Download as PDF, PPTX
![A non-compliant GDPR consent
screen (single screen)
[Site] and our partners set cookies and collect
information from your [browser] [device] to provide
you with [website] content, deliver relevant
advertising and understand [web] audiences. [View
partner info]
We use technology such as cookies on our site to
collect and use personal data to personalize
content and ads, to provide social media features
and to analyse our traffic. We also share
information about your use of our site with our
partners who also use technologies such as
cookies to collect and use personal data to
personalize content and ads, to provide social
media features and to analyse our traffic on our
site and across the internet. View info on our
partners and their use of this data. You can always
change your mind and revisit your choices.
OK
Manage use of
your data
Appears to be hard
to not give consent
breach of the GDPR, Article 4,
paragraph 11, and Recital 42, and
Recital 32.
No mention of the
duration for which
data are stored.
breach of the GDPR, Article 13,
paragraph 2, a
No precise
description of a
purpose of
processing, and no
notification of
profiling.
breach of the GDPR, Article 4,
paragraph 11, and Article 13,
paragraph 1, c, and paragraph 2,
f, and Recital 60.
Conflation of
multiple purposes
breach of the GDPR, Article
5, paragraph 1, b, Recital 32,
and Recital 43.](https://image.slidesharecdn.com/egta-180517111112/75/Tech-stole-your-audience-Take-it-back-30-2048.jpg)
Uploaded byJohnny Ryan
Tech stole your audience. Take it back.
This document discusses issues around third party tracking of personal data for online advertising purposes. It outlines how personal data is shared across many different parties during real-time bidding for online ads, presenting numerous potential points of data leakage. The document also examines users' lack of consent for such widespread data sharing, with studies showing that the majority of users would reject third party tracking if given a single, clear choice. It argues that GDPR requires separate consent for each specific purpose of data processing.
More Related Content
Similar to Tech stole your audience. Take it back.
Tech stole your audience. Take it back.
- 1. TECH STOLE YOUR AUDIENCE. DrJohnny Ryan @johnnyryan TAKE IT BACK.
- 2. Problem Set 1: The“Facebook and Cambridge Analytica Problem” How to enforce control over personal data that 3rd parties access from your websites?
- 3. Control Problem Images hosted onother domains Embedded videos Social sharing widgets Fonts and other resources loaded from other domains Commenting widgets 3rd party audio players, etc. No data protection of personal data accessed by 3rd party widgets and assets.
- 4. Control Problem No data protectionof personal data accessed by 3rd party widgets and assets. Your websites Your audience
- 5. “Behavioural” ad targeting &“programmatic” trading. (This jargon means: automatic auctions for the right people’s attention)
- 6.
- 7. /// Visitor Site SSPDSP DMP Brand $ “Demand side”“Supply side” Ad Exchange
- 8. /// Visitor Site SSPAd Exchange DSP DMP Brand $ “Demand side”“Supply side”
- 9. /// Visitor Site SSPAd Exchange DSP DMP Brand $ store data “Demand side”“Supply side”
- 10. /// Visitor Site SSPAd Exchange DSP DMP request segment Brand $ store data “Demand side”“Supply side”
- 11. /// Visitor Site SSPAd Exchange DSP DMP request segment deliver segment Brand $ store data “Demand side”“Supply side”
- 12. /// Visitor Site SSPAd Exchange DSP DMP request page request segment deliver segment Brand $ store data “Demand side”“Supply side”
- 13. /// Visitor Site SSPAd Exchange DSP DMP serve page request page request segment deliver segment Brand $ store data “Demand side”“Supply side”
- 14. /// Visitor Site SSPAd Exchange DSP DMP serve page request page request segment deliver segment Ad request Brand $ store data “Demand side”“Supply side”
- 15. /// Visitor Site SSPAd Exchange DSP DMP serve page request page request segment cookie to SSP deliver segment Ad request Brand $ store data “Demand side”“Supply side”
- 16. /// Visitor Site SSPAd Exchange DSP DMP serve page request page request segment ad request cookie to SSP deliver segment Ad request Brand $ store data “Demand side”“Supply side”
- 17. /// Visitor Site SSPAd Exchange DSP DMP serve page request page request bid request segment ad request cookie to SSP deliver segment Ad request Brand $ store data “Demand side”“Supply side”
- 18. /// Visitor Site SSPAd Exchange DSP DMP serve page request page request bid request segment ad request cookie to SSP deliver ad deliver segment Ad request Brand $ store data “Demand side”“Supply side”
- 19. /// Visitor Site SSPAd Exchange DSP DMP serve page request page request bid request segment ad request cookie to SSP deliver ad deliver segment sync Ad request Brand $ store data “Demand side”“Supply side”
- 20. /// Visitor Site SSPAd Exchange DSP DMP serve page request page request bid request segment ad request cookie to SSP deliver ad sync deliver segment sync Ad request Brand $ store data “Demand side”“Supply side”
- 21.
- 22.
- 23.
- 24. The Daily Bugle ExchangeExchange Exchange Exchange DSPDMP DSP DMP DSP DMP DSP DMP DSPDMP DSPDMP DSPDMP DMP DSP DSPDSP DSP DSP DSP
- 25. The Daily Bugle ExchangeExchange Exchange Exchange DSPDMP DSP DMP DSP DMP DSP DMP DSPDMP DSPDMP DSPDMP DMP DSP DSPDSP DSP DSP DSP ADVERTISEMENT
- 26. The Daily Bugle ExchangeExchange Exchange Exchange DSPDMP DSP DMP DSP DMP DSP DMP DSPDMP DSPDMP DSPDMP DMP DSP DSPDSP DSP DSP DSP ? ? ? ? ? ? ? ADVERTISEMENT
- 27. JavaScript ad creativescan summon unauthorized trackers. The Daily Bugle ADVERTISEMENT Plus, other data leakage via SDKs on mobile, 3rd parties on page, logging on load of 3rd party assets, etc. Any one of the hundreds or thousands of parties receiving personal data via ad exchanges can profile and / or trade with unauthorized parties.
- 28. Ad server SSP Step2. Ad server selects an SSP Step 3. SSP selects an exchange Step 7. DSP serves agency creative Step 8. Assets load from CDN Step 9. Agency ad server loads verification vendor ADVERTISERS website.com AD DMP DMP DMP DMP DMP DMP DMP DMP DMP DMP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP DSP W inningbid DSP Ad server javascript SSP javascript DMP DMP DMP DMP DSP DSP DSP DSP DSP DSP javascript Ad server javascript Step 6. Exchange serves winning bid Verification javascript Agency ad server Verification vendor Winning DSP Step 1. User requests webpage Ad exchange Channel of data leakage Personal data Legend Step 4. Exchange sends bid requests to hundreds of partners Step 5. Exchange lets some DMPs/ DSPs to refresh cookie sync CDN Money This is the current process of real-time bidding that is used in online behavioural advertising. DATA LEAKAGE IN ONLINE ADVERTISING Risk
- 29. Problem Set 2: Consentfor ad tracking 97%1 - 80%2 would reject 3rd party ad tracking (single dialogue) 1. "Research result: what percentage will consent to tracking for advertising?", PageFair, September 2017 (URL: https://pagefair.com/blog/2017/new-research-how-many-consent-to-tracking/) 2. “Europe Online: an experience driven by advertising”, IAB Europe, 2017, p. 7 (URL: https:// www.iabeurope.eu/wp-content/uploads/2017/09/EuropeOnline_FINAL.pdf).
- 30. A non-compliant GDPRconsent screen (single screen) [Site] and our partners set cookies and collect information from your [browser] [device] to provide you with [website] content, deliver relevant advertising and understand [web] audiences. [View partner info] We use technology such as cookies on our site to collect and use personal data to personalize content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our partners who also use technologies such as cookies to collect and use personal data to personalize content and ads, to provide social media features and to analyse our traffic on our site and across the internet. View info on our partners and their use of this data. You can always change your mind and revisit your choices. OK Manage use of your data Appears to be hard to not give consent breach of the GDPR, Article 4, paragraph 11, and Recital 42, and Recital 32. No mention of the duration for which data are stored. breach of the GDPR, Article 13, paragraph 2, a No precise description of a purpose of processing, and no notification of profiling. breach of the GDPR, Article 4, paragraph 11, and Article 13, paragraph 1, c, and paragraph 2, f, and Recital 60. Conflation of multiple purposes breach of the GDPR, Article 5, paragraph 1, b, Recital 32, and Recital 43.
- 31. 51% 64%13% Do you believethat users will opt-in to tracking for the purposes of advertising? No YesYes, if denied access to the site otherwise 1st party tracking on a website 23% 0% 100% 200% Can not deny access Article 7(2) prohibits conditionality.
- 32. 3% 3%32%65% 46% 51% 64%13% Do youbelieve that users will opt-in to tracking for the purposes of advertising? No Yes, if denied access to the site otherwise Yes 1st party tracking on a website 3rd party tracking on a website Tracking by any party, anywhere on the web 23% 0% 100% 200%
- 33. But the GDPRrequires a separate consent for each purpose
- 34. Website SSP Ad Exchange DSPDMP Advertiser Fraud verification Ad server Analytics 1 To inform the agents of prospective advertisers that you are on visiting the web site, so that the website can solicit bids for the opportunity to show an ad to you. Controller Processor Processor 2 To combine your browsing habits with data they already have collected about you (and infer further insights about you) so that they can select relevant ads for you. These ads may be for products you have shown interest in previously. This profile may include your income bracket, age and gender, habits, social media influence, ethnicity, sexual orientation, religion, political leaning, etc. Controller Controller Controller Controller Controller 3 To use your browsing habits to build or improve a profile about you, in order to sell these data to partners for online marketing, credit scoring, insurance companies, background checking services, and law enforcement. This profile may include your income bracket, age and gender, habits, social media influence, ethnicity, sexual orientation, religion, political leaning, etc. Controller Controller 4 To identify whether you are the kind of person that its advertising clients want to show ads to. Processor Controller Controller 5 To combine your browsing habits with data they already have collected about you (and infer further insights about you), to personalize the service or product that it offers you. This may include determining whether to offer you discounts. This profile may include your income bracket, age and gender, habits, social media influence, ethnicity, sexual orientation, religion, political leaning, etc. Controller 6 To monitor your behavior on websites in order to determine if you have viewed or interacted with an ad. Controller Controller Processor 7 To determine whether you have purchased one of its products or services following your viewing of or interaction with an ad that it has paid for. Controller 8 To combine your browsing habits with data they already have collected about you (and infer further insights about you), to verify that you are human rather than a “bot” attempting to defraud advertisers. This profile may include your income bracket, age and gender, habits, social media influence, ethnicity, sexual orientation, religion, political leaning, etc. Controller 9 To record the number of times you have viewed each ad, to prevent a single ad being shown to you too frequently. Controller 10 To combine your browsing habits with data they already have collected about you (and infer further insights about you), to understand how you and people similar to you browse the web. This profile may include your income bracket, age and gender, habits, social media influence, ethnicity, sexual orientation, religion, political leaning, etc. Controller Examples of the many purposes of data processing in online behavioral advertising. Each purpose requires its own opt-in.
- 35. Gordon House, Barrow St,Dublin 4, Ireland Acxiom GmbH Martin Behaim Strasse 12, 63263 Neu-Isenburg, Germany Google Ltd. Viewing 2 of 251 partners Help keep Example.com profitable Learn about your data rights here. OFF Let these companies combine your browsing habits for 6 months with data they already have collected about you to improve their profile of you, including by inferring insights, to show you relevant advertising. (This profile may include your income bracket, age and gender, habits, social media influence, ethnicity, sexual orientation, religion, political leaning, etc.). Item 1 of 9 View details View details Next Purpose of processing, and notification of profiling. Article 4, paragraph 11, and Article 13, para 1, c, and para 2, f. Duration Article 13, para 2, a. Granular opt-in for several purposes Recital 32, and Article 29 Working Party Guidance November 2017 Details of rights to complain to supervisory authority, and to access, correct, and transfer data, etc. Article 13, para 2, b, c, and d. unambiguous, specific affirmative action. Not yes by default. Article 4, para 11, and Recital 32. contact details of the Data controller, and list of categories of processor. Article 13, para 1, a, and Recital 42. An opt-in for each processing purpose
- 36. Help keep Example.comprofitable Learn about your data rights here. Let these companies combine your browsing habits for 6 months with data they already have collected about you to improve their profile of you, including by inferring insights, to show you relevant advertising. (This profile may include your income bracket, age and gender, habits, social media influence, ethnicity, sexual orientation, religion, political leaning, etc.). Item 1 of 9 Next Gordon House, Barrow St, Dublin 4, Ireland Acxiom GmbH Martin Behaim Strasse 12, 63263 Neu-Isenburg, Germany Google Ltd. View details View details Viewing 2 of 251 partners “Explicit consent” (to process special categories of data) Article 9, paragraph 2, a. This design requires Two tap / click / drag actions to signal consent explicitly Explicit consent for special categories of personal data OFF
- 37. Help keep Example.comprofitable Learn about your data rights here. Let these companies combine your browsing habits for 6 months with data they already have collected about you to improve their profile of you, including by inferring insights, to show you relevant advertising. (This profile may include your income bracket, age and gender, habits, social media influence, ethnicity, sexual orientation, religion, political leaning, etc.). Item 1 of 9 Next Gordon House, Barrow St, Dublin 4, Ireland Acxiom GmbH Martin Behaim Strasse 12, 63263 Neu-Isenburg, Germany Google Ltd. View details View details Viewing 2 of 251 partners This design requires Two tap / click / drag actions to signal consent explicitly Explicit consent for special categories of personal data “Explicit consent” (to process special categories of data) Article 9, paragraph 2, a.
- 38. Help keep Example.comprofitable Learn about your data rights here. Let these companies combine your browsing habits for 6 months with data they already have collected about you to improve their profile of you, including by inferring insights, to show you relevant advertising. (This profile may include your income bracket, age and gender, habits, social media influence, ethnicity, sexual orientation, religion, political leaning, etc.). Item 1 of 9 Next CONFIRM? Gordon House, Barrow St, Dublin 4, Ireland Acxiom GmbH Martin Behaim Strasse 12, 63263 Neu-Isenburg, Germany Google Ltd. View details View details Viewing 2 of 251 partners This design requires Two tap / click / drag actions to signal consent explicitly Explicit consent for special categories of personal data “Explicit consent” (to process special categories of data) Article 9, paragraph 2, a.
- 39. Most people willnot click OK to any of this
- 40.
- 41. 5 Needs “opt-in”consent, but is unable to communicate with users 4 Needs “opt-in” consent, but user has little incentive to agree • Facebook Audience Network • WhatsApp advertising (see assumption 1) 3 Needs “opt-in” consent, and may get it 2 Can show an “opt-out” before using data • NewsFeed ads (based only on personal data with no “special” personal data (e.g. ethnicity, political opinion, religious or philosophical beliefs, sexual orientation), unless marked “public” or visible to “friends of friends” (see assumptions 1 and 2) • Instagram ads (see assumption 1) 1 Out of scope of the regulation, if business is modified. 0 Already out of scope of the regulation. Assumption 2. GDPR Article 6, paragraph 4, c, indicates a higher bar for “special categories of personal data” that reveal race, ethnicity, political opinion, religious or philosophical beliefs, trade union membership, or related to a data subject’s sex life or sexual orientation. However, this does not apply if the data have been “manifestly made public by the data subject” (GDPR, Article 9, paragraph 2, (e)). This may mean that the publicity settings that a user places on their post will prevent or enable those posts to be mined for advertising. GDPR scale: FACEBOOK Assumption 1. That the use of personal data to target advertising will be accepted as a “compatible” purpose with the original purpose for which personal data were shared by users, under GDPR Article 6, paragraph 4. GDPR Recital 61 says that if the further processing is compatible then the company must alert the data subject that it is using their data for this further purpose before it starts processing. GDPR Article 21, paragraph 2 and 3 say that the data subject must be alerted about their right to object to their data being used for direct marketing, and can do so at any time. GDPR Recital 70 says this alert should be presented clearly and separately from any other information. However, the Article 29 Working Party’s opinion on purpose limitation notes that among the various things that the compatibility assessment must consider are “the impact of the further processing on the data subjects”.
- 42. 5 Needs “opt-in”consent, but is unable to communicate with users 4 Needs “opt-in” consent, but user has little incentive to agree • Most personalized AdWords ads on Google properties including Search, Youtube, Maps, and the Google Network (including “remarketing”,“affinity audiences” , “in-market audiences”, “demographic targeting”, "similar audiences”, “Floodlight” cross-device tracking), “customer match”, “remarketing” (see assumption 1) • Gmail ads • Programmatic services (DoubleClick) 3 Needs “opt-in” consent, and may get it 2 Can show an “opt-out” before using data • Location targeting in Maps (see assumption 2) 1 Out of scope of the regulation, if business is modified. • AdWords (if all personalized features are removed) on Google properties including Search, Youtube, Maps 0 Already out of scope of the regulation. • “Placement-targeted” ads on Google properties. Assumption 1. That the average user does not “sign in” to Google Search or Chrome. If, however, users did sign in then Google may be able to further process their data for other purposes. GDPR scale: GOOGLE Assumption 2. That the use of personal data to target advertising will be accepted as a “compatible” purpose with the original purpose for which personal data were shared by users, under GDPR Article 6, paragraph 4. GDPR Recital 61 says that if the further processing is compatible then the company must alert the data subject that it is using their data for this further purpose before it starts processing. GDPR Article 21, paragraph 2 and 3 say that the data subject must be alerted about their right to object to their data being used for direct marketing, and can do so at any time. GDPR Recital 70 says this alert should be presented clearly and separately from any other information. However, the Article 29 Working Party’s opinion on purpose limitation notes that among the various things that the compatibility assessment must consider are “the impact of the further processing on the data subjects”.
- 43. Fossil Fuel RenewableEnergy N20 C02 Regulatory disincentive OLD INDUSTRY Regulatory incentive NEW CLEAN INDUSTRY
- 44. Ads (Ethical Data)Ads(Conventional Data) Personal data Non-personal data Regulatory disincentive OLD INDUSTRY Regulatory incentive NEW CLEAN INDUSTRY Fossil Fuel Renewable Energy N20 C02
- 45. Ads (Ethical Data)Ads(Conventional Data) Personal data Ads (Conventional Data) Personal data (with consent and enforceable protection) Non-personal data Small, premium market // Regulatory disincentive OLD INDUSTRY Regulatory incentive NEW CLEAN INDUSTRY + Fossil Fuel Classic CarsRenewable Energy N20 C02 +
- 46. 1.Personal data leakagefrom widgets & adtech exposes us all to legal risk. 2.Data leakage is also theft of your audience. 3.Media owners should ask for regulatory action: when you comply, you are not cheated by competitors. @johnnyryanSummary
- 47.