Campaigners in six European countries filed simultaneous complaints on Wednesday accusing online advertisers including Google of “broadcasting” internet users’ personal data online.
The consortium, which is led by European human rights group Liberties, wants European regulators to examine how a user’s personal data can be sold to multiple advertising partners in an instant.
It says a widely-used model called RTB – which stands for "real-time bidding" – means the information is not being protected as advertisers scramble to reach the most valuable audiences online.
Dr Orsolya Reich, a senior advocacy officer at Liberties, said it was "an abuse of people’s right to privacy".
"Today, more civil society groups are saying enough with this invasive advertising model and are asking data protection authorities to stand up against the harmful and unlawful practices they use," she said.
The complaints accuse Google and the Interactive Advertising Bureau (IAB), an industry group, of being the "standard-setters" behind the RTB advertising model.
The IAB told Euronews it was an industry body that does not engage in real-time bidding itself.
Google said users of its real-time bidding systems were "subject to stringent policies and standards.”
But what is real-time bidding, and how exactly does it work? Euronews explains in this Q&A guide.
What is real-time bidding (RTB)?
It is when advertisers engage in near-instantaneous auctions for the right to display a specific advert on a web page you are looking at. This happens whether you are browsing on a computer, a tablet or your phone.
How do I notice it happening?
Most people will have seen adverts for things that, for example, are suspiciously reminiscent of items they have already bought – or have thought about buying – online.
Give me an example.
Here’s a hypothetical: imagine you want a new ski jacket and you flick through a number of websites, including major retailers like Amazon. You spend some time looking at models made by Schöffel, the German sportswear firm.
You may then see advertisements for ski jackets appearing elsewhere on the internet, such as news websites or social media feeds. These are based not just on your browsing history but on the platform’s best guess of how likely you are to buy.
The adverts could be from Schöffel, a rival like North Face, or a retailer like Amazon. It depends on which firm bids more for the right to appear before you.
How does it work?
There are five broad steps to the real-time bidding process:
- You visit a website;
- The website requests an advert from a platform called an “ad exchange”;
- The ad exchange invites bids from one or several demand-side platforms (DSP), a service that works with advertisers;
- The DSPs analyse data sent from your computer or smartphone to decide whether to bid for the right to show you an advert;
- The highest bidder shows you an advert.
Is it fast?
Extremely. Adverts can be processed and tailored to you in a matter of milliseconds.
Is it profitable?
It appears so. One forecast estimates the real-time bidding advertising market will grow from €5.4 billion last to €22.4 billion by 2024.
What kind of data is sent to advertisers?
This varies according to the ad exchanges and service providers, but can include information about:
- the kind of device you are using
- your location
- the website you reading right now, and other pages you have looked at
- your age, gender, hobbies and interests
Does the data go anywhere else?
The consortium led by Liberties says personal data is often sold on between advertisers to help them build a profile of users that can then be resold to other advertisers.
Advertisers say this cannot happen without the user explicitly consenting to their data being shared.
Is real-time bidding legal?
On the whole, yes. But privacy campaigners say the system is poorly policed and is growing too quickly for governments to keep track of it.
Townsend Feehan, chief executive of the Interactive Advertising Bureau in Europe, told Euronews that real-time bidding "must not involve processing anyone's sensitive data without what is called 'explicit consent'. So if there is data processing going on of sensitive data without explicit consent, that behaviour is illegal."
Who runs these real-time bidding systems?
Johnny Ryan, who works for the internet browser Brave, says there are two main systems of real-time bidding in operation: one called "Authorized Buyers", which was developed by Google, and a rival known as "OpenRTB".
What complaints have been filed?
The consortium led by Liberties, the Civil Liberties Union for Europe, filed complaints in six EU member states on Wednesday: Croatia, Cyprus, Greece, Malta, Portugal and Romania.
It follows earlier action in Belgium, Britain and Ireland.
They argue data protection authorities, the government bodies that oversee data privacy issues, should take a greater interest in how their citizens' personal data is stored and managed for advertising purposes.
The complaints accuse Google and the Interactive Advertising Bureau (IAB), an industry group, of being the "standard-setters" behind the real-time bidding advertising model.
What does the industry say?
Google told Euronews that it was "engaging fully" with an investigation by the Data Protection Commission of Ireland, where Google's European operations are based.
A spokesperson added: "Authorised buyers using our systems are subject to stringent policies and standards.”