The UK’s data watchdog has found that adtech companies are holding on to large amounts of personal data that have been obtained through real-time programmatic bidding.
The Information Commissioner’s Office revealed its preliminary findings in a private meeting this morning, having launched an investigation into the real-time bidding industry in June.
RTB is an auction whereby advertisers (through exchanges) bid for audiences they want to target. The watchdog warned ±±¾©Èü³µpk10 earlier this year that the industry has evolved into a world of "perverse" incentives" in which intrusive behaviour is being rewarded.
— Johnny Ryan (@johnnyryan)The ICO presenting this morning on its findings since its June interim "adtech report". This is precisely what we said in our original GDPR complaints
Among its findings, the ICO confirmed that special category data, which includes sensitive information about uses such as their sexual orientation or political affiliation, was being directly processed without explicit consent.
There are also inconsistent contractual arrangements in the RTB process, the ICO said, as well as inadequate transparency information.
Johnny Ryan, chief policy and industry relations officer for ad-tracker-blocking browser Brave, said the ICO's findings were "precisely" what it said in its GDPR complaints about RTB earlier this year and which was criticised by the Internet Advertising Bureau for being "intentionally damaging to the digital advertising industry".
Media was not invited to the London meeting, which was originally set to be held under Chatham House rules, but this was later waived by the ICO’s executive director for technology policy, Simon McDougall, who is leading the investigation.
Ryan said: "It’s a good session, though several years too late. What has become clear to everyone is that RTB is indeed causing a massive data breach. And I think there was a consensus in the hall that the industry needs to reform to fix that. We at Brave and our colleagues at privacy organisations like ORG [Open Rights Group] and Panoptykon Foundation are no longer the only voices calling for change. Everybody gets it now."
±±¾©Èü³µpk10 has asked the ICO for more information about its findings, but a spokeswoman indicated that it was unlikely to comment.
There is likely to be a formal statement about the investigation’s progress in the coming weeks, given that the ICO said in June that the industry had six months to start taking action over RTB abuses.
Google also presented at the event to explain its decision last week to remove some bid request information from programmatically traded advertising.
Beginning in February 2020, Google will no longer include contextual content categories, such as "sport" or "weather", in bid requests. Google cited privacy concerns since contextual categories revealed in a bid request can be used to create individual profiles about individual users.