New York-based IAB Tech Labs, a standards body for the digital advertising industry, is being taken to court in Germany by the Irish Council for Civil Liberties (ICCL) in a piece of privacy litigation that’s targeted at the high-speed online ad auction process known as real-time bidding (RTB).
While that may sound pretty obscure, the case essentially loops in the entire “data industrial complex” of adtech players, large and small, which make money by profiling internet users and selling access to their attention — from giants like Google and Facebook to other household names (the ICCL’s PR also name-checks Amazon, AT&T, Twitter and Verizon, the latter being the parent company of TechCrunch — presumably because all participate in online ad auctions that can use RTB); as well as the smaller (typically non-household name) adtech entities and data brokers also involved in handling people’s data to run high-velocity background auctions that target behavioral ads at web users.
The driving force behind the lawsuit is Dr Johnny Ryan, a former adtech insider turned whistleblower who’s now a senior fellow a the ICCL — and who has dubbed RTB the biggest data breach of all time.
He points to the IAB Tech Lab’s audience taxonomy documents which provide codes for what can be extremely sensitive information that’s being gathered about internet users, based on their browsing activity, such as political affiliation, medical conditions, household income or even whether they may be a parent to a special needs child.
The lawsuit contends that other industry documents vis-à-vis the ad auction system confirm there are no technical measures to limit what companies can do with people’s data, nor who they might pass it on to.
The lack of security inherent to the RTB process also means other entities not directly involved in the adtech bidding chain could potentially intercept people’s information — when it should, on the contrary, be being protected from unauthorized access, per EU law…
Ireland’s data watchdog slammed for letting adtech carry on ‘biggest breach of all time’
Ryan and others have been filing formal complaints against RTB security issue for years, arguing the system breaches a core principle of Europe’s General Data Protection Regulation (GDPR) — which requires that personal data be “processed in a manner that ensures appropriate security… including protection against unauthorised or unlawful processing and against accidental loss” — and which, they contend, simply isn’t possible given how RTB functions.
The problem is that Europe’s data protection agencies have failed to act. Which is why Ryan, via the ICCL, has decided to take the more direct route of filing a lawsuit.
“There aren’t many DPAs around the union that haven’t received evidence of what I think is the biggest data breach of all time but it started with the U.K. and Ireland — neither of which took, I think it’s fair to say, any action. They both said they were doing things but nothing has changed,” he tells TechCrunch, explaining why he’s decided to take the step of litigating.
“I want to take the most efficient route to protection people’s rights around data,” he adds.
Per Ryan, the Irish Data Protection Commission (DPC) — which is Google’s lead data supervisor in the EU — has still not sent a statement of issues relating to the RTB complaint he lodged with them back in 2018. So years later. In May 2019 the DPC did announce it was opening a formal investigation into Google’s adtech, following the RTB complaints, but the case remains open and unresolved. (We’ve contacted the DPC with questions about its progress on the investigation and will update with any response.)
Since the GDPR came into application in Europe in May 2018 there has been growth in privacy lawsuits — including class action style suits — so litigation funders may be spying an opportunity to cash in on the growing enforcement gap left by resource-strapped and, well, risk-averse data protection regulators.
A similar complaint about RTB lodged with the U.K.’s Information Commissioner’s Office (ICO) also led to a lawsuit being filed last year — albeit in that case it was against the watchdog itself for failing to take any action. (The ICO’s last missive to the adtech industry told it to — uhhhh — expect audits.)
“The GDPR was supposed to create a situation where the average person does not need to wear a tin-foil hat, they do not need to be paranoid or take action to become well informed. Instead, supervisory authorities protect them. And these supervisory authorities — paid for by the tax payer — have very strong powers. They can gain admission to any documents and any premises. It’s not about fines I don’t think, just. They can tell the biggest most powerful companies in the world to stop doing what they’re doing with our data. That’s the ultimate power,” says Ryan. “So GDPR sets up these guardians — these potentially very empowered guardians — but they’ve not used those powers… That’s why we’re acting.”
“I do wish that I’d litigated years ago,” he adds. “There’s lots of reasons why I didn’t do that — I do wish, though, that this litigation was unnecessary because supervisory authorities protected me and you. But they didn’t. So now, as Irish politics like to say in the middle of a crisis, we are where we are. But this is — hopefully — several nails in the coffin [of RTB’s use of personal data].”
We are going to court. Our lawsuit takes aim at Google, Facebook, Amazon, Twitter, Verizon, AT&T and the entire online advertising/tracking industry by challenging industry rules set by IAB TechLab. @ICCLtweet https://t.co/D7NkyAILQg
— Johnny Ryan (@johnnyryan) June 16, 2021
The lawsuit has been filed in Germany as Ryan says they’ve been able to establish that IAB Tech Labs — which is NY-based and has no official establishment in Europe — has representation (a consultancy it hired) that’s based in the country. Hence they believe there is a clear route to litigate the case at the Landgerichte, Hamburg.
While Ryan has been indefatigably sounding the alarm about RTB for years, he’s prepared to clock up more mileage going direct through the courts to see the matter through.
And to keep hammering home his message to the adtech industry that it must clean up its act and that recent attempts to maintain the privacy-hostile status quo — by trying to rebrand and repackage the same old data shuffle under shiny new claims of “privacy” and “responsibility” — simply won’t wash. So the message is really: Reform or die.
“This may very well end up at the ECJ [European Court of Justice]. And that would take a few years but long before this ends up at the ECJ I think it’ll be clear to the industry now that it’s time to reform,” he adds.
IAB Tech Labs has been contacted for comment on the ICCL’s lawsuit. Update: A spokesperson said:
IAB Tech Lab will continue to deliver on its mission to drive global technology standards that enable growth and trust in the digital media ecosystem. This mission has never been more timely or important. At this time, we have not been served with any documents in the case. We will review the allegations in conjunction with our legal advisers and, if appropriate, will respond in due course.
Ryan is by no means the only person sounding the alarm over adtech. Last year the European Parliament called for tighter controls on behavioral ads to be baked into reforms of the region’s digital rules — calling for regulation to favor less intrusive, contextual forms of advertising which do not rely on mass surveillance of internet users.
While even Google has said it wants to depreciate support for tracking cookies in favor of a new stack of technology proposals that it dubs “Privacy Sandbox” (although its proposed alternative — targeting groups of internet users based on interests derived from tracking their browsing habits — has been criticized as potentially amplifying problems of predatory and exploitative ad targeting, so may not represent a truly clean break with the rights-hostile adtech status quo).
The IAB is also facing another major privacy law challenge in Europe — where complaints against a widely used framework it designed for websites to obtain internet users’ consent to being tracked for ads online led to scrutiny by Belgium’s data protection agency.
Last year its investigatory division found that the IAB Europe’s Transparency and Consent Framework (TCF) fails to meet the required standards of data protection under the GDPR.
The case went in front of the litigation chamber last week. A verdict — and any enforcement action by the Belgian DPA over the IAB Europe’s TCF — remains pending.
IAB Europe’s ad tracking consent framework found to fail GDPR standard
Behavioural advertising is out of control, warns UK watchdog
UK’s ICO faces legal action after closing adtech complaint with nothing to show for it
UK resumes privacy oversight of adtech, warns platform audits are coming
Comment