Compliance
Legal Issues in Ad-Tech
Author
Howard Ricklow
Author
Howard Ricklow
December 2, 2024
Compliance
Data Protection Law
E-commerce business in the UK generates revenues of hundreds of billions of pounds a year and continues to grow. One of the critical parts of the e-commerce industry connecting retailers and consumers is internet-related advertising. In this blog, we explain the meaning of Ad-Tech with focus on real-time bidding, technologies involved and legal issues that may arise as well as GDPR implications.
What is Ad-Tech?
‘Advertising Technology’ is the general term which applies to the software which advertisers use to reach their audiences. The term ‘Ad Tech’ is normally applied to the automated buying and selling of online advertising space. Also known as ‘programmatic advertising’, the term is normally applied to software and other tools to automate the selling and buying of digital advertising. Although there are other models (for example ‘programmatic direct’) where there are fewer legal issues the model which this blog will consider is known as ‘real-time bidding’ (RTB).
RTB uses technology to allow advertisers to compete for online advertising space sold by or usually on behalf of website owners (publishers). Each advertiser is bidding against the other to buy displays of their advertisements (impressions) on the publisher’s website in ‘real-time’ for display to an end user who is visiting the website at that moment.
The participants and technologies involved in RTB include:
- Advertisers: Who bid in real-time with the highest bidder winning, whereby their advertisement will immediately be presented on the webpage which the end-user is visiting.
- Demand Side Platform (DSP): A software platform which allows the advertiser to automatically bid within parameters it has set.
- Supply Side Platform (SSP): A software platform which allows publishers to sell adverts.
- Advertising Exchange (Ad-Exchange): A platform which conducts real-time auctions by comparing and agreeing a price for the purchase of advertising space.
- Data Management Platforms: These analyse, store and manage data about individuals.
- Consent Management Platforms (CMPs): These serve as a tool for publishers to enable them to manage user consent.
Programmatic advertising is a very valuable tool to both publishers and advertisers in that:
- Publishers can gain access to large numbers of advertisers bidding against each other for advertising space creating a higher demand (and generally a higher price) than is generally the case through conventional advertising or the programmatic direct model.
- Advertisers can more effectively target their advertising to their existing and new audience and exercise greater control of how and where the advert is displayed on the publisher’s website than in traditional advertising, where advertisers buy advertising space manually on a case-by-case basis.
Legal Issues
1. Form of Contract – DSPs’ standard terms of contract are generally utilised in their contracts with advertisers. Similarly, in the case of SSPs which use standard terms and conditions in their contracts with publishers. Whilst these are a fast and practical means of contracting in the context of programmatic advertising, it does mean that there is generally no direct contracting taking place between an advertiser and publisher. Moreover, as there are several contracting parties in the process since, as well as DSPs and SSPs, there are Ad-Exchanges and Data Management Platforms, this means, for example, that an advertiser can only get the assurance regarding delivery of a publisher’s service that the DSP can give them, which in turn is reliant on the assurance it receives from the Ad-Exchange.
2. Reports and audit – one of the features that the programmatic advertising sector promotes is the transparency available to advertisers regarding the display of their adverts on the publisher’s website. However, an advertiser will need to have a contractual right to have access to technical data to verify this as best it can in its contract with the DSP, which would in turn need to have the contractual right to obtain that information from the Ad-Exchange; and possibly the Data Management Platform. In addition, advertisers may wish to employ third party audit software to verify the reporting, in which case it will need to obtain agreement to that.
3. Dispute Resolution – advertisers will need to know that there is a dispute resolution process available to them; for example, in cases of verifying fees charged to the advertisers as against impressions actually displayed.
4. Amongst other contractual areas to be considered there will need to be pricing terms, control over where an advertiser’s advert may be shown (e.g. not on adult websites), governing law and jurisdiction provisions, possible limitations of liability and a provision that the publisher will comply with applicable laws.
5. Participants involved in RTB will need to consider ownership of any intellectual property rights created within the transactions comprised within the RTB; as well as a possible right to retain reports produced by the services of an SSP or DSP.
Advertising Agreements
In most cases advertisers will utilise an advertising agency in relation to Ad-Tech which will be dealing with publishers and DSPs directly; accordingly the contract between the advertiser and advertising agency will need to deal with many of the above issues, as well as privacy issues, which are touched upon below.
Privacy
RTB will almost certainly involve the transfer and processing of personal data; including in some cases special category data (e.g. health, political views, religion and ethnic group) amongst the several entities involved in the RTB process. Cookies are also invariably involved in collecting personal data. Those in the Ad-Tech industry will therefore need to be fully apprised of the relevant provisions of both the UK General Data Protection Regulation (GDPR) and the Privacy and Electronic Communications Regulations (PECR).
How are GDPR and PECR involved?
- A publisher generally uses cookies to collect information about visitors to their website. The use of cookies is governed by PECR and the information collected will generally include information which constitutes personal data under GDPR.
- The information collected is incorporated into a ‘bid request’ which is transferred to advertisers who can bid to place their ad on the publisher’s website, specifically to be viewed by the individual whom the bidder considers, on the basis of the information received, will be interested in the advertiser’s product or service.
- All of the above processes take place in fractions of a second.
- Because of the probable number of participants operating within the RTB process, it is often unclear precisely which entities will be data controllers, whose primary responsibility it is to comply with GDPR; and in particular the lawful basis for processing data which will on some occasions be special category data.
- Regulation 6 of PECR requires organisations to provide clear and comprehensive information about the purpose of cookies which sit or access information on users’ devices and obtain prior consent – whether or not what is being stored or accessed is personal data.
- Although there are ‘protocols’ adopted primarily by the major players in RTB, the Information Commissioner’s Office report on Ad-Tech and real-time bidding in 2019 raised concerns about a lack of transparency, the lawful bases for processing personal data (and special category data) and for breach of GDPR and PECR where personal data is being shared.
Conclusion
The EU has regulated to some extent in this area under the Digital Services Act (DSA) in relation to online advertising. That legislation is outside the scope of this blog; however, it should be noted that the DSA applies to any digital services provider who has customers/servers in the EU, even if based in the UK.
In relation to contractual provisions and privacy issues where, as is well-known, GDPR sets a maximum fine of £17.5m or up to 4% of annual global turnover for breach (and where legislation is to be introduced in relation to breaches of PECR and those breaches will attract similar fines), those involved in RTB will need to consider their exposure and how best it may be addressed. Advertisers in particular who generally have no direct contracts with publishers or DSPs directly, rather a contract with their advertising agency which buys services from Ad-Tech vendors on the advertiser’s behalf, may need to consider sharing the risks involved. In any event the issues being raised should alert the advertising agency to the potential exposure which they may be able to raise with publishers.
Ad-Tech will continue to come under the scrutiny of regulators both nationally and internationally with new regulatory frameworks on the horizon. In particular, the use of cookies and third-party cookies will occupy the minds of privacy regulators; and the extent to which those involved in the Ad-Tech industry are able to collect, process and share personal data. Publishers, advertisers and intermediary platforms will need to be quick and agile in adapting to changes as they occur.
At EM Law we are experts in Ad-Tech, e-commerce and data protection. Please do not hesitate to contact Howard Ricklow, Colin Lambertus or Neil Williamson – we will be happy to discuss your questions.
