Data Protection Law
Digital Marketing is a growth industry with legislation struggling to keep up. Unsurprisingly though there are legal issues that digital marketing businesses need to be aware of to remain compliant. The House of Lords’ 2018 report “UK advertising in a digital age” noted that digital marketing accounted for over half of all spending on advertising in the UK for the first time in 2017. This figure is likely to only increase, especially in the aftermath of COVID-19. This article provides some background into the types of digital marketing and some of the legal issues to consider in this context.
Digital marketing formats
The Digital Adspend study produced by industry body the Internet Advertising Bureau (IAB) and accountants PricewaterhouseCoopers, breaks down 2017 digital marketing spend by format, as follows:
Paid-for search: £5.82bn, of which smartphone spend was £2.62bn. This is essentially sponsored search results, where advertisers pay to have their details presented at the top of a search results page or prominently featured elsewhere on the page.
Display: £4.18bn, within which falls:
- Online video:£1.61bn, of which smartphone spend was £1.17bn. An example is the pre-roll advert which appears before you watch a YouTube clip, or videos which start playing as the page loads or when your mouse scrolls over them.
- Banners and standard display formats:£1.31bn, of which smartphone spend was £418m. These are the obvious adverts and include those which appear across the top of the screen (banner adverts) or in a sidebar, overlay adverts (which pop up on-screen and have to be clicked to close) and interstitial adverts (full-screen adverts that pop up between expected content, for example before a target page appears on the screen).
Native: £1.03bn, of which smartphone spend was £895m. An advertorial is native advertising, as are adverts which appear to be recommendations by the publisher (“you might also like”), influencer marketing on social media and adverts which appear to be search results.
Classified and other: £1.47bn. Classified advertising is advertising in an online directory or marketplace (for example, Rightmove, Auto Trader and Gumtree).
Commentators note that the biggest increase recently has been in spend on advertising targeting mobile phone users, in particular using a video format.
Key industry players
The CMA’s Final Report on its Digital Marketing Market Study estimates that search advertising revenues totalled around £7.3 billion in 2019, of which more than 90% was earned by Google. Total spend on display advertising was worth £5.5 billion, of which it is estimated more than half went to Facebook.
Google receives revenue from its search engine and other brands such as YouTube, Google Maps and Google Play (an app and digital media store). Google sells advertising space on its own and other sites through Google Ads, and provides services to buy and optimise campaigns on Google via its Google Marketing Platform.
Digital Marketing Legal Issues
Adverts must be obviously identifiable as such.
All advertising must be obviously identifiable as advertising. This is a requirement under:
The Consumer Protection from Unfair Trading Regulations 2008 (SI 2008/1277) (CPUT) which implement the Unfair Commercial Practices Directive (2005/29/EC) (UCPD):
- A failure to identify commercial intent, unless this is already apparent from the context, is a misleading omission.
- Using editorial content in the media to promote a product where a trader has paid for the promotion without making that clear in the content or by images or sounds clearly identifiable by the consumer (advertorial) is a prohibited commercial practice.
- Falsely claiming or creating the impression that the trader is not acting for purposes relating to his trade, business, craft or profession, or falsely representing oneself as a consumer is a prohibited commercial practice.
The Electronic Commerce (EC Directive) Regulations 2002 (SI 2002/2013) (E-Commerce Regulations) which implement the E-Commerce Directive (2000/31/EC):
- Service providers must ensure that any commercial communication provided by them which constitutes or forms part of an information society service (which would include all advertising) is clearly identifiable as a commercial communication.
- Marketing communications must be obviously identifiable as such.
- Marketing communications must not falsely claim or imply that the marketer is acting as a consumer, or for purposes outside its trade, business, craft or profession; marketing communications must make clear their commercial intent, if that is not obvious from the context.
- Marketers and publishers must make clear that advertorials are marketing communications; for example, by heading them “advertisement feature”.
Information obligations on digital advertisers
Online advertisers need to:
- Provide certain information about themselves on their websites.
- Include certain information about themselves and their products in their online adverts.
Information advertisers must include on websites
The information the advertiser must include on websites consists of:
- Its name.
- The geographic address at which it is established.
- Details, including an email address, which make it possible to contact the advertiser rapidly and communicate with it in a direct and effective manner.
- Where the advertiser is registered in a trade (or similar) register available to the public, details of the register in which the service provider is entered and its registration number, or equivalent means of identification in that register.
- Where the provision of the service is subject to an authorisation scheme, the particulars of the relevant supervisory authority. Advertising itself is not subject to an authorisation scheme in the UK, but the advertiser’s business may be.
- The advertiser’s VAT number.
- Where the advertiser exercises a regulated profession:
- the details of any professional body or similar institution with which the advertiser is registered;
- the advertiser’s professional title and the EEA state where that title has been granted; and
- a reference to the professional rules applicable to the service provider in the member state of establishment, and the means to access them.
Information requirements for online adverts
An information society service provider (which includes any online advertiser) must ensure that any commercial communication provided by it as part of an information society service (which would include all digital marketing) shall:
- Be clearly identifiable as a commercial communication.
- Clearly identify the person on whose behalf the commercial communication is made.
- Clearly identify as such any promotional offer (including any discount, premium or gift) and ensure that any conditions which must be met to qualify for it are easily accessible and presented clearly and unambiguously.
- Clearly identify as such any promotional competition or game and ensure that any conditions for participation are easily accessible and presented clearly and unambiguously.
Digital Marketing: Controls on the use of personal data and online behavioural advertising (OBA)
The digital environment offers advertisers the opportunity to track users’ online behaviour to build a profile of their interests and target advertising at them. This practice is known as “online behavioural advertising” (OBA) or sometimes as interest-based advertising (IBA).
Information is generally collected using online identifiers (such as cookies, internet protocol (IP) addresses, radio frequency identification (RFID) tags, advertising IDs, pixel tags, account handles and device fingerprints) which can be used variously to note information such as searches conducted, content viewed, purchases made and the user’s location. Data about browsing habits can be combined with information about the user obtained via registrations and purchases.
OBA may be conducted by a website owner solely based on activity on its own site (first-party OBA) or by a third party tracking activity across multiple websites and user devices and serving adverts for products not necessarily sold on the website being viewed (third-party OBA).
Examples of OBA include:
- Advertising (such as pop-ups and banners) for products a user is likely to be interested in based on their interests, as revealed by their browsing habits or searches.
- Retargeting of adverts for products a user has viewed, encouraging them to go back and make or complete a purchase.
- Advertising to a mobile phone promoting a cafe which a user is passing near to.
Advertisers need to be aware that if they have collected personal data at any stage in the process enabling them to target advertising at individuals, they will be classified as a data controller unless they are acting on behalf of another data controller in which case they may be a data processor. A data controller must notify the individuals whose personal data they are using about who they are, what personal data they are collecting and what they are using that data for. They must also only process that data under one of the specified lawful bases. So if, for example, an advertiser is processing personal data relating to an individual’s political or religious beliefs, the advertiser will need to obtain consent to such processing from the individual.
The Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426) require the user’s consent to the use of non-essential cookies and similar technologies on their devices, including computers or mobiles, but also other equipment such as wearable technology, smart TVs, and connected devices including the ‘Internet of Things’.
If the advertiser’s cookies are collecting personal data then the advertiser will also need to comply with data protection laws as a data controller.
A short introduction
Digital marketing can give rise to many legal issues and what has been mentioned here is only a short overview. The content of adverts and websites and the use of personal data need to be considered from the outset.