Today at a panel before the International Association of Privacy Professionals (“IAPP”) – Europe Data Protection Congress in Brussels, leading European Union (“EU”) data protection authority commissioners cast doubt on the notion that there could ever be a lawful basis for targeted advertising based on behavioral profiling, referred to often as interest-based advertising (“IBA”).

The panel, skillfully moderated by the IAPP’s Catlin Fennessey, brought together Commissioners Hielke Hijmans (Belgium Data Protection Authority), Bertrand du Marais (French CNIL) and Meike Kamp (Berlin Commissioner for Data Protection and Freedom of Information).  Whilst setting the stage that their opinions would be personal and that the EU General Data Protection Regulation (“GDPR”) compliance would have to be addressed on a case-by-case basis under the procedures of the regulatory system, they all were surprisingly candid in expressing skepticism that IBA could be GDPR compliant, noting recent decisions rejecting legitimate interest, processing in connection with a contractual relationship and consent in direct or related contexts.  As to the issue of consent, Commissioner Kamp pointed to the requirement that valid GDPR consent must be specific and granular and noted that the complexity of personal data processing inherent in digital advertising posed great challenges to the viability of valid consent.  Ms. Fennessey asked the Commissioners if their thinking would be any different in the context of the so-called “pay or ok” model whereby a publisher offers an ad-free version of content for a subscription fee (e.g., $9.99 a month) or a free subscription that requires acceptance of IBA, an approach recently rolled out by a major social media network across Europe.  Commissioner Camp first noted concerns with the paid subscription model for a number of reasons, including appropriateness of pricing and sufficiency of the granularity and range of choice and then turned to the free-with-IBA model opining that the existence of an alternative ad-free choice did not avoid the need for the free option to still have valid consent, reinforcing the challenges of specificity and granularity in the context of the digital advertising ecosystem.  An audience member posited that in the context of “pay or ok” regulators should look at processing for IBA in the context of fulfilling the consumer’s choice of subscription and thus IBA potentially qualifying for legitimate interests and/or contractual basis.  Commissioner Hijmans responded that he failed to see a material difference from cases that had already rejected legitimate interest and contract as lawful bases for IBA, and Commissioner Kamp noted that consent seemed to be the basis advanced by “pay or ok” proponents.  Of course, the lawful basis of “pay or ok” will have to be examined in the context of all of the facts through the GDPR enforcement process, but whatever authorities may have the opportunity to do so will scrutinize the positions publishers advance.  Furthermore, the next round of cases may involve digital advertising practices that do not involve IBA, but nonetheless involve arguably opaque practices involving multiple parties.  Some of the same challenges faced by IBA will need to be overcome there. 

Elsewhere in the world legislators and regulators take a different approach.  For instance, under the new U.S. state consumer privacy laws IBA is addressed through transparency and choice whereby consumers have the right to opt-out of certain processing of their personal data in the context of advertising.  That said, Congress and the Federal Trade Commission are considering federal regulation of IBA and it remains unclear if that will advance and in what direction.   Worldwide there is a growing tension between increased attention to individual privacy and effective data-driven marketing.