Programmatic advertising in the EU: which contractual solutions for which concerns?

As the definition of personal data becomes broader – for example, Germany, Italy and France consider that IP addresses, and sometimes even mobile device IDs are personal data – it is likely that an increasing number of AdTech companies will be viewed as being involved in data processing activities. So we have assumed in this article that AdTech companies are subject to data protection regulations.

1. Use and ownership of data

Are you a data controller?

Issue: AdTech companies have usually been seen as data processors which are acting under their clients’ instructions. However, this interpretation was never adapted to AdTech companies’ business models, as they are using proprietary technologies to offer turnkey solutions. Furthermore, AdTech companies are now processing data for their own needs, using their own algorithms to get a clear view of the audience. They can therefore be seen as controllers or co-controllers, and need to comply with their obligations as such.

Action: Assess your processing activities in order to determine your legal status, and avoid relying solely on the qualifications given in contracts. Each party’s obligations should be clearly identified in contracts.

What data do you own?

Issue: Since personal data has an increasingly important market value, its ownership has become a matter of concern for AdTech companies and for advertisers. On one hand, advertisers consider that they own all the data related to their products and their audience. On the other hand, AdTech companies need such data to improve their targeting services.

Action: Negotiate and include a data ownership clause in contracts – as this question should be addressed contractually. However, you should go beyond the question of data ownership and obtain appropriate rights to access or use such data in your contracts, especially in cases where the other party refuses to give up ownership of personal data.

2. Targeting activities

How do you gather consent and communicate rights?

Issue: Getting data subjects’ consent (in particular when using cookies) and informing them of their rights of access, opposition, rectification and deletion can sometimes prove difficult for AdTech companies, especially when there is no interface allowing AdTech companies to communicate directly with data subjects.

Action: Try to ensure transparency using every means at your disposal, and when relevant try to acquire the links (including licensees, if any) to the information notices and consent forms of the third parties at the time of entering into the relevant agreements. Should this not be possible, add a clause in your contracts providing that the information obligation falls upon the entity which has the closest link with the data subjects. As a last resort, rely on the exception set out in Article 11 of Directive 95/46/EC and Article 14.5.b of the GDPR which addresses the situation where the provision of such information “proves impossible or would involve a disproportionate effort”.

3. Financial transparency

How do you navigate incentive and rebate arrangements?

Issue: Advertisers usually expect transparency from the intermediaries with whom they contract to buy advertising space (such as media agencies and trading desks) and also from media owners. In most cases, the auction process is completed without disclosure as to the rebates granted by media owners to intermediaries. This lack of transparency could put these entities in breach of local applicable laws or regulations.

Actions: Where possible, require from intermediaries that they open a separate account per client advertiser. Review terms with intermediaries to ensure that provisions requiring transparency on their part protect you as much as possible.

4. Ad blocking

How do you ensure advertising efficiency?

Issue: As ad blocking add-ons are increasingly popular amongst Internet users, the audience now has the ability to block the advertising it does not want to see. In the self-regulated world of online advertising, advertising formats that are considered invasive and/or merely annoying to the audience may progressively lose their efficiency.

Actions: Whilst there may be legal arguments that could be raised against ad blocking software, the key to advertising efficiency might simply be the display of advertising that consumers will want to see. Try to maintain adequate communication and negotiate appropriate contractual provisions with other advertising intermediaries and with media owners so as to (i) prevent repetitive advertising, (ii) enhance advertising relevance and (iii) move towards first-class industry practices by giving more control to the audience when displaying Online Behavioural Advertising.

5. Inventory control

How do you know or control where adverts go?

Issue: Some recent studies have shown that many advertisers have no idea of the final destination of their adverts. The danger is seeing adverts appearing near unsuitable editorial content such as content related to illegal drugs, violence or pornography, which can damage advertisers’ reputation and advertising efficiency and therefore impact your business.

Actions: Contractually agree a reporting mechanism listing the media on which the campaigns have run, and determine a website blacklist with advertisers.