ICO resumes investigation into adtech industry

Critics say the adtech industry is guilty of multiple GDPR breaches

The UK Information Commissioner's Office (ICO) is resuming its probe into real-time bidding (RTB) and the adtech industry, after a nine-month pause due to the Covid-19 pandemic.

ICO Deputy Commissioner Simon McDougall said the regulator would conduct a series of audits over the coming months, focusing on digital marketing platforms. The watchdog also plans to issue assessment notices to specific firms as part of the investigation, in order to gain a clear understanding of the state of the industry in the UK.

Enabling transparency and protecting the data of vulnerable citizens are the ICO's main priorities, said McDougall. He added that RTB auction systems require explicit consent to use people's personal data to serve adverts, which is not happening at the moment.

"Sharing people's data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, also raises questions around the security and retention of this data," he added.

The ICO's announcement comes more than two months after privacy advocates at the Open Rights Group (ORG) filed a legal challenge against the ICO, over its alleged failure to stop unlawful practices by the adtech industry in the UK.

Jim Killock, executive director of ORG, and Michael Veale, a lecturer in digital rights at the University College London, filed the challenge.

The ORG alleged that the ICO had completely wrapped up its investigation into the adtech industry, without taking appropriate action against the wrongdoers.

Earlier in September 2018, Killock and Veale made a complaint to the ICO about systemic GDPR breaches by the adtech industry and the Internet Advertising Bureau (IAB). They argued that the adtech industry's RTB system does not comply with the GDPR's requirements for firms to offer proper security for people's data.

Responding to the complaints, the ICO ordered a probe and found that there were indeed many systemic issues with industry practices, such as the sharing of users' browsing history and personal information, without any control over who is allowed to access this data. The regulator said it was concerned over the industry's use of personal data in the RTB component of programmatic advertising.

In 2019, McDougall stated that the adtech industry should correct its practices, such as the lack of clear consent for the processing of 'special category' data, such as political and sexual orientation.

Despite identifying multiple GDPR breaches, the ICO announced in May that it was pausing its investigation, to avoid "undue pressure on any industry" during the pandemic. However, it added that it was concerned about the adtech industry and would restart the work in the coming months.

The freeze is over now, and the audits are expected to begin soon.

Among the focuses of the probe will be RTB auctions - the process used by advertisers to select ads to be shown to internet users. The auctions, which take a few milliseconds to complete as the web pages load, offer little chance for user consent. They can also sometimes use special category data to display ads to users.

The ICO's probe will also assess the role of data brokers in the adtech ecosystem.

The data watchdog completed a probe into data broking activities by the credit agencies Experian, Equifax and TransUnion last year. At the time, it issued an enforcement notice to Experian directing the agency to make changes in "how it handles people's personal data within its direct marketing services".