• Marketing Land
  • Sections
    • CMO
    • Social
    • SEM
    • SEO
    • Analytics
    • Display
    • Retail
    • MarTech
    • Resources
    • More
    • Home
  • Marketing Land
  • CMO
  • Social
  • SEM
  • SEO
  • Analytics
  • Display
  • Retail
  • MarTech
  • Resources
  • More
  • SUBSCRIBE

Marketing Land

Marketing Land
  • CMO
  • Social
  • SEM
  • SEO
  • Analytics
  • Display
  • Retail
  • MarTech
  • Resources
  • More
  • Home
  • Newsletters
  • Home
Martech: Analytics & Data

Why a French ruling against a small mobile ad firm has ad tech on the defensive

Here's what recent charges against a French ad tech firm might mean for U.S. marketers.

Robin Kurzer on November 21, 2018 at 10:35 am
  • More


Earlier this month, French data authority CNIL put French ad tech company Vectaury on notice for violating consent-gathering rules under Europe’s General Data Protection Regulation (GDPR). Vectaury collects geolocation data through behind-the-scenes methods such as software development kits (SDKs) and real-time ad bidding (RTB) for mobile ad targeting purposes. The company specializes in mobile advertising aimed at driving people to retail locations.

What happened. After an April investigation by the CNIL (la Commission nationale de l’informatique et des libertés) revealed that Vectaury had obtained personal data without proper consent. The company had created its own consent management platform (CMP). The CNIL said that Vectaury’s consent tool does not comply with GDPR because:

  • The language was unclear, complex and not easily accessible
  • The consent was not specific to the processing of geolocation data for targeted marketing
  • The user’s choice wasn’t based on an affirmative action, or opt-in

The CNIL has given Vectaury three months to come into compliance. Companies found in breach of GDPR can be assessed fees up to €20 million, or 4 percent of their annual revenue, whichever is higher.

Ruling appears to imply the IAB consent framework has problems. Almost immediately after CNIL posted its notice, several prominent privacy voices online said that the charges showed irrefutable flaws in the ability of the IAB Transparency and Consent Framework (TCF) to properly collect consent under GDPR. In theory, the TCF enables publishers and ad tech firms to collect consent and then ‘signal’ that consent across the advertising supply chain.

In looking at the CNIL ruling, New York Times’ data governance and privacy expert Robin Berjon said that it shows that consent gathered elsewhere and signaled through the IAB Europe’s consent framework is “inherently invalid” per GDPR’s Article 7, “you cannot pass consent to another controller through a contractual relationship.”

“It may seem like small fry, but the decision has potential wide-ranging impacts for Google, the IAB  framework, and today’s adtech,” Berjon tweeted.

Johnny Ryan, who currently serves as chief policy & industry relations officer for open-source browser Brave, agreed, saying that CNIL’s decision illustrates several problems with the framework, including violation of the “purpose specification” principle, which requires that consent be gathered for specific purposes; not supplying information to users about who is receiving their data; and not proving the validity of  passed consent.

“This decision should be a wake-up call for the industry, a milestone in its reform,” Ryan said in an email.

IAB Europe pushes back. The IAB Europe refutes these claims. Matthias Matthiesen, director of privacy and public policy for IAB Europe, said that the CNIL’s decision does not mean that the TCF is problematic.

“Nowhere does the CNIL say in its notice to Vectaury that the IAB Europe Transparency & Consent Framework’s approach is inherently invalid,” Matthiesen said. “The CNIL’s notice was specifically about Vectaury’s approach to obtaining consent. If anything, we feel reinforced in our positions.”

Stacey Gray, policy counsel of the Future of Privacy Forum, agreed “that the scope of the decision is limited to Vectaury’s own implementation of IAB’s standards (rather than a direct ruling on the consent framework itself).”

“That said,” Gray said. “It’s challenging to obtain specific consent in the mobile app setting for some partners and purposes, and so it’s an open question of what a legally valid CMP implementation would look like.”

Not the first time the IAB Europe’s framework has been called into question. The IAB Europe’s framework has been met with criticism since it was first unveiled in March 2018. Google, in particular, has delayed joining, citing technical concerns. Ryan, who used to be head of ecosystem for anti-ad-blocking solutions provider PageFair, told us in January that consent in general was “unworkable” under GDPR, saying the TCF didn’t sufficiently track the sharing of user consent records.

Why you should care. As Matthiesen notes, GDPR went into effect in May and will likely evolve in practice. But this type of charge against data-driven companies like Vectaury affects U.S. companies in several ways. First, global companies that handle the personal data of European Union (EU) members are beholden to GDPR, and could face investigations and penalties. Second, the U.S. is looking to pass its own set of privacy regulations, and cases like these serve as real-life previews to what businesses might face here.

Finally, if regulatory frameworks such as the IAB TCF aren’t adequate for the job, what what will be? In October, the IAB Tech Lab — which has worked with IAB Europe on its framework — started testing PrivacyChain, a blockchain-based way to track consent it developed with identity resolution provider LiveRamp as a way to address some of these concerns. Of course, an alternative is for the industry to upend the adtech complex and stop using personal data for ad targeting purposes.



About The Author

Robin Kurzer
Robin Kurzer started her career as a daily newspaper reporter in Milford, Connecticut. She then made her mark on the advertising and marketing world in Chicago at agencies such as Tribal DDB and Razorfish, creating award-winning work for many major brands. For the past seven years, she’s worked as a freelance writer and communications professional across a variety of business sectors.

Related Topics

CCPA - California Consumer Privacy ActChannel: Martech: Analytics & DataGDPR - General Data Protection Regulation

We're listening.

Have something to say about this article? Share it with us on Facebook, Twitter or our LinkedIn Group.

Get the daily newsletter digital marketers rely on.
See terms.

ATTEND OUR EVENTS

Next Event: Sept. 14-15, 2021

Available On-Demand: March 2021

Available On-Demand: October 2020

×

Attend MarTech - Click Here


Learn More About Our MarTech Events

April 13, 2021: SMX Create

May 18-19, 2021: SMX London

June 8-9, 2021: SMX Paris

June 15-16, 2021: SMX Advanced

June 21-22, 2021: SMX Advanced Europe

August 17, 2021: SMX Convert

November 9-10, 2021: SMX Next

December 14, 2021: SMX Code

Available On-Demand: SMX

Available On-Demand: SMX Report

×


Learn More About Our SMX Events

White Papers

  • Nielsen Annual Marketing Report: Era of Adaptation
  • Global Social Media Advertising Trends Among Retailers in 2021
  • 2020 Hispanic Market Report
  • Delivering Audio Success: Industry Trends in Streaming Audio & Podcast Performance
  • Ten Tips for Acquisition Email Success
See More Whitepapers

Webinars

  • Drive Customer Engagement with the Power of Personalization
  • 7 Use Cases That Prove Why You Should Implement DAM
  • Accelerate Your SEO & Content Marketing Program with 4 Key Milestones
See More Webinars

Research Reports

  • Local Marketing Solutions for Multi-Location Businesses
  • Enterprise Digital Asset Management Platforms
  • Identity Resolution Platforms
  • Customer Data Platforms
  • B2B Marketing Automation Platforms
  • Call Analytics Platforms
See More Research

Attend SMX For Only $149

h
Receive daily marketing news & analysis.

Channels

  • MarTech
  • CMO
  • Social
  • SEM
  • SEO
  • Mobile
  • Analytics
  • Retail
  • Display

Our Events

  • MarTech
  • SMX

Resources

  • White Papers
  • Research
  • Webinars

About

  • About Us
  • Contact
  • Privacy
  • Marketing Opportunities
  • Staff

Follow Us

  • Facebook
  • Twitter
  • LinkedIn
  • Newsletters
  • RSS
  • Youtube

© 2021 Third Door Media, Inc. All rights reserved.