ICO eyes formal real-time bidding regulation after being 'ignored'

Data watchdog threatens 'wider powers' as it continues to investigate RTB process.

ICO: has power to fine companies for violating GDPR
ICO: has power to fine companies for violating GDPR

The UK’s data watchdog has accused companies of "ignoring" its message that the adtech industry needs to clean up its act as it considers formal regulatory action as part of its real-time bidding investigation.

Simon McDougall, executive director for technology and innovation at the Information Commissioner's Office's, warned today that "those who have ignored the window of opportunity to engage and transform must now prepare for the ICO to utilise its wider powers".

The ICO launched an investigation in June 2019 into the RTB industry supply chain and gave a deadline of six months for companies to start getting their house in order.

Through the RTB process, a wide range of data is broadcast to multiple advertisers via an auction that uses this data to serve ads to online users in a fraction of a second.

Following complaints by privacy advocates and Brave, the anti-tracking internet browser company, the ICO said RTB was failing in terms of good data protection and that the adtech industry was "immature" in its understanding of compliance. 

Companies that fall foul of the General Data Protection Regulation, Europe’s data-privacy law, are liable to be fined 4% of annual turnover or €20m (£17.9m), whichever is higher. The ICO enforces GDPR in the UK. 

Google and the Internet Advertising Bureau are the principal bodies in the UK that set RTB standards and support for online advertisers.

Today, McDougall added that both companies had made progress on cleaning up the RTB supply chain: the IAB has pledged to educate the industry on special category data (which contains sensitive information about internet users), while Google will remove content categories and improve its auditing process. 

Google also announced this week that it will remove third-party data cookies from its Chrome browser that allow advertisers to track users across the web. 

McDougall said: "We are using the intelligence gathered throughout last year to develop an appropriate regulatory response. While it is too soon to speculate on the outcome of that investigation, given our understanding of the lack of maturity in some parts of this industry, we anticipate it may be necessary to take formal regulatory action and will continue to progress our work on that basis."