Enlarge image
Collection of advertising motifs: The banners are often displayed online based on the data in advertising profiles
Photo: Douglas R. Clifford / imago images / ZUMA Wire
The Hamburg Regional Court has - at least if the plaintiff is to be believed - to deal with a case of international concern. Johnny Ryan describes the practice of today's online advertising as "the greatest data leak in history" and his civil suit as a "milestone". The Irish data protection activist, who works for the Irish Council for Civil Liberties, wants to overthrow one of the central business models of online advertising that generates billions of euros annually: the huge real-time data marketplaces, on which billions of advertising spaces are auctioned every day.
Ryan sued three organizations.
First the IAB Tech Lab, an industry organization that sets technical standards for the advertising industry.
Second, the online advertising exchange Xandr, which also has a location in Hamburg.
Third, a specialist portal for online marketing, which Ryan accuses of having passed on his advertising data inappropriately.
Lawsuit against a business model
The activist's goal is not a single company, but a complete business model. "Real Time Bidding" (RTB for short) is a system with which advertising can be displayed on websites all over the world, including SPIEGEL.de. The basic idea: Instead of booking advertising on certain advertising spaces, advertisers can instead reserve a space on the screen of certain customer groups. The system has conquered the industry in recent years. According to the industry organization IAB Europe, RTB generated sales of 6.6 billion euros in Europe in 2019, and companies spent a total of 23 billion euros on data-based advertising.
The implementation is technically complex. After users have accessed a website, this information is sent to real-time marketplaces. The platform operators collect as much information as possible: age, income class, hobbies, search history - even the weather at the user's location can be included. Automated programs bid on these advertising spaces on behalf of the advertisers in order to display the most relevant advertising possible at the lowest possible cost. The whole thing happens within fractions of a second. When the website is loaded, the advertising spaces are already populated with personalized advertising.
Ryan accuses the providers of this system of fundamentally disregarding the data protection rights of the users. On the one hand, he accuses the advertising companies of processing data that should not be used for advertising purposes - such as information on health or sexual orientation. Where information is allowed to be used, he accuses the technology providers and the publishing websites of not providing users with sufficient information. In the course of advertising processing, the profile information is passed on to hundreds, sometimes even more than 1000, companies. This is not made sufficiently clear in the widespread cookie banners. In order to substantiate the lawsuit, Ryan and his lawyers have carefully analyzed the data traffic from online portals, compiled advertising material from the companies involved and internal documents.The result is a complaint of more than 180 pages in which Ryan outlines the flow of data between the various parties as an example.
The Irishman, who previously worked in online advertising himself, has been campaigning against the industry for years and has initiated several proceedings with European supervisory authorities, including against Google. But so far there has been no tangible result. Although the British data protection authority had already classified the RTB system as "excessive, intrusive and unfair" in 2019, it was content with minor improvements by the advertising industry. Belgian privacy advocates also expressed major doubts about the system last year. Nevertheless, business continues to this day. Most disappointed is Ryan from the data protection authority of Ireland. “Two years after the agency opened an investigation into Google's advertising systems, it hasn't even publishedwhich aspects it specifically wants to examine «. The advertising business could continue because the responsible supervisory authorities did not enforce the General Data Protection Regulation.
The advertising industry criticizes the lawsuit. "Johnny Ryan and his cooperation partners have already submitted complaints against real-time bidding in accordance with the GDPR in 22 EU countries," explains Thomas Duhr, Vice President of the BVDW digital association, in an interview with SPIEGEL. The procedure is now being carried out in consultation with several supervisory authorities in Belgium. "Why he is now filing a civil suit, even though the proceedings are ongoing, is not clear to me," says Duhr.
The lawsuit is based in part on misunderstandings, explains Duhr. "For example, I consider it legitimate to categorize the types of data listed in the lawsuit," explains Duhr, who works in the main job for RTL marketer IP Deutschland. Laws stipulated not to display advertising in certain cases - or only under certain conditions. In order to comply with the law, however, one must be able to record where and when advertising is not allowed to be played. This is stated in the documents that Ryan cites in his complaint.
While online advertising has grown largely unregulated in the past few decades, politics is now pulling the reins. For example, a group of MPs has formed in the European Parliament who want to restrict or completely ban advertising based on advertising profiles. At the same time, politicians are working on laws such as the E-Privacy Regulation or the Digital Services Act, the latter in particular to reorganize online business. If real-time bidding is made more complicated or abolished with the new regulations, it could become expensive for website operators. "Data-based advertising in the broader sense makes up 60 to 70 percent of all digital advertising income in Germany today," says Duhr.
