New ICO privacy standards clamp down on adtech

The Information Commissioner’s Office (ICO) has today (25 November) published an Information Commissioner’s Opinion which sets out data protection and privacy expectations for those developing and utilising new online advertising technologies (adtech).

The ICO has called on Google and its contemporaries to take action to eliminate privacy risks posed by adtech and has warned those designing new methods of online advertising must comply with data protection law and stop the excessive collection and use of personal data.

The opinion sets out privacy standards companies must meet to safeguard individuals’ privacy online when developing new adtech.

Companies must offer individuals the ability to receive ads without tracking, profiling or targeting based on excessive collection of personal information. If individuals elect to share their data, all those within the adtech supply chain must ensure there is meaningful accountability and provide control over the data and the ability for people to exercise their information rights.

Companies must also be able to justify the use of personal data for online advertising as fair, necessary and proportionate and be clear with people about how and why their information is being used.

Information Commissioner, Elizabeth Denham, said: “Digital advertising is a complex ecosystem that grew quickly with the e-commerce boom and without people’s privacy in mind.

“What we found during our ongoing adtech work is that companies are collecting and sharing a person’s information with hundreds, if not thousands of companies, about what that person is doing and looking at online in order to show targeted ads or content. Most of the time, individuals are not aware that this is happening or have not given their explicit consent. This must change.

“That is why we want to influence current and future commercial proposals on methods for online advertising early on, so that the changes made are not just window dressing, but actually give people meaningful control over their personal data.”

The opinion highlights one of the most significant, recent developments in adtech – the Google Privacy Sandbox (GPS). The GPS aims to replace the use of third-party cookies and other forms of cross-site tracking with alternative technologies enabled to drive targeted digital advertising and the measurement of advertising.

The ICO has joined forces with the Competition and Markets Authority (CMA) to review how the GPS will safeguard personal data, while supporting the CMA’s agenda of ensuring there is competition in digital markets.

Denham said: “I am looking for solutions that eliminate intrusive online tracking and profiling practices, and give people meaningful choice over the use of their personal data. My office will not accept proposals based on underlying adtech concepts that replicate or seek to maintain the status quo.”