In a Discussion Report published in August 2022 the Bundeskartellamt outlined the findings of its sector inquiry into non-search online advertising and presented them to market participants and observers for discussion. About one year after the editorial deadline of the Report, this article discusses some market developments which have become observable in the meantime and relates them to the Discussion Report’s findings regarding the market structure, the dispute about the use of personal data for advertising purposes and effective competition oversight in a highly complex, technically fast-moving and opaque sector in which one player is in a very special position.
By Holger Dubberstein[1]
In August 2022 the Bundeskartellamt published a Discussion Report summarizing the findings of its sector inquiry into online advertising.[2] Based on a number of interviews with market participants with different positions in the online advertising value chain and on several hundred responses to written questionnaires sent out to advertisers, media agencies, publishers and ad technology providers, the Report undertook to describe the value chain and its technical elements, discuss plausible market definitions, and identify market positions and the factors which are likely to influence them.
Extending the view beyond the situation at the time, the Report’s two final chapters were each devoted to possible changes in the landscape: One analyzed, amid lasting discussions about the industries’ data-gathering practices, what more restrictions on access to personal data could mean from a competition point of view for a sector as data hungry as this one. The other chapter discussed whether, in an industry exhibiting those special features so far defining the non-search online advertising sector, competition really can be preserved – or, if considered necessary, restored – with the instruments currently available to competition authorities and regulators. And what could be done if this is not the case.
The Discussion Report was meant to start a discussion with the industry and market participants were offered the possibility to submit written comments, which a number of them did. The individual submissions as well as a Final Report providing a summary of the comments (in German only) are available on the Bundeskartellamt’s website.[3]
Nearly a year after finalizing the Discussion Report and given the fact that online advertising can rightfully be considered a rather fast-moving industry – at least as far as technology is concerned – it seems like the right time to take a short look at some developments that can be observed in the market, the relevant regulatory and legal landscape and how they relate to the Discussion Report’s findings. Just like the Report, this is unavoidably based on a somewhat German and European perspective. But first, slightly more context is provided for those new to the topic.
I. ONLINE ADVERTISING MAY MEAN DIFFERENT THINGS – THE SCOPE OF THE SECTOR INQUIRY
Not all online advertising is the same and different parts of the industry raise different questions. For many people the first association that comes to mind when thinking of online advertising might be what competition authorities and market participants usually call online search advertising – those little ads that appear after entering a query into a search engine. The sector inquiry, however, did not focus on this form of advertising, even though one undertaking, Alphabet (aka Google), commands a strong market position[4] in this context.[5] But there is also another sector of the online advertising industry that seems worth a closer look: non-search online advertising. This term is used to describe all those ads that appear when opening a web page, starting an app on a mobile phone or plunging into watching some videos on ad-powered platforms like YouTube. It is this form of advertising that currently finances or co-finances a large number of websites, including most news media sites and also a large number of mobile apps.
A first still rather superficial look at this sector shows a high degree of technical complexity with trading structures somewhat resembling those of high-frequency stock market trading and a market structure which is seemingly more complex than the one found in search advertising. However, it also shows that there is an ongoing discussion about competitive deficiencies mostly related to the influential role of a few large providers of ad space and technical services, in particular – again – Alphabet/Google. So it was this part of the online advertising sector, which is usually considered to be part of a different market than online search advertising and with regard to which further sub-segmentation is sometimes being debated, that the Bundeskartellamt decided to inspect more closely. In this context, a particular focus was placed on the highly complex technical side – those interlinked technical services on which this industry effectively runs.
Their main role is intermediation,[6] which essentially involves bundling the ad inventory of different publishers and also increasing the value of that inventory through data. Intermediation in online advertising can – in a simplified way – be split into two categories: integrated intermediation services (advertising networks) on the one hand and a relatively open system of different offerings grouped around digital marketplaces, so-called ad exchanges, on the other hand. This system is usually referred to as programmatic advertising. There are four, or rather five, services central to the system, with two of them specifically catering to the needs of publishers and another two catering to the needs of advertisers: publisher ad servers implement the publishers’ sales strategy and deliver advertising media. Supply side platforms (“SSPs”) offer advertising spaces for sale, in most but not all cases in the form of an auction. Demand side platforms (“DSPs”) bid on ad spaces offered by SSPs according to a buying strategy specified by the advertisers or their media agency. Advertiser ad servers (also) implement such buying strategies, track campaigns and deliver advertising media.
The fifth technical service, conceptually positioned between publishers and advertisers/agencies, the marketplace (ad exchange) itself, is nowadays mostly a functionality of the SSP. The entire trading process takes place in fractions of a second after a user navigates to a web page or opens an app (so-called real-time bidding (“RTB”)), and it can take place for each single ad space on a given web page or in a given app. In addition to these four/five core functions, there are further technical services that support their functioning. Data management platforms (“DMPs”) assist in storing, organizing, and combining the different datasets used for targeting the advertisements and measuring their success. Anti-ad-fraud, brand safety and viewability measurement services, collectively often referred to as ad verification services, help to ensure that advertisers do not unwittingly pay money to criminals operating fake websites with fake audiences, that their advertisements do not appear in an environment considered unsuitable by the advertisers in one way or another (and that publishers can avoid ads considered unsuitable by them) and they help to determine to how many users their ads were presented and under what circumstances this happened.[7] Many times these additional services are at least partially integrated into offerings providing these four/five core services, but in principle they can also be sourced separately.
When looking at the situation described above from a market definition perspective, the Discussion Report tended to regard those technical services offered as part of integrated intermediation services as not belonging to separate technical services markets. In contrast, however, it considered it appropriate to define at least four separate technical services markets for those technical services offered for use in the programmatic advertising system: publisher ad servers, SSPs/ad exchanges, DSPs, and advertiser ad servers. DMPs may also be considered as belonging to a separate market. As regards ancillary services, such as ad verification, the Discussion Report identified more blurred boundaries so that it seemed more doubtful to assign them to their own markets. Ultimately, however, this question was left open to be answered when examining a specific case. It generally has to be born in mind that market definitions were only considerations based on tendencies here, that there are in any case technical and competitive relations between integrated intermediation services and the programmatic advertising system and also within the services which can be found in the latter, and that technical developments in the ad technology sector are rather dynamic, so that all considerations on market definitions in the Discussion Report were based exclusively on the situation at the relevant point in time.
With respect to the geographic market definition, the Discussion Report tended towards European if not world-wide markets. The most obvious argument for defining the markets as narrower, national markets would be strong dependencies potentially existing between the typically national markets for the ad spaces themselves and the ad tech markets, but the Report did not find that sufficient indications for that existed at the time.
II. THE COMPETITIVE LANDSCAPE
The one thing that stood out in the Discussion Report’s analysis of the market structure for the various technical services was Google’s special position: Google was by far the leading company for the provision of publisher ad servers in particular, but also for SSPs/ad exchanges, DSPs, and advertiser ad servers. This result was largely consistent with the findings of the UK’s CMA, the Australian ACCC, the Spanish CNMC, and the Japanese JFTC in their respective sector inquiries and with various findings in individual proceedings conducted by the French AdlC and the European Commission. Apart from acting as an intermediary for third-party advertising space, Google also sells its own ad inventory via these and related in-house technical services, including the integrated Google Ads/AdSense/AdMob intermediation system, which is highly relevant particularly for smaller publishers and advertisers.
Regarding this general picture of intermediation for third-party publishers, no fundamental change can currently be seen on the horizon compared to last year. What can be observed, however, is that some big players are trying to get a slice of the cake by establishing their role as publishers. This is, for example, observable in the case of Netflix recently entering the video ads market with a new tier of its video streaming service. The company also attracted interest from a technical services/intermediation perspective because Netflix chose Microsoft as its ad tech and sales partner.[8] But it remains to be seen to what extent deals like these or Amazon’s progress in its own ad space business translate into substantially increased dynamics in the “ad tech for intermediation” sector in the medium term.[9]
When considering the reasons for the current market structure, the Discussion Report reached the conclusion that apart from the quality of Google’s technical services acknowledged/appreciated by various market participants, “leverage effects” emerging from Google’s control over relevant advertising inventory and demand, Google’s control over important data, and the links between individual technical services provided by Google are likely to play an important role. In any event, the overall result reached was that although in theory it would be possible in the programmatic advertising ecosystem to freely “mix and match” the services offered by several providers as needed, in reality there seem to be substantial restrictions. These restrictions exist either in the form of ties between the advertising space offered or demand represented by certain providers and their technical services. Or they occur in the form of ties between a provider’s technical services which in principle could be separated. Prima facie, this seems to restrict the scope for competitive action by providers competing with Google.
At least two new efforts to address this situation could be observed in the last year, both of them in the U.S. In January 2023 the Department of Justice together with eight state attorney generals filed a civil antitrust suit against Google with respect to its practices around ad technology.[10] The complaint focuses on a diverse set of acquisitions and product design decisions by Google over more than a decade, which it sees as having the goal and effect of making the use of competing technical services unattractive or even impossible for its customers, thus depriving them of optimal transaction results while extracting rents at a supra-competitive level to the benefit of Google’s own bottom line. The second measure was the (effective re-) introduction of an antitrust bill specifically aimed at the ad tech sector, the AMERICA Act, supported by senators from both parties.[11] This bill also referred to a (similarly-described) set of practices by Google which it classifies as anti-competitive. In the UK two civil lawsuits (in the form of group litigation, similar to U.S.-style “class actions”) have been filed in recent months on behalf of publishers.[12] Both assert damages as a result of Google’s behavior in the ad tech sector and seek compensation.
An interesting factual development against the background of the market structure described above are recent announcements by Google and Meta to take a (further) step in the creation of advertising material – this time using AI technologies to generate ads by remixing textual, graphical and other elements based on data about the audience.[13] Although the use of AI in ad technology and even the idea of using it to select the “right” advertising material is in principle not that new,[14] this move, if successful, could further deepen Google’s vertical integration along the ad (technology) value chain and could offer the company an opportunity to leverage its particularly large trove of user data in a new way. Taken to its logical conclusion, the concept would allow for a complete individualization and personalization not only in terms of the targeting of advertising, but also in terms of the message conveyed and the media elements used to embed and support such adverts – perhaps a rather unsettling perspective in view of the additional manipulative possibilities that would go along with it.[15]
A related problem addressed by the Discussion Report was that of possible conflicts of interest in those cases where a provider/company is active both on the sell side and on the buy side, and in particular in those cases where providers of an SSP/ad exchange and a DSP are also relevant publishers seeking to optimally sell their own ad spaces. The proposed AMERICA Act mentioned above[16] makes measures aimed at eliminating such conflicts of interest – not only in the case of Google but in a generalized approach – an important part of its solution strategy. They include behavioral requirements as well as structural remedies.
III. RESTRICTIONS ON ACCESS TO PERSONAL DATA FOR ADVERTISING PURPOSES
Chapter D. of the Discussion Report gave an overview of the discussion about restricting access to personal data for advertising purposes and analyzed what the consequences would be from a competition point of view. It identified two main types of possible consequences, namely a less diverse and effective system of online advertising in general and a system becoming (even more) asymmetric to the benefit of large providers like Google. The Report contrasted these consequences with the substantial risks particularly for user privacy und autonomy that result from the current state of the online advertising ecosystem in which giant troves of user data are floating in a network of actors distributed worldwide and which makes effective control seem manifestly unrealistic.[17] It then discussed options to mitigate the risks for competition when restricting access to data as well as technical and legislative options to restrict access to data. As a result, the Report concluded that also from a competition point of view it can be considered whether, overall, it would not seem advisable to move away from a system of data-driven advertising such as the current one.[18]
The discussion is of course still ongoing, with a number of legislative steps having been taken in the past year, at least in Europe. The first example is the Digital Services Act (“DSA”), which prohibits the display of digital advertising based on profiling using the personal data of minors or particularly sensitive personal data in general. The DSA formally entered into force on November 16, 2022, and it will be fully applicable from February 17, 2024. The separate proposal for a regulation of the European Parliament and of the Council on the transparency and targeting of political advertising is currently (May 2023) still under discussion in the “trilogue,” but an agreement is expected to be reached. The version adopted by the Parliament in February 2023[19] and the version adopted by the Council in December 2022[20] differ somewhat with regard to regulating the targeting of political advertising (and also algorithmic amplification), with the Parliament providing a rather complex set of provisions.
On the other hand, the legislative process towards replacing the E-Privacy Directive by a new E-Privacy Regulation to better complement the GDPR, which could include more effective restrictions on tracking if the tendency of the European Parliament’s position prevails against that of the Council, currently seems to have stalled in the “trilogue” procedure.[21] In principle, an approaching change in the legal framework for the transfer of personal data to the U.S. would also be of interest to the online advertising ecosystem – after all, a large number of providers in the field of online advertising and ad tech are based there. In 2020, the ECJ annulled for the second time the Commission’s adequacy decision on the so-called “Privacy Shield,” which was probably the most important legal basis for such data transfers.[22] The Commission is seeking to adopt a new adequacy decision shortly based on modified U.S. commitments, but its legality is also likely to be tested in light of ongoing discussions about whether this is actually “old wine in new bottles.” Finally, in the medium term the proposal for an AI Act,[23] currently still in the midst of discussion in the EU legislative process, might also influence the mechanisms available for targeting advertising.
The dispute is also conducted before courts and authorities. In the U.S. the FTC started a procedure to possibly issue rules “concerning the ways in which companies collect, aggregate, protect, use, analyze, and retain consumer data, as well as transfer, share, sell, or otherwise monetize that data in ways that are unfair or deceptive,” which could also cover personalized advertising.[24] In the EU, the privacy NGO NOYB filed 226 complaints with 18 different data protection authorities against cookie[25] banners[26] the design of which it considered to be in contravention of the GDPR.[27] The core issue here are design elements that do not seem to be “neutral” and seem to have been designed to nudge or even trick the user into granting consent to tracking for advertising and other purposes. The German consumer association vzbv has gone a different way and recently obtained a first instance civil judgment against the cookie banner of a major publishing house.[28]
On the technical side, the arms race between measures to limit the collection of personal data on the web or within apps on the one hand and strategies to circumvent these measures on the other hand continued. Mozilla, maker of the Firefox web browser, e.g. just recently activated improved protection by default against classic tracking via cookies.[29] In April 2023, a Swedish VPN provider released[30] a version of the Tor Browser, which is hardened against fingerprinting[31] and other tracking techniques, for broader use without the user having to rely on the Tor Network for connecting to the internet.[32] On the other hand, it is clear that measures against certain tracking technologies are prompting a number of publishers or ad tech providers to switch to other technologies. For example, according to a study of 1759 apps for iOS, the introduction of Apple’s App Tracking Transparency (“ATT”)[33] made tracking more difficult, but did not prevent a number of those apps from continuing to use other tracking techniques that are not effectively covered by ATT.[34]
In Europe, some large telecoms seized the opportunity they saw in cookies being more and more repressed as a means for tracking and established a joint venture for a technology called “TrustPID.”[35] The project aims to provide publishers with a pseudonymous, publisher-unique ID of internet users that is calculated by retracing IP addresses to phone numbers. Google, as a particularly large provider of online ad space and ad tech but also as the maker of the most widely used web browser “Chrome,” has a rather complex set of interests in this context. The company continues to work on its “Privacy Sandbox” project, which it says will eliminate tracking via cookies and replace that with more privacy-friendly technologies, which will still provide for some form of targeted advertising, although Google’s original plans have been delayed after the CMA intervened.[36]
IV. ENFORCING COMPETITION LAW IN THE AD TECH UNIVERSE
The last chapter of the Discussion Report took a – one might say: holistic – look at the scope of the ad tech universe, its characteristics and, in particular, the role of Google. The scope is large and the system includes a variety of interacting components: it ranges from the user’s browser or operating system to the complete ad tech stack described in section I to the booking interface for the advertiser. It is also highly dynamic because it is essentially software which can be updated in short cycles. The latter is particularly true for the various technical services that are usually provided in a software-as-a-service (“SaaS”) model, implying that updates only need to be installed centrally on a limited number of servers. Another characteristic of the system is opacity combined with high complexity. Users of the system, i.e. advertisers and publishers and in some, mostly passive, way also natural persons surfing the web or using an app, can essentially only observe what the system does from the outside. This means that it can take a long time to even detect a change in behavior. At the same time, Google controls a large number of the system’s components and is subject to a constant conflict of interests: on the one hand, it is an intermediary for the sale of third-party advertising space; on the other hand, it has an interest in selling its own advertising space in the best possible way.
The Report therefore raised the question of whether, in such a situation, individual interventions by a competition authority – in the sense of behavioral prohibitions and requirements – would actually be suitable for remedying potentially identified competition problems in the long term. After all, it seems plausible that Google could simply – and much more easily than other companies – economically compensate for the restrictive consequences of such individual interventions in the bottom line by making changes elsewhere. And the fact that many such changes will have Janus-faced effects would put an additional burden on proceedings aimed at implementing individual interventions.
Against this backdrop, the Report discussed possible more far-reaching interventions, ranging from procedural and substantive simplifications of imposing behavioral requirements, such as those underlying the new Section 19a of the German Competition Act (“GWB”) and the conduct obligations of the even newer European Digital Markets Act (“DMA”), to structural measures. It concluded that if the promising new regulatory and competition law approaches of the GWB and the DMA and the experiences gathered in the application of these rules are in fact considered and the individual prohibitions by competition authorities and other individual specific behavioral rules still prove to have only a limited effect on the competitive process, the option to use more comprehensive interventions should become more central to the discussion.
It is therefore interesting to note that the idea of structural interventions has recently gained some ground again, for example in the U.S. Both of the initiatives mentioned in section II, the DOJ lawsuit against Google[37] and the proposed AMERICA Act,[38] incorporate structural measures into their approach to solving the problem they target. In the lawsuit the court is demanded to “order the divestiture of, at minimum, the Google Ad Manager suite, including both Google’s publisher ad server, DFP, and Google’s ad exchange, AdX, along with any additional structural relief as needed to cure any anticompetitive harm.”[39] An earlier lawsuit filed by 17 Republican states against Google in 2020 and amended later[40] had already requested structural measures but without specifying them. Meanwhile, the proposal for the AMERICA Act seeks to generally establish a separation of functions for companies with a very large “digital advertising” business (more than US-$ 20 billion). Such companies may own a DSP or an SSP, but not both. If they own an ad exchange, they may not own either an SSP or a DSP. The same applies to buyers and sellers of digital advertising space, except for selling or buying ads for themselves. The latter may not own an ad exchange either.
V. CONCLUSION
While calls for structural solutions for the non-search online advertising and ad tech space have recently become somewhat louder, it seems not yet clear whether, to what extent and when they might be implemented. At the same time, fundamental change in the ad tech market without intervention still seems rather unlikely in the short to medium term. Disputes over individual actions by Google are therefore unlikely to diminish significantly in the foreseeable future and they will remain of high interest.
[1] Senior Case Officer (Rapporteur), Bundeskartellamt, The text reflects the personal point of view of the author, not necessarily that of the Bundeskartellamt.
[2] Bundeskartellamt, Sektoruntersuchung Online-Werbung, Diskussionsbericht (August 2022), https://www.bundeskartellamt.de/SharedDocs/Publikation/DE/Sektoruntersuchungen/Sektoruntersuchung_Online_Werbung_Diskussionsbericht_lang.html (in German only); an English version of the Executive Summary can be found at https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Sector%20Inquiries/Sektor_inquiry_online_advertising_report_discussion_summary.html.
[3] Bundeskartellamt, Sektoruntersuchung Online-Werbung, Zusammenfassender Abschlussbericht (May 2023), https://www.bundeskartellamt.de/SharedDocs/Meldung/EN/Pressemitteilungen/2023/31_05_2023_SU_online_Werbung.html?nn=3591568 (Report) and https://www.bundeskartellamt.de/DE/UeberUns/Publikationen/Sektoruntersuchungen/Online_Werbung_Stellungnahmen/stellungnahmen_node.html (comments).
[4] Cf. Bundeskartellamt, Google: Determination of paramount significance for competition across markets, case B7-61/21 (Decision of December 30, 2021), Nos. 308 et seq., https://www.bundeskartellamt.de/SharedDocs/Entscheidung/EN/Entscheidungen/Missbrauchsaufsicht/2022/B7-61-22.html.
[5] Relatively recent developments in Artificial Intelligence (“AI”), which have been the subject of hype for about two years now, might in the medium to long term bring about some change in this context. In particular, Microsoft’s strategic move to integrate AI-powered chat capabilities into its “Bing” search engine seems to be perceived as a potential threat to Google’s core business (cf. e.g. Nico Grant & Karen Weise, In A.I. Race, Microsoft and Google Choose Speed Over Caution, The New York Times (April 7, 2023), https://www.nytimes.com/2023/04/07/technology/ai-chatbots-google-microsoft.html or Benj Edwards, Fearing ChatGPT, Google enlists founders Brin and Page in AI fight, Ars Technica (January 24, 2023), https://arstechnica.com/information-technology/2023/01/fearing-chatgpt-google-enlists-founders-brin-and-page-in-ai-fight/). But keeping in mind the famous Gartner Hype Cycle, it seems still too early to judge the role AI-powered natural language processing and generation will play for searches in the long run, Google’s capabilities to copy or even outdo Microsoft’s move and the effect that upcoming legislation, such as the planned AI Act of the European Union, might have on the race.
[6] Technical services are nevertheless also used by publishers themselves, in particular big ones, to facilitate and automate what still qualifies as direct sales.
[7] This is relevant to determine whether the advertiser actually received value for money. For example, an ad may have been integrated into a web page sent to a user’s browser, but the user may never have scrolled down so far as to actually be able to see that ad.
[8] Sarah Krouse & Suzanne Vranica, Netflix Partners With Microsoft for New Advertising-Backed Option, The Wall Street Journal (July 13, 2022), https://www.wsj.com/articles/netflix-partners-with-microsoft-to-launch-advertising-supported-plan-11657738975; Jon Brodkin, Microsoft wins deal to serve ads on Netflix, edging out Comcast and Google, Ars Technica (July 13, 2022), https://arstechnica.com/information-technology/2022/07/microsoft-wins-deal-to-serve-ads-on-netflix-edging-out-comcast-and-google.
[9] There is already a discussion about Netflix possibly switching to its own technical services when the current contract with Microsoft expires, cf. Dan Meier, Netflix with Ads is Delivering on ARPU but Password Crackdown is Kicked Down the Road, Videoweek (April 19, 2023), https://videoweek.com/2023/04/19/47092/.
[10] Press release, The United States Department of Justice, Justice Department Sues Google for Monopolizing Digital Advertising Technologies (January 24, 2023), https://www.justice.gov/opa/pr/justice-department-sues-google-monopolizing-digital-advertising-technologies.
[11] Cf. press release, Mike Lee, The AMERICA Act: Lee Introduces Bill to Protect Digital Advertising Competition (March 30, 2023), https://www.lee.senate.gov/2023/3/the-america-act.
[12] Competition Appeals Tribunal, Application by Mr Claudio Pollack, case 1572/7/7/22, https://www.catribunal.org.uk/cases/15727722-claudio-pollack; Chris Vallance, Google faces new multi-billion advertising lawsuit, BBC (March 31, 2023), https://www.bbc.com/news/technology-65115231.
[13] Christina Criddle & Hannah Murphy, Google to deploy generative AI to create sophisticated ad campaigns, Ars Technica (April 20, 2023), https://arstechnica.com/information-technology/2023/04/google-to-deploy-generative-ai-to-create-sophisticated-ad-campaigns/.
[14] Cf. e.g. Thomas H. Davenport et al., How to Design an AI Marketing Strategy, Harvard Business Review (July-August 2021), https://hbr.org/2021/07/how-to-design-an-ai-marketing-strategy; Bernard Marr, How AI Is Transforming The Future Of Digital Marketing, Forbes (October 18, 2021), https://www.forbes.com/sites/bernardmarr/2021/10/18/how-ai-is-transforming-the-future-of-digital-marketing/.
[15] If one does not find this concept disturbing or – depending on one’s perspective – promising enough, one can take it a step further and imagine a ChatGPT-style bot that – after clicking on or even just passing the mouse over the ad – engages the user in a fully automated and individualized sales conversation based on the data known about him or her. Using chatbots in marketing is not a completely new approach, but the new level of capabilities demonstrated by GPT-3 and ChatGPT as well as the latter’s resonance with the public are creating an image on the horizon of a world in which every consumer comes across a variety of virtual salespeople who are all both well informed about them and equipped with the latest findings in sales psychology. The next but one step – when AI-powered, photorealistic, and convincingly animated avatars talking with a freely configurable voice become possible on scale – can be left to one’s (sci-fi?) fantasies.
[16] See press release, Mike Lee, note 11 above.
[17] One of the latest examples is a company seemingly abusing data from the programmatic advertising ecosystem to offer worldwide location tracking of people through their mobile phones, cf. Ryan Gallagher, Your Ad Data Is Now Powering Government Surveillance, Bloomberg (May 11, 2023), https://www.bloomberg.com/news/articles/2023-05-11/surveillance-company-turns-ad-data-into-government-tracking-tool.
[18] Critical of the current state of affairs of digital advertising also a recent study for the European Commission: Armitage et al., Study on the impact of recent developments in digital advertising on privacy, publishers and advertisers (Final report, 2023), https://op.europa.eu/en/publication-detail/-/publication/8b950a43-a141-11ed-b508-01aa75ed71a1/language-en.
[19] European Parliament, Amendments adopted by the European Parliament on 2 February 2023 on the proposal for a regulation of the European Parliament and of the Council on the transparency and targeting of political advertising (COM(2021)0731 – C9-0433/2021 – 2021/0381(COD)), (https://www.europarl.europa.eu/doceo/document/TA-9-2023-0027_EN.html).
[20] Council of the European Union, OUTCOME OF PROCEEDINGS (16013/1/22, December 13, 2022), https://www.consilium.europa.eu/media/60812/st16013-re01-en22.pdf.
[21] Cf. Luca Bertuzzi, Leading MEP enraged by Swedish presidency’s neglect of ePrivacy Regulation, Euractiv (March 8 & 9, 2023), https://www.euractiv.com/section/data-privacy/news/leading-mep-enraged-by-swedish-presidencys-neglect-of-eprivacy-regulation/.
[22] European Court of Justice, “Schrems II” case C-311/18 (Judgement of the Court (Grand Chamber) of 16 July 2020), https://curia.europa.eu/juris/document/document.jsf?docid=228677&mode=lst&pageIndex=1&dir=&occ=first&part=1&text=&doclang=EN. However, it seems rather likely that in practice the resulting legal problems were simply ignored by a number of companies concerned.
[23] European Commission, Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL LAYING DOWN HARMONISED RULES ON ARTIFICIAL INTELLIGENCE (ARTIFICIAL INTELLIGENCE ACT) AND AMENDING CERTAIN UNION LEGISLATIVE ACTS (COM/2021/206 final, April 21, 2021), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52021PC0206.
[24] Federal Trade Commission, Advanced Notice of Proposed Rulemaking, https://www.federalregister.gov/documents/2022/08/22/2022-17752/trade-regulation-rule-on-commercial-surveillance-and-data-security; cf. also press release, Federal Trade Commission, FTC Extends Comment Deadline on Commercial Surveillance, Lax Data Security Practices Initiative Exploring Possible Rules (October 14, 2022), https://www.ftc.gov/news-events/news/press-releases/2022/10/ftc-extends-comment-deadline-commercial-surveillance-lax-data-security-practices-initiative.
[25] Cookies are small amounts of data, in practice often a unique identifier, that a website can send to a user’s browser to have them stored there. When that browser visits the website again, the data is sent back to the website. This mechanism also works for websites that deliver elements to be embedded in other websites, like images, videos, or executable program fragments (scripts), which allows for tracking the browser’s journey from website to website.
[26] Cookie banners are prompts that appear when a website is accessed and are intended to obtain the user’s consent to data storage in the browser or to various data collection and processing activities for advertising purposes, as required by the E-Privacy Directive and the GDPR.
[27] Natasha Lomas, Hold-outs targeted in fresh batch of noyb GDPR cookie consent complaints, TechCrunch (August 9, 2022), https://techcrunch.com/2022/08/08/noyb-gdpr-cookie-consent-complaints/.
[28] Torsten Kleinz, Verbraucherschützer klagen erfolgreich gegen Cookie-Banner, heise.de (December 2022, 19), https://www.heise.de/news/Verbraucherschuetzer-klagen-erfolgreich-gegen-Cookie-Banner-7408270.html (in German only).
[29] Press release, Mozilla, Firefox rolls out Total Cookie Protection by default to more users worldwide (April 11, 2023), https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/.
[30] Press release, Mullvad VPN, Mullvad VPN and the Tor Project team up to release the Mullvad Browser (April 3, 2023), https://mullvad.net/de/blog/2023/4/3/mullvad-vpn-and-the-tor-project-team-up-to-release-the-mullvad-browser/.
[31] Fingerprinting uses properties of a browser or a device that can be read out by an app or a script in a website to calculate an identifier as unique as possible for that browser or device, which in turn can be used for tracking purposes.
[32] The Tor Network is a project that tries to offer anonymous communication by routing the user’s traffic through a network of relays, thus hiding the user’s IP address.
[33] ATT is an Apple program to require the user’s explicit consent before giving an app access to the unique identifier for advertising purposes on iOS devices; it was accompanied by mandatory “privacy nutrition labels” for apps.
[34] Konrad Kollnig et al., Goodbye Tracking? Impact of iOS App Tracking Transparency and Privacy Labels (2022 ACM Conference on Fairness, Accountability, and Transparency (FAccT ’22), June 20, 2022), https://doi.org/10.1145/3531146.3533116; studies on the extent to which certain fingerprinting methods are used can be found, for example, in Sebastian Neef, Uncovering Fingerprinting Networks. An Analysis of In-Browser Tracking using a Behavior-based Approach (Technische Universität Berlin, Master Thesis, March 29, 2021), https://arxiv.org/pdf/2210.11300.pdf, or in Imane Fouad et. Al., My Cookie is a phoenix: detection,
measurement, and lawfulness of cookie respawning with browser fingerprinting (PETS 2022 – 22nd
Privacy Enhancing Technologies Symposium, Sydney, Australia, February 24, 2022), https://hal.science/hal-03218403v2.
[35] See press release, European Commission, Mergers: Commission clears creation of a joint venture by Deutsche Telekom, Orange, Telefónica and Vodafone (case M.10815, February 10, 2023), https://ec.europa.eu/commission/presscorner/detail/en/IP_23_721.
[36] Ron Amadeo, Google delays death of tracking cookies again, wants more time for “testing,” Ars Technica (July 28, 2022), https://arstechnica.com/gadgets/2022/07/google-delays-death-of-tracking-cookies-again-wants-more-time-for-testing/; the latest reports by the CMA on the implementation of the commitments Google undertook in order to address the CMA’s competition concerns can be found at https://www.gov.uk/cma-cases/investigation-into-googles-privacy-sandbox-browser-changes.
[37] See press release, The United States Department of Justice, note 10 above.
[38] See press release, Mike Lee, note 11 above.
[39] See press release, The United States Department of Justice, note 10 above, no. 342/6 of the complaint.
[40] Press release, Ken Paxton, Attorney General of Texas, Paxton Files Third Amendment in Antitrust Lawsuit Against Google (November 16, 2021), https://www.texasattorneygeneral.gov/news/releases/paxton-files-third-amendment-antitrust-lawsuit-against-google.
