have queried whether it is necessary to use all the data collected through adtech platforms. This section provides links to reference materials for improving insights into advertising effectiveness to allow for a proportionate approach to using personal data.
- Alternatives to third party cookies – what does a post third-party cookie world look like? This section provides some suggestions about alternative methods of targeting including the adoption of contextual targeting. It also provides references to some industry initiatives which are exploring different ways of targeting in a less intrusive manner.
