A vicious circle? Enabling privacy-friendly alternatives to behavioural advertising

A new report from EDRi member Panoptykon Foundation shows that privacy-friendly alternatives to behavioural advertising could be a sustainable funding model for online publishers. But in order to make that happen, EU policymakers must create a regulatory push by enforcing the GDPR and adopting new rules which would incentivise the uptake of alternatives.

For nearly 20 years the advertising industry and leading online platforms have engaged in convincing regulators, users, and publishers that behavioural advertising based on invasive tracking is the only sustainable way to fund the internet. In reality, however, the “To Track or Not to Track: Towards Privacy-Friendly and Sustainable Advertising” report argues that there is only one winner in this supposed “win-win” situation: the ad tech industry.

For online users, behavioural advertising creates huge risks to privacy and individual autonomy. Publishers are kept in a prisoner’s dilemma where they are facing the tough choice between having to hand over up to 70% of their profits to advertising middlemen or being unable to fund themselves at all. Advertisers have to rely on unreliable metrics and deal with bots fabricating clicks on ads which funds organised crime. Societies have to bear the consequences of attention-driven behavioural advertising by observing the deterioration of media quality and an increase of sensationalist content, which is not without effect on the quality of public debate and democracy.

At the same time, evidence shows that contextual advertising, which does not rely on personal data, can be more profitable for publishers and equally if not more effective for advertisers. First-party targeting limited to shallow behavioural insights collected directly by publishers and subject to users’ control can also be a valid alternative.

Despite the fact that alternative advertising models hold the promise of better privacy protection and more revenues for publishers, the online advertising market does not currently provide many options for publishers, particularly small or local ones. Although the ad tech industry is under scrutiny by data protection authorities in 17 EU jurisdictions, business carries on as usual. However, the lack of GDPR enforcement, instead of helping publishers, further cements their dependence on the ad tech industry and throttles the development of privacy-friendly alternatives.

We are stuck in a vicious circle. The failure of data protection authorities to send a clear signal that excessive tracking is illegal prevents the mass uptake of privacy-friendly solutions. When alternatives are not implemented at scale, the report argues, gathering enough evidence to demonstrate that they can be equally if not more sustainable for publishers is a massive challenge. This further consolidates the market driven by the logic of more data and more personalisation.

Panoptykon proposes that apart from enforcing the GDPR, the EU should adopt a systemic regulatory response aimed at fixing the root cause and not the symptoms of the problem. A coherent regulatory framework would include both a prohibition on cross-site tracking and targeting in the ePrivacy regulation and an effective restriction of the power of online platforms in the Digital Services Act package. The former would end publishers’ reliance on ad tech middlemen and promote contextual and first-party targeting, while the latter would ensure that online platforms do not dictate the rules of the game and capture most of advertising budgets.

The report was prepared by Panoptykon’s lawyer and policy analyst Karolina Iwańska as part of her Mozilla EU Tech Policy Fellowship.