Examining the validity of consumer consent for behavioral advertising under the General Data Protection Regulation
Personal data is used in behavioral advertising to display targeted ads and commercial content.[1] Typically, personal data is collected in exchange for free services (such as search engines and social media platforms) and transferred between such service providers.[2] While it has significant positive effects on the economy, this ecosystem also contributes to manipulation and undue influence by marketers.[3] This article focuses on valid consent for behavioral advertising under the General Data Protection Regulation (GDPR).[4]
Artificial intelligence (AI) has revolutionized marketing by enabling personalized and targeted advertising, improving the customer experience and lowering advertising costs.[5] Marketers use machine-learning algorithms to learn from data about previous consumer behavior and predict a consumer's future financial value.[6]
According to the European Commission (EC), targeted advertising is "a marketing practice that uses data about individuals to select and display advertisements or other forms of commercial content for marketing purposes."[7] The EC distinguishes three main practices: (i) contextual advertising, (ii) segmented advertising, and (iii) behavioral advertising. This article focuses on behavioral advertising.
Behavioral advertising targets online consumers by showing relevant ads based on past behavior and predicted future behavior.[8] This approach relies on collecting and analyzing personal data to provide targeted content to consumers.[9]
While this leads to significant economic benefits, the ability to predict consumer behavior offers marketers the opportunity to elicit certain behaviors through targeted advertising.[10] This ability provides a great incentive for deception and manipulation, as consumers may not be aware of how they are being influenced. Thus, this ability may influence consumer consent.[11]
Data protection laws play a prominent role in the regulation of behavioral advertising.[12] The AVG applies "to the processing of personal data ...", which constitutes the material scope of the AVG.[13] It follows that the AVG applies to behavioral advertising as long as these practices involve the processing of personal data.[14
According to the AVG, any processing of personal data must be based on a legal basis which is described in Article 6.[15] A crucial role is played by consumer consent (Article 6(1)(a) AVG).[16] Consent is defined as "any freely given, specific, informed and unambiguous expression of will whereby the data subject signifies, by means of a statement or an unambiguous active act, his consent to the processing of personal data relating to him."[17] According to the combined reading of Articles 4 and 7 and recitals 32, 33, 42, 43, 53 and 58 of the AVG, valid consent must be (i) freely given, (ii) specific, (iii) informed and (v) obtained by a clear affirmative act of the data subject.[18]
The AVG aims to strengthen the position of consumers vis-à-vis behavioral advertising,[19] however, this legislation has so far not been able to significantly impact the behavior of marketers or the online behavior of consumers.[20]
This current state of affairs is largely due to the way consumer consent is misused as the legal basis for targeted advertising.[21] In theory, the mandatory legal basis for data processing should ensure that personal data are only processed when it serves the interests of the consumer in question, who has voluntarily consented to the data processing (Article 6(1)(a) AVG).[22] Unfortunately, it seems that the weakness in this mechanism is precisely this consent.[23] AI algorithms can target consumers based on their psychological profiles and preferences, persuading consumers to consent to any kind of processing for advertisements and make purchases or behave against their own interests.[24]
Several solutions have been proposed to address the legal challenges of AI in online marketing.[25] One possible solution is to limit the scope of consumer consent.[26] This would mean that consent would no longer be a valid legal basis for the use of personal data in behavioral advertising.[27] This would make the processing of personal data in these cases unlawful, even when the consumer has given consent.[28]
Consumer laws can be used to invalidate consent in cases where the exchange of personal data is unbalanced, particularly where marketers have significant market power.[29] Restricting the processing of personal data even where consent has been given may seem paternalistic.[30] However, preventing agreements driven by unequal power could improve consumer choices.[31]
If the law invalidates consent, it would require significant changes to current business models that rely precisely on collecting and processing personal data for advertising.[32] This could affect the revenues of large platforms and smaller entities.[33] However, this approach does not eliminate advertising based on the content of web pages visited or services requested.[34] Targeted advertising can still be delivered without using behavioral data, and users who want personalized suggestions can opt for monitored behavior-based ads.[35] This may motivate marketers to offer more relevant marketing content, as users may drop out if targeted ads are found irrelevant or annoying.[36]
In conclusion, valid consent plays a crucial role in behavioral advertising under the AVG, but it is not enough to fully protect consumers. A broader legal framework is needed to address the challenges of AI-driven marketing. One possible solution is to limit the scope of consumer consent by invalidating it as a legal basis for the use of personal data in behavioral advertising. This would make such processing illegal even with consent. Consumer laws could invalidate consent in cases of unbalanced data sharing or significant market power. While this approach may require changes to existing business models, it allows targeted advertising based on content or requested services without using behavioral data. Users can opt for monitored ads based on behavior if they wish. These measures would empower consumers, prevent unfair deals and encourage marketers to provide more relevant content while respecting privacy rights.
Want to know more about this matter? Then visit our Academy.
1. European Parliament. (2021). Regulating targeted and behavioral advertising in digital services. How to ensure users' informed consent. Accessed June 1, 2023, from https://www.europarl.europa.eu/thinktank/en/document/IPOL_STU(2021)694680, p. 10-11. (Hereinafter European Parliament (2021)).
2. Galli, F., Lagioia. F. & Sartor, G. (2022). Consent to Targeted Advertising. European Business Law Review, 33(4). Accessed May 31, 2023, from https://kluwerlawonline.com/journalarticle/European+Business+Law+Review/33.4/EULR2022023, p. 486. (Hereinafter: Galli et al (2022)).
3. European Parliament (2021); Galli et al (2022), p. 486.
4. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
5. Kumar, D. (2023). Ethical and Legal Challenges of AI in Marketing: An Exploration of Solutions. Available at SSRN 4396132. Accessed May 30, 2023, from https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4396132, p. 2. (Hereinafter: Kumar (2023)); Eriksson, K., Kerem, K., & Nilsson, D. (2019). Artificial intelligence in marketing: A general overview and future research directions. Journal of Business Research, 98, 365-380. (Hereinafter: Eriksson et al (2019)).
6. Ribeiro, T., & Reis, J. L. (2020). Artificial intelligence applied to digital marketing. In Trends and Innovations in Information Systems and Technologies: Volume 2 8 (pp. 158-169). Springer International Publishing. Accessed June 1, 2023, from https://link.springer.com/chapter/10.1007/978-3-030-45691-7_15, p. 161.
7. European Parliament (2021), pp. 23-24.
8. Sposit, N. (2021). Adapting to digital marketing regulations: The impact of the General Data Protection Regulation on individualized, behavior-based marketing techniques. Journal of Digital & Social Media Marketing, Henry Stewart Publictaions, vol. 6)4), p. 342 (Hereinafter: Sposit (2021)).
9. Sposit (2021), p. 342.
10. European Parliament (2021), p. 19.
11. European Parliament (2021), p. 19; Galli et al (2022), p. 490.
12. Galli et al (2022), p. 490-491.
13. Purtova, N. (2018). The law of everything. Broad concept of personal data and future of EU data protection law. Law, Innovation and Technology, 10(1). Accessed May 31, 2023, from https://doi.org/10.1080/17579961.2018.1452176, p. 43-44.
14. Ibid.
15. Galli et al (2022), p. 490-491.
16. Ibid.
17. Article 4(11) AVG.
18. Galli et al (2022), p. 490-491.
19. Galli et al (2022), p. 490-491.
20. European Parliament (2021), pp. 20-21.
21. Ibid.
22. European Parliament (2021), pp. 20-21; Kumar (2023), p. 14; Crawford, K., & Schultz, J. (2014). Big data and due process: Toward a framework to redress predictive privacy harms. Boston College Law Review, 55(1), 93-128; German, S., O'Sullivan, S., & Raworth, K. (2019). Communicating AI. The Lancet Digital Health, 1(2), e51-e52. (Hereinafter: German et al (2019)); Kumar (2023), p. 5.
23. European Parliament (2021), p. 21.
24. German et al (2019).
25. Eriksson et al (2019).
26. Eriksson et al (2019); Kumar (2023), p. 3.
27. Galli et al (2022), pp. 508-509.
28. Galli et al (2022), p. 508.
29. Hacker, P. (2019). Regulating the economic impact of data as counter-performance: from the illegality doctrine to the unfair contract terms directive. Data as Counter-Performance: Contract Law, 2.
30. Galli et al (2022), p. 509.
31. European Parliament (2021), pp. 117-120; Galli et al (2022), p. 509.
32. Galli et al (2022), pp. 510-511.
33. Ibid.
34. European Parliament (2021), p. 122.
35. Ibid.
36. Galli et al (2022), pp. 510-511.
