Real Time Bidding - The World’s Largest Data Breach?

Barely a day goes by without global regulators and law enforcement agencies issuing a notice that they’re after big tech for some new violation of consumer privacy or anti-competitive behaviour.

Yet three years after the implementation of GDPR, save for the issuance of a dozen or so fines, little progress seems to have been made in the way in which our information - and rights - are protected. That may be about to change, however, and it’s not due to the actions of the European Commission nor the US House Judiciary Committee.

An entirely independent organisation, with an intriguing connection to South Africa, has just dropped a bombshell on the world of digital advertising.

Claiming that online advertising is responsible for the world’s largest data breach, the Irish Council for Civil Liberties (ICCL) is using GDPR rules to take the New York-based IAB Tech Labs to court in Germany for its role in equipping the ad tech industry with a set of audience taxonomy documents that allow brands to target behavioural adverts at internet users. 

Founded by KZN-born anti-apartheid activist Kader Asmal in 1976 when he was in exile in Ireland (Kader returned to SA in 1990 and later served as  Miister for Water Affairs & Forretry and as Minister of Education), the ICCL was instrumental in helping legalise homosexuality, divorce and contraception in Ireland.

The organisation has named Google, Facebook, Amazon, Twitter, Verizon, AT&T - and by default the entire online advertising and tracking industry - in its lawsuit. In its evidence it maintains that the codes used in the taxonomy allow extremely sensitive information to be captured and that little to no provision is made to restrict what companies can do with this data.

The action is being led by Dr Johnny Ryan, a highly charismatic former adtech insider, and it may be that his ability to demystify the process - and consequences - of real time bidding will inflict more damage on the industry than any of the investigations launched by regulators thus far.

In a damning video on the ICCL’s website he unpacks how the online advertising ecosystem captures information on every click we make and then auctions the behavioural data it has gathered on us in real time. 

While most of us in the marketing industry are only too aware of how tracking works, it’s scary hearing his first hand testimony of just how connected the ecosystem is and how much data is shared - from what video we’ve just watched to information on our sexual preferences, our political views and even, in some cases, our GPS co-ordinates.

The IAB Techlab’s taxonomy assigns a code to each behavioural trait - over 1 500 in all - covering everything from drug use to religious belief to whether we have special needs children. 

At issue is the acknowledgement that publishers have no technical way to limit what happens to data once it’s been provided to the potential advertiser. With ad exchanges passing data to other exchanges and to data brokers, Ryan postulates that our data is shared hundreds of billions of times a day. All of this in direct contravention of GDPR which specifies that companies can not use or share data unless they can protect it.

He claims to have obtained a confidential lobbying document, published a year before GDPR came into effect, that acknowledges online advertising would be illegal once the new laws came into effect.

In the past three years Ryan has lodged multiple submissions to regulators complaining about the deficiencies in real time bidding and exposing how data from the online advertising industry has been used to influence a European election and to profile people with HIV.

While little has come from his past efforts, this latest legal case, in which he puts a very human face to the scale of the deficiencies in the industry, may well yield a very different result. The debate now has a personality and looks set to move from the law rooms into the court of public opinion.

This article originally appeared on MarkLives.