The writing is on the wall for ads based on real-time bidding in the EU – and maybe everywhere

Privacy News Online noted back in February a growing disquiet at the huge amounts of personal information that sites like Facebook and Google routinely gather about us, and how it is used for personalized advertising. Of particular concern is real-time bidding (RTB), which sees often extremely private information sent out to hundreds of potential advertisers, with no control over what they do with it. A formal complaint has been submitted to the data protection authorities in the UK and in Ireland, asking them to investigate the use of real-time bidding systems by Google and other adtech companies. The UK’s Information Commissioner’s Office (ICO) has just published an adtech update report, following extensive discussions on the subject with stakeholders:

We have focused on RTB due to its complexity, the risks it poses and the low level of data protection maturity we’ve found through some of our initial engagement. Whilst we accept that RTB is an innovative means of advertisement delivery, our view is that, in its current form, it presents a number of challenges to good data protection practices.

Although couched in restrained language, the preliminary results of the ICO’s investigation don’t look good for the online advertising industry:

Our work has highlighted the lack of maturity of some market participants, and the ongoing commercial incentives to associate personal data with bid requests. We do not think these issues will be addressed without intervention. We are therefore planning a measured and iterative approach, so that we act decisively and transparently, but also in ways in which we can observe the market’s reaction and adapt our approach accordingly.

Section 3 of the 25-page report spells out the problems the ICO has found with the RTB approach. A key one is that it involves what the EU’s GDPR calls “special category data”. This is more sensitive than “ordinary” or non-special category personal data, and includes things like racial or ethnic origin, political opinions, religious or philosophical beliefs, and data concerning health and sexual orientation. As a result, it can only be processed by companies, including adtech companies, with explicit consent from the people affected. This is almost never sought when it comes to RTB advertising, so the ICO is effectively saying advertising that currently uses this special category data is illegal under the GDPR. The report warns:

Consent mechanisms must be appropriate for the processing of special category data. Market participants must therefore modify existing consent mechanisms to collect explicit consent, or they should not process this data at all.

The report highlights several other serious problems with today’s RTB process, and implies that unless the industry sorts itself out quickly, the ICO will intervene – and start handing out GDPR fines. The ICO is just one country’s data protection authority, but it is likely that other European nations that have adopted the GDPR will take a similarly dim view of real-time bidding. The European civil liberties organisation Liberties has filed complaints across Europe to call the attention of national data protection offices to the risks of the behavioral advertising industry, and is encouraging EU citizens to do the same.

The bad news for the online publishing industry is that behavioral ads based on real-time bidding are unlikely to survive for long in the EU. The good news is that they probably aren’t worth using anyway. Here’s what new research on the area concluded: “We find that when a user’s cookie is available publisher’s revenue increases by only about 4%. This corresponds to an average increase of $0.00008 per advertisement.” As an article in the Wall Street Journal about the research points out, publishers are getting a terrible deal here:

That modest gain for publishers stands in contrast to the vastly larger sums advertisers are willing to pay for behaviorally targeted ads. A 2009 study by Howard Beales, a professor at George Washington University School of Business and a former director of the Bureau of Consumer Protection at the Federal Trade Commission, found advertisers are willing to pay 2.68 times more for a behaviorally targeted ad than one that wasn’t.

Most of the money goes to the intermediaries that run the RTB process. Companies like Facebook and Google are making hefty profits from ignoring the privacy of Internet users, but publishers are seeing almost no benefit from the premium prices advertisers are paying. Assuming that is confirmed by further research, a world without micro-targeted ads based on real-time bidding would represent a huge win for privacy, with negligible damage to online publishers. Moreover, as an op-ed in the New York Times points out, publishers have been successfully using an alternative to behavioral advertising for decades.

It’s called “contextual advertising”, and doesn’t need to know your most intimate secrets in order to work. Instead, the advertisers simply use information about the page that you are viewing to infer your interests, and show you a related ad. For example, if the article is about computers, an ad for computer-related products is displayed. No private information is involved. It’s how newspapers, magazines, radio and media have worked ever since ads were introduced for these media. Publishers made good profits, advertisers generated sales, people didn’t find the ads overly intrusive, and everyone was happy.

At the moment, publishers are allowing micro-targeted ads on their sites placed using real-time bidding because they are told by intermediaries like Facebook and Google that it will produce far more revenue for them. But given the new evidence that’s not the case, and the immense harm they cause to the privacy of millions of people every day, it’s clearly time to take a step back from micro-targeted ads. They bring practically no benefit for anyone except the big Internet companies that run the RTB services. The latter can easily survive without behavioral ads. They may even find that they are less hated by the public, and less demonized by politicians, if their business models are not based on spying on everything we do online, and selling intimate details about our lives to the highest bidder.

Featured image by Wikimedia.