The Autoriteit Persoonsgegevens (AP) advises Dutch websites to immediately stop using the widely used advertising system of advertising industry organization IAB Europe. The system, which uses information about website visitors' browsing behavior to base ads on, violates privacy laws.
So reports the Financieele Dagblad (FD) based on an opinion from the AP (1).
About 80% of European Web sites use IAB's Transparency & Consent Framework (TCF), according to the newspaper. The websites affiliated with the TCF all ask users for permission to collect browsing data in the same way. This is done through a pop-up screen. The data collected, in turn, the Web sites use to sell advertising space that suits specific visitors.
The Autoriteit Persoonsgegevens (AP) advises companies using the TCF to look for alternatives. According to the regulator, it is questionable whether other systems that track users and resell data do comply with privacy laws. More research is needed to find out, an AP spokesperson told Data&Privacyweb.
In the meantime, according to the regulator, companies are better off switching to other ways of advertising, such as contextual advertising. This is very simple: for a video about DIY, an advertisement for a DIY store. For an article about soccer, an advertisement for a sports store. The STER has been working with this method for a few years now, and it seems to work very well,' says the regulator.
It is still unclear how the AP's advice will affect companies that have used or are using the TCF. The AP informs that companies using the IAB system violate the AVG and that enforcement for such violations is possible. Whether the regulator will actually impose fines remains to be seen, according to the FD. Large advertisers who used the TCF do fear this, according to the newspaper, as do claims from privacy organizations.
IAB represents major media and tech companies such as RTL, Google and Microsoft, among others. The TCF set up IAB only in 2018 (2). It also has a knowledge hub on online advertising and organizes events and training sessions on the topic.
The AP's advice follows a ruling by the Belgian privacy regulator. That first ruled that the TCF violates European privacy laws, because the data collected by IAB can be traced back to individual persons through incorrect linking.
The Belgian regulator launched an investigation into the TCF partly based on a complaint to the AP. The Belgians imposed a fine of 250,000 euros on IAB, but gave the trade association two months to solve the problem and remove collected data. The AP looked along with the Belgian investigation and is therefore now making its own ruling because this is a case that also affects Dutch citizens.
IAB, in a reaction on its own website, previously expressed its disagreement with the ruling of the Belgian regulator (3). The Belgians wrongly see the IAB as the data controller for the data collected with the TCF, according to IAB. Nevertheless, the industry association is willing to explore with the Belgian privacy regulator what adjustments can be made to make the TCF comply with privacy legislation. IAB Europe has not yet responded to the AP's advice.
(1) https://fd.nl/tech-en-innovatie/1429434/toezichthouder-advertentiebranche-moet-direct-stoppen-met-online-volgen-bezoeker-ihb2caAzTufo
(2) https://iabeurope.eu/transparency-consent-framework/
(3) https://iabeurope.eu/all-news/apd-ruling-clears-way-for-work-on-developing-tcf-into-a-formal-gdpr-code-of-conduct-iab-europe-statement-on-the-apd-decision-announced-today/
