Bidders and Brokers: Investigation into Real Time Bidding and Data Broker Activities in AdTech

Companies using real-time bidding for advertising should take heed of the investigation developments across the pond. The Information Commissioner’s Office (ICO) has resumed its investigation into real-time bidding and the advertising technology (AdTech) industry. The investigation was paused back in May 2020 as ICO focused on prioritizing its response to the COVID-19 pandemic. The investigation has been an ongoing project since February 2019, and ICO partly started its original efforts into the review of real-time bidding due to the risks it poses to the rights and freedoms of individuals.

Real-Time Bidding and Personal Data

Real-time bidding is a system where advertising is bought and sold through near-instant auctions. An advertising buyer will place a bid on an advertising impression, and if the bid wins, the advertisement is displayed on a site or platform. Reports suggest that real-time bidding will use personal data in bid requests over a billion times per day. There are personal data concerns because there is little control over where this personal data is shared and a lack of transparency around how it is used, especially because real-time bidding is complex, even for those with technical knowledge. ICO’s review of real-time bidding has thus far resulted in urging organizations to follow ICO’s guidance reports, but the renewed investigation appears to be ramping up for more aggressive enforcement.

Data Brokering

According to the ICO, “data brokering” is the practice of aggregating information from a variety of sources; creating a richer data set that can be resold or licensed to other entities. This is slightly different from US definitions which focus more on the lack of direct relationship with the consumer in addition to aggregator activities.

By way of example, the ICO recently issued an enforcement action against Experian in October 2020, after an investigation into how credit monitoring companies traded, enriched, and enhanced people’s personal data without their knowledge. As part of its enforcement action, ICO ordered Experian to stop using personal data collected for credit referencing purposes for marketing purposes. Using personal data for marketing was an unexpected use of personal data, particularly because people had no choice about whether their data was shared with Experian for credit referencing purposes in the first place.

ICO’s investigations into data brokering are far from over, and data brokering will continue to be reviewed as it plays a large part in real-time bidding.

Enforcement Notices

ICO’s announcement suggests that it will issue notices to particular companies, and ICO has previously stated that it is ready to “utilize its wider powers” for those who are not engaging with the issues involved in real-time bidding. For example, ICO’s review of Data Protection Impact Assessments for real-time bidding found that many assessments were generally immature, lacked appropriate detail, and did not follow ICO’s recommendations to assess the risk to rights and freedoms of individuals. Further, basic data protection controls, data retention, and security for personal data used in real-time bidding were insufficient.

Companies are advised to urgently assess their AdTech practices and ensure they have implemented best practice guidance into their AdTech operations.