The legislation put in place to empower people with data control has fallen short of expectations.
These laws are supposed to help people control their experience of online advertising and data sharing. There are five main reasons they are not currently working:
- People's rights are not implemented into the products they use.
- People are not aware of their rights.
- Data sharing starts as soon as people visit a website, making meaningful consent impossible.
- Businesses don’t know how to use the law to meet the range of people's needs.
- The law is not enforced.
People’s rights are not implemented into the products they use
In a August 2023 Yougov survey 88% of UK adults said that it is important that social media platforms enable people to use their right to object to the processing of personal data for advertising.
But when the Projects by IF team tried to use the right to object to Meta’s use of data for advertising it was hard to find. When we used it we got a response saying that we could not object as we were in the UK.
People need to be able to use their rights whenever they want. While they are reading a website, ordering a pair of shoes, or reading a news story about a data breach. There is too little incentive for advertisers and publishers to do this. The UK regulator's guidance simply suggests that people should make an objection by sending a letter. How many people will do that?
People are not aware of their rights
During this project we interviewed 17 people about the right to object to the use of personal data for advertising.
Many of these people were aware of GDPR, but none were aware of the right to object.
Data sharing starts as soon as people visit a website, making meaningful consent impossible
When people visit a website it is likely to start immediately sharing data with a large number of advertising intermediaries, sometimes hundreds.
This is not only because of visible features like website cookies, but also because of other less visible features like Meta's tracking pixel, Google Analytics or the code that embeds adverts.
Even if a user rejects website cookies then these other features may still share data about them.
Data sharing like this does not provide people with the time to understand what is happening, let alone empower them to meaningfully consent to it.
Businesses don’t know how to use the law to meet the range of people's needs
The law can seem to describe rights, such as the right to object, as simple yes/no options. If a person objects then the publisher cannot use an email address to send a generic advert for a Summer sale. Yet many people want to object to data being shared with third parties that they do not know, but are happy to receive relevant adverts from the publisher or advertiser they know.
Rather than simple yes/no options, presenting people with more granular, accessible and effective controls is a better way to meet the range of needs that they have. It will work better for advertisers and publishers too.
This requires products to be designed in a way that combines various elements of the law such as the ability to consent to specific data sharing purposes and the right to object to others. This will enable people to exercise their rights and get the useful adverts they actually want.
The law is not enforced
Finally, the law is not enforced - particularly in the UK.
It took five years of legal battles before the European Court ruled that Meta’s online advertising model was in breach of the EU’s General Data Protection Regulation (GDPR). Meta are now changing their products, but hundreds of other organisations are likely to be similarly in breach of the law.
The UK’s data protection regulator started an investigation into the online advertising industry in 2019. As yet it has taken no enforcement action.