Behavioural Advertising Legal Review
Behavioural Advertising Legal Review
1. Overview
Behavioural advertising (also called online behavioural advertising or OBA) involves tracking users’ online activities—such as browsing history, search queries, app usage, or purchase behaviour—to deliver targeted advertisements. It relies heavily on cookies, device fingerprinting, tracking pixels, and data analytics.
Because it involves personal data collection, profiling, and automated decision-making, behavioural advertising raises complex issues under:
Data protection law
Privacy rights
Consumer protection law
Competition law
Misrepresentation and unfair commercial practices
Corporate governance must therefore integrate compliance, transparency, and ethical oversight into advertising strategies.
2. Core Legal Issues
(1) Lawful Basis for Data Processing
Companies must establish a valid legal basis (e.g., consent or legitimate interest) before collecting behavioural data.
(2) Informed and Freely Given Consent
Consent must be specific, informed, and unambiguous—particularly for cookie tracking and profiling.
(3) Transparency and Notice
Privacy policies must clearly explain:
What data is collected
How it is used
Whether profiling occurs
Whether third parties receive the data
(4) Automated Decision-Making & Profiling
Users may have rights to object to profiling or request human review in certain jurisdictions.
(5) Cross-Border Data Transfers
Behavioural advertising often involves international data flows, requiring compliance safeguards.
(6) Children’s Data Protection
Targeting minors with behavioural advertising triggers heightened regulatory scrutiny.
3. Key Case Laws
1. Google Spain SL v Agencia Española de Protección de Datos (AEPD)
Issue: Right to be forgotten and search engine data processing.
Principle: Entities that process personal data for commercial purposes (including profiling and targeted ads) are data controllers and must comply with privacy obligations.
2. Schrems v Data Protection Commissioner
Issue: Cross-border data transfers to the United States.
Principle: Data used in behavioural advertising must be protected when transferred internationally; inadequate safeguards invalidate transfer mechanisms.
3. Lloyd v Google LLC
Issue: Unlawful tracking of iPhone users via Safari workaround.
Principle: Unauthorized tracking through cookies may breach data protection law and give rise to representative actions.
4. United States v Google LLC
Issue: Monopoly practices in digital advertising markets.
Principle: Behavioural advertising dominance can raise competition law concerns when data concentration distorts market fairness.
5. Carpenter v United States
Issue: Privacy in digital location tracking.
Principle: Individuals retain privacy interests in digital tracking data; extensive behavioural tracking implicates constitutional privacy protections.
6. Fashion ID GmbH & Co KG v Verbraucherzentrale NRW eV
Issue: Facebook “Like” button data sharing.
Principle: Website operators embedding third-party tracking tools may be joint controllers and share responsibility for data collection compliance.
7. Planet49 GmbH v Bundesverband der Verbraucherzentralen
Issue: Validity of cookie consent via pre-ticked boxes.
Principle: Pre-ticked consent boxes are invalid; behavioural advertising cookies require active user consent.
4. Corporate Governance Implications
(A) Consent Architecture Design
Companies must design:
Clear cookie banners
Granular opt-in mechanisms
Easy withdrawal options
(B) Data Minimization
Collect only data necessary for advertising objectives; excessive profiling increases regulatory risk.
(C) Third-Party Vendor Due Diligence
Ad tech vendors must contractually guarantee compliance and data protection safeguards.
(D) Risk of Class Actions
Unlawful tracking or misleading disclosures can lead to mass claims or regulatory fines.
(E) Competition Law Exposure
Large digital platforms may face scrutiny for leveraging behavioural data dominance.
5. Regulatory and Financial Consequences
Administrative fines under data protection regimes
Orders to suspend data processing
Reputational damage
Civil damages claims
Antitrust penalties
Restrictions on automated profiling
6. Summary
Behavioural advertising operates at the intersection of privacy law, consumer protection, and competition law. Judicial decisions emphasize that:
Tracking without proper consent is unlawful.
Data controllers must ensure transparency and fairness.
Cross-border data transfers require adequate safeguards.
Platforms embedding tracking tools may share liability.
Data dominance can trigger antitrust enforcement.
For corporations, behavioural advertising must be governed through robust compliance systems, transparent consent mechanisms, vendor accountability, and board-level oversight to mitigate legal, financial, and reputational risks.
RELATED Blog
comments