European Commission: Article 29 Working Party - Opinion on Behavioural Advertising

IRIS 2010-8:1/6

Joris van Hoboken

Institute for Information Law (IViR), University of Amsterdam

The EU’s Article 29 Data Protection Working Party has adopted an Opinion on data protection law as applied to behavioural advertising. In its Opinion, it gives legal guidance on legal issues related to the tracking of internet users when they surf the net. Amongst other issues, it addresses the permissibility of the use of cookies and it clarifies the legal responsibility of online content and advertising network providers under European data protection laws.

Behavioural advertising involves the tracking of internet users’ online behaviour in view of the targeting of advertising to internet users based on their habits and interests. The Opinion focuses in particular on network behavioural targeting, in which users are being tracked across a large network of online content providers through the use of cookies or similar tracking techniques. The Opinion notes that network behavioural advertising typically entails the processing of personal data and the profiling of internet users, activities to which European data protection laws apply.

The obligations related to tracking cookies in the recently amended Article 5 (3) of the e-Privacy Directive are discussed in detail, as well as recent changes to this provision at the European level. The Opinion concludes that consent must be given by the internet user before the cookie is placed on the user’s equipment (prior consent) and after having provided information to the user about the sending and purposes of the cookie (prior information). The Working Party notes that browser settings, which are mentioned in Recital 66 of the amending Directive, can only be considered a valid means of acquiring consent if a number of strict conditions are satisfied that guarantee valid prior informed consent.

The Opinion also discusses the responsibility under European data protection law of content providers that rent out space on their websites for advertising networks. The Opinion notes that publishers are involved in tracking internet users “by setting up their web sites in such a way that when a user visits a publisher's web site, his/her browser is automatically redirected to the webpage of the ad network provider. In doing so, the user's browser will transmit his/her IP address to the ad network provider which will proceed to send the cookie and tailored advertising.” As a result, the Working Party concludes, publishers will carry responsibility as data controllers for these actions, although this responsibility cannot require compliance with the bulk of data protection obligations. In particular, according to the Opinion, online publishers that participate in behavioural advertising will have to comply with the obligation to inform the visitors to their sites about the processing of personal data that is a result of behavioural targeting on their website.

The Opinion should probably be seen as a first step by European data authorities towards addressing behavioural advertising. The Working Party explicitly invites the industry to enter into a dialogue on the ways in which it can guarantee compliance with the legal framework as set out in the Opinion, in particular through the development of technological tools or other means.