Data protection and adtech in Europe: where next?

摘要

A lot has happened in the world of data protection and adtech recently. At EU level, the Court of Justice of the European Union ('CJEU') issued its decision in the Planet49 case in October 2019 (Case C-673/17), confirming that consent for cookies cannot be obtained via a pre-ticked checkbox. The CJEU also confirmed in that case that a valid consent for cookies requires, among other things, prior information on the storage period of the cookie and whether third parties have access to the cookies. A number of EU Supervisory Authorities ('SAs') have also issued guidance on how to use cookies and similar technology in compliance with European data protection law. Additionally, we are starting to see first enforcement actions by SAs in this field. This article discusses the impact of these recent developments for the adtech industry, as well as for advertisers and publishers. 'Adtech' refers to technologies used for online targeted advertising, meaning personalised advertisements on websites or mobile apps which are specifically selected for a particular user, based on their characteristics or interests. Most internet users will be familiar with seeing personalised advertisements appear on the websites and apps they visit, but much less aware of the complex process behind the scenes that enables this to happen.