Katia De Blasio,
Research Assistant, University of Roma Tre, Italy
About the Author: Katia De Blasio Ph.D. in Law & Innovation, University of Macerata, Italy.
Post-doc fellow in Comparative Private law at University of Roma Tre, Italy.
Member of the Italian Association of Comparative law.
Passed the Italian bar exam in 2022.
Research interests: data governance, AI liability, law & new technologies.
katia.deblasio@uniroma3.it
About the South EU Google Data Governance:
Last June 24th, 2021 the launch and the beginning of the activities of the South EU Google Data Governance Chair took place.
The Board is headed by Professor José Luis Piñar (CEU-San Pablo University, Madrid) and counts with Professors Maria da Graça Canto Moniz (Nova University Lisbon), Georgios Yannopoulos (University of Athens) and Vincenzo Zeno-Zencovich (University of RomaTre).
The Chair will focus on scientific reflection and research in the academic field on data governance, in the context of the European countries.
In addition, it will serve as a framework to analyze the challenges for Law and Data Governance in the European sphere, in areas such as Big Data, Data Driven Innovation, Artificial Intelligence or International Personal Data flows.
Abstract: Algorithmic marketing involves the use of predictive tools and is especially proficient for targeted advertising. Like any predictive system, it requires a huge amount of data, which raises privacy concerns. In addition to that, even when personal data is not involved, online users may feel like they are monitored for commercial purposes. Therefore, it is important to find shared solutions in which the personalisation of content does not lead to the feeling that every user’s move is being tracked for profit.
Keywords: online marketing, targeted advertising, artificial intelligence, GDPR.
1. ABOUT ALGORITHMIC MARKETING
AI is used for many marketing purposes, the most relevant being of course online advertising, which is more effective than traditional advertising.
In fact, building on concepts long used in marketing, such as the creation of a “buyer persona” and consumer scoring, algorithms enable marketers to predict the behaviour of consumers and therefore direct energies to targeted users. Such advertisement practices involve digital advertising, social media content, search-engine marketing, and e-mail marketing.
An example of algorithmic marketing is “programmatic advertising”, that is the use of automated means to buy and sell advertising space and deliver personalised marketing materials to potential customers. One of the most effective types of programmatic targeting is based on a predictive technology called “real-time bidding” (RTB), where marketers participate in real-time micro auctions by bidding to place ads with users based on their previously observed behaviour. This practice helps to determine which site is preferred for banner ad placement.
Some online advertisement practices can be particularly intrusive. For example, thanks to the technique of “tracking pixels”, online advertisers are able to track user behaviour and place their ads in different parts of the internet, usually on social media platforms. Users are often unaware of the use of such pixels, which are designed to blend into the background of the website and therefore be ignored.
Another technique is “geo-targeting”, which enables internet media providers to access the geo-localisation of a user and then offer targeted advertisements for goods offered in that specific place.
2. PRIVACY CONCERNS
The aforementioned techniques implement AI algorithms to predict the fitness of a customer for the advertisement they want to display. In order to perform these tasks, such predictive tools need huge amounts of data for their training. The more the data the better the outcome, although some concerns could be raised in terms of privacy of the data subjects.
First of all, to collect personal data, the processor has to comply with the requirements of the GDPR1, especially articles 6 and 9 for the lawfulness of the treatment of personal and sensitive data. In particular, among the legal basis of art. 6, it could be argued that legal obligation, public interest, and vital interests could not apply online advertising, given that it would be difficult to argue that commercial ads are imposed by law or they represent public needs or vital interests2
It would also be inappropriate to use contract as a legal basis for processing: even the EDPB considered that it would be difficult to argue that marketing practices are “strictly necessary” for the performance of a contract3.
Therefore, consent and legitimate interest would be the best ways to justify the processing4.
Consent is widely used as a legal basis to process personal data of online users. According to art. 4, GDPR, it must be “freely given, specific, informed and unambiguous”. Nevertheless, there is an ongoing debate on how consent could meet those criteria in online environments, given that usually website providers use dark pattern techniques or pay-or-consent schemes to get users to agree on their conditions.
In addition to consent, legitimate interest is widely used to justify the processing of personal data collected online. The legitimate interest must be lawful5, clearly and precisely articulated, and real and present (therefore not speculative)6. This article must be read together with recital 47, which recognizes that “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”.
Some practices, such as the aforementioned “tracking pixels” and “geo-targeting” require the use cookies, which are text files that enable the transmission of information from the server to the client; they are especially used to store information about the behaviour of the user online (i.e. the items she put in a chart or the browsing session).
The use of cookies triggers not only the application of GDPR if personal data is involved, but also art. 5 of the ePrivacy Directive7, which prescribes that the storage of information online or the access to stored information is only allowed when the user “has given his or her consent, having been provided with clear and comprehensive information”8. However, as mentioned above, the rule of consent is usually circumvented by practices such as the use of pay-or-consent or cookie walls9, which basically force the user to accept the use of cookies if she wants to navigate on the website or use the app.
Moreover, it is important to underline that online advertising raises concerns that go beyond privacy concerns. Indeed, for marketing purposes, the processor does not necessarily need personal data to target consumers, as even anonymous behavioural data could be effectively used for such purposes. In such cases, since data is anonymised, the GDPR does not apply and the legal framework is not clear, although many questions arise on what could be the limit to such practices, some of which could even be considered misleading or aggressive commercial practices under the Unfair commercial practices directive10.
3. PRIVACY CONCERNS
As with any new technology, there is a balance to be struck between its shortcomings and its benefits. While it is important to give consumers a personalised experience by showing them ads they are interested in, the widespread use of algorithmic techniques could make them feel ‘surveilled’, and intrusive ads can lead to a negative online experience.
The GDPR offers some remedies to avoid such situations, such as transparency obligations upon the data controller at articles 12, 13 and 14. In addition, as required by Article 35, the controller shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data if, according to the nature, scope, context and purposes of the processing, it is likely to result in a high risk to the rights and freedoms of natural persons.
However, it is important to note that GDPR rules do not always apply to online advertising practices, for example when anonymised behavioural data is used.
Thus, it is important that stakeholders collaborate to create a more transparent online environment. Companies should implement more safeguards when it comes to advertising11, especially when it concerns children and teenagers. For example, one way to achieve a better balance could be for online providers to offer free alternatives without behavioural advertising, as suggested by the EDPB itself 12.
1 Regulation (EU) 2016/679.
2 G. Malgieri, In/acceptable marketing and consumers’ privacy expectations: four tests from EU data protection law, in Journal of Consumer Marketing, 2023, 40, p. 214.
3 See EDPB, Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, 8 October 2019 and Guidelines 8/2020 on the targeting of social media users, 13 April 2021. See also Meta Platform and Others, Case C 252/21, the ECJ stated that such processing “can be regarded as necessary for the performance of a contract to which the data subjects are party, within the meaning of that provision, only on condition that the processing is objectively indispensable for a purpose that is integral to the contractual obligation intended for those users, such that the main subject matter of the contract cannot be achieved if that processing does not occur”.
4 Ibidem.
5 Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens, case C 621/22, ECLI: ECLI:EU:C:2024:858.
6 Fashion ID, Case C-40/17, ECLI:EU:C:2019:629.
7 Directive 2002/58/EC.
8 EDPB, Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities, 12 March 2019.
9 EDPB, Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms, 17 April 2024.
10 Directive 2005/29/EC.
11 Federal Trade Commission, A Look Behind the Screens Examining the Data Practices of Social Media and Video Streaming Services, September 2024.
12 EDPB, Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms, 17 April 2024.
