A Little Privacy: week of August 2

Julie Rubash, Chief Privacy Counsel
August 9, 2021

Want to receive these weekly privacy recaps in your inbox? Sign up for our privacy newsletter, A Little Privacy.


Facebook disables accounts of university researchers

In response to a report that Facebook disabled the personal accounts of New York University researchers who were collecting data on the targeting of political ads on Facebook, Sen. Mark Warner (D-VA) released a statement calling Facebook’s decision “deeply concerning” and stating that “it’s time for Congress to act to bring greater transparency to the shadowy world of online advertising, which continues to be a major vector for fraud and misconduct.” 


Although Sen. Warner is just one senator, we have seen a rapidly increased emphasis in the United States on addressing privacy, antitrust, fraud and misconduct in the advertising industry, in particular surrounding the collection and use of data for ad targeting. This is just another signal that we’re likely to see an increase in legislation, regulation and enforcement in these areas.


Amazon threatened with unprecedented GDPR fine

According to new information released this week, Amazon has 6 months to establish a proper legal basis for its ad targeting practices to avoid receiving a 746 million euro fine per day of delay after the 6-month period. The decision was issued by the Luxembourg data protection authority and agreed to by other European states. 

Amazon had previously relied on its contract terms of service as a means of obtaining consent to ad targeting, which the Luxembourg DPA held to be insufficient. 

Some context: Amazon is not the first company to try to rely on its Terms of Service as a legal basis to process data for ad targeting, either leaning on it as a form of consent under Article 6.1(a) or claiming that ad targeting is “necessary for the performance of a contract” under Article 6.1(b)  Article 6.1(b) only applies if processing is necessary for the performance of a contract, and, despite arguments from Facebook and Amazon, the courts don’t appear to consider targeted advertising to be “necessary” to the services they provide consumers. 


Identity solutions that rely on first-party data may tempt data controllers to combine consent with other contract terms (e.g., agreeing to the terms of service). These cases are good reminders to always ensure consent is distinguishable, clear, and freely given. 

IAB provides contextual advertising guidance

IAB Europe released a Guide to Contextual Advertising, noting that $412B is projected to be spent on contextual advertising by 2025. The guide provides best practices, including using providers who have access to opt-in panels and checking up on the transparency of providers through A/B testing on the accuracy and precision of their classification. The guide also discusses the integration of first-party data with contextual advertising, offering that “incorporating real-time insight into a contextual campaign ensures the perfect blend between audience and context is achieved.” 


Shifts to contextual targeting may present new challenges for publishers and advertisers to ensure the providers and methods selected are transparent, effective and responsible. Additionally, an emphasis on opt-in panels and first-party data to supplement contextual advertising will depend on consent solutions that are tailored to the needs of the evolving digital advertising industry.   


Brazil’s LGPD goes into effect

The final portion of the LGPD went into effect on August 1, authorizing administrative sanctions for noncompliance. The Brazil data protection authority, however, pledged to take a responsive approach to organizations failing to comply, as reported by ZDNet


Now that sanctions are a possibility, we may start to see companies taking LGPD more seriously, although the “responsive approach” promised by the DPA may calm anxieties. 

Israel DPIAs

The Israel Authority for Conducting an Impact on Privacy Survey released a new guide to help companies identify and reduce risks from collection of personal data. The public comment period is now open to receive feedback on the guidelines.


Although Israel law doesn’t currently require data protection impact assessments, this is another example of the growing emphasis from countries across the globe either mandating or encouraging companies to incorporate such assessments into projects involving personal data.   

Pseudonymous data use in South Korea

South Korea’s Personal Information Protection Commission issued proposed amendments to the Notice on the Combination and Export of Pseudonymous Information, providing clarity on the pseudonymization, export and combination of data, in order to promote the safe and convenient dissemination of pseudonymous information. The Commission opened a 20-day public comment period to provide feedback. 


Due to the pseudonymous nature of most advertising data (i.e., not directly identifying an individual without combining with other data), changes to requirements and guidelines regarding the handling of pseudonymous information are likely to impact the advertising industry, but we will know more from analysts in the coming weeks.

Want more of the privacy highlights that matter to adtech and martech? Sign up for our privacy newsletter, A Little Privacy.

Latest Blog Posts

Unlimited Data Export for Easier Privacy Audits and CMP Disclosures

July 12, 2024

Keeping track of all your tracking technology partners to...

What is Global Privacy Control? Frequently Asked Questions

July 9, 2024

How does Global Privacy Control work? How is it...

Comprehensive Privacy Laws Take Effect in Texas and Oregon

July 9, 2024

Now in effect: privacy laws in Texas, Oregon, and...

Latest White Papers

E-book: Enterprise Guide To Cookie management & Tracker List Curation

July 1, 2024

How to review the tracking tech on your websites...

Benchmark Report: US Privacy Compliance

August 19, 2022

The current state of publisher compliance with CCPA, and...

Keep in touch

Sign up for our newsletter to keep up with privacy news for adtech and martech,
plus occasional company news.

Let's explore what we can do together.

We'll be in touch within 48 hours

[contact-form-7 id="593" title="Schedule a Demo"]