In a recent ruling, the Court of Justice of the EU (CJEU) delivered a significant blow to the tracking ads industry. The court confirmed that the data generated by the ad industry’s consent management tool, in response to users’ privacy choices, is personal data within the meaning of the bloc’s General Data Protection Regulation (GDPR).
This ruling has significant implications for the ad industry and businesses that rely on digital advertising. The court also held that the ad industry association responsible for devising the consent management tool, IAB Europe, is a ‘joint controller’ with its advertiser members. This means that it can’t eschew responsibility for ensuring the data processing complies with the GDPR.
The Belgian DPA’s decision, which found that the ‘Transparency and Consent Framework’ (TCF) breached the GDPR, was a big deal for web users in Europe. The GDPR came into force in May 2018, and since then, websites have been littered with pop-ups soliciting consent for ‘sharing’ user data with long lists of ad ‘partners’.
The adtech industry has been accused of making it difficult for users to deny tracking. Tactics include pre-checking sharing options and requiring web users to manually click through and uncheck multiple boxes, making it tedious and time-consuming to reclaim privacy.
The CJEU’s ruling will now be factored into the ongoing legal proceedings against the IAB’s TCF. The IAB had sought to overturn the Belgian decision by arguing that TCF strings are not personal data and challenged the authority’s classification of it as a joint controller. On both counts, the CJEU found otherwise.
So, what does this mean for SMBs? The ruling could potentially lead to a significant shift in digital advertising practices. Businesses that rely on tracking ads for their marketing strategies may need to rethink their approach. The emphasis on user consent and data protection means that businesses will need to be more transparent and respectful of user privacy.
The ‘consent or pay’ model, where users are given the choice to either consent to tracking or pay for an ad-free experience, is also under scrutiny. This model is facing privacy and consumer protection challenges, and the European Data Protection Board is due to weigh in with guidance soon.
In conclusion, the CJEU’s ruling is a reminder that businesses must prioritize user privacy and consent in their digital marketing strategies. The days of ‘compliance theatre’ are numbered, and businesses must adapt to a landscape where user consent cannot be taken for granted. As the digital marketing landscape continues to evolve, businesses must stay informed and adapt their strategies accordingly.
For more insights and strategies for local, service-based SMBs, stay tuned to our blog at Optimized Marketing.
