The current system of online advertising has been ruled illegal by the Belgian Court of Appeal. Advertising itself is still allowed, but not in a way that secretly tracks everyone’s behavior.

From time to time, important news gets overshadowed by other headlines, even though it could have a profound impact on our (online) world. To most of us, few things are more bothersome than the dreaded cookie banners. On countless websites, you’re confronted with a pesky pop-up urging you to agree to something. You end up consenting without really knowing what it is. If you try to figure out what’s going on, you quickly get lost among the often hundreds of “partners” who want access to your personal data. Even if you do give your consent, it’s questionable whether you truly understand what you’re agreeing to.

The Trade in Personal Data

Take, for example, the Dutch newspaper de Volkskrant (a major daily newspaper in the Netherlands). When you visit their website, you’re immediately shown a block of text asking if you’re okay with your behavioral data being shared with “93 advertising partners” - most of whom you probably haven’t heard of. The button to accept is big and yellow. If you ignore it and click “settings”, you’re shown a list of “107 advertising partners.” These companies may store your data, such as your exact geolocation, for years, and “match and combine” it with information from other sources. Even then, as a user, you still don’t really understand what’s happening.

The newspaper needs your consent to use your data for showing ads. Information about you and your online behavior is shared with dozens, sometimes even hundreds, of companies you’ve never heard of. Your data and browsing habits are then used in a fully automated system. The ad space on websites is auctioned off to advertisers in a fraction of a second. Based on your data, they decide whether to bid for a spot to show you their ad on the site you’re visiting. In short: there’s a hidden marketplace trading in your personal data.

And that’s against European privacy law. That’s why, back in 2019, Bits of Freedom asked the Dutch Data Protection Authority to take action. Similar organizations across Europe, focusing on protecting human rights, did the same. Three years later, the Belgian Data Protection Authority ruled that this system of online ad auctions violated the law. The company that manages this framework, IAB Europe (the European branch of the Interactive Advertising Bureau), was fined €250,000 and ordered to change the system and delete all collected personal data. Naturally, IAB Europe disagreed and appealed the decision.

Illegal

Fast forward to the end of May: IAB Europe lost its appeal, and the court sided with the regulator. This court ruling has major consequences. It means the system of behavioral advertising, meaning advertising where our behavior is constantly tracked, violates privacy law. The current model of advertising online is therefore illegal. Advertising itself is still allowed, but not in a way that secretly tracks everyone’s behavior. Contextual advertising is still considered in line with the law: for example, a hardware store may advertise alongside a video about building a deck. There’s nothing wrong with that.

This is a win for everyone in Europe, and possibly beyond. Companies may no longer secretly track your behavior based on “consent” given under pressure. Hopefully, this will not only put an end to these dubious practices, but also to those pesky cookie banners.
But we’re not there yet. Regulators have ruled the system illegal, and the court’s ruling has now confirmed it. Still, the companies making billions from this model won’t stop on their own. That’s why European regulators must now truly step up: enforce the law and make sure these companies actually comply.