Ref. Ares(2018)6600682 - 20/12/2018
THE PROPOSED REGULATION ON E-PRIVACY
UNINTENDED CONSEQUENCES FOR EUROPEAN MEDIA, CONSUMERS AND
EUROPE’S DIGITAL ECONOMY
Executive Summary
By making the provision of virtually all online advertising conditional on prior user consent, the
proposed regulation on ePrivacy will have serious unintended consequences for European
media, SMEs, citizens and ultimately Europe’s digital economy.
Some of these consequences may be attenuated or obviated by ensuring that the future
regulation fully aligns to the General Data Protection Regulation (GDPR) so that prior, “opt-in”
consent is not required for the processing of non-sensitive categories of pseudonymised data
for the purposes of digital advertising. An exception should be introduced in Article 8 of the
proposed regulation for this purpose.
The new ePrivacy Regulation would be more constraining than the existing ePrivacy Directive
The nature of the ePrivacy Directive’s and future ePrivacy Regulation’s general consent requirement
for the use of storage and processing capabilities, and accessing information on a user’s device changes
dramatically once the General Data Protection Regulation becomes applicable on 25 May 2018. New
obligations under the GDPR place a significantly higher burden on controllers when obtaining consent,
including a presumption that consent is not freely given where it is a precondition for accessing a
service.
Virtually all interactions between a controller and a user’s terminal devices – including mobile phones,
tablets, and PCs – require the use of storage and processing capabilities, or the accessing of information
on a user’s device. As a consequence, if the ePrivacy Regulation proposal is adopted without
amendment, virtually all Internet activities would be subject to consent. For users, this would mean
dealing with continuous, and possibly more, consent requests in their everyday digital life making it
difficult and time consuming to differentiate between important and unimportant requests.
Intuitively, consent may appear to give the highest degree of consumer protection because on the face
of it, it appears to offer users the greatest amount of control. In actuality, at least from a digital
advertising perspective, consent would come with many unintended consequences that negatively
impact European companies (especially SMEs), but also consumers and ultimately the quality of our
democracy.
The unintended consequences – less revenue for media, with knock-on effects for citizens
The strict consent-only regime would lead to a significant reduction in advertising revenue for
European media, diminishing media plurality and citizens’ access to quality news.
This is because the advertising that generates the most revenue for news and other websites is
advertising1 that, one way or another, requires data collection and processing that would need consent
under the proposed regulation. Such processing is necessary, for example, to create aggregated
audiences likely to have similar interests, or to ensure that the same browser is not sent the same ad
hundreds of times, or to enable a publisher who ran an ad campaign to be paid for it. Advertising that
benefits from data processing in this way is the advertising that is of most interest to brand advertisers,
and for which they are willing to pay a premium that is then reflected in publisher revenues2. Yet the
data collection and processing required to deliver it could simply not be done lawfully under the
proposed ePrivacy Regulation in combination with the GDPR, because consent will be too difficult or
impossible to obtain.
The reason for this is that much of the data processing is performed by an ecosystem of third-party
intermediaries acting on behalf of European publishers, rather than by the publishers themselves.
These third parties, who will be required under the GDPR to operate in full transparency, have no way
to reach consumers to obtain their consent for data processing.
In theory, website publishers could organise consent on behalf of their third-party partners, but it is not
even clear that a highly-motivated publisher willing to go to the trouble of doing this for several third
parties would be able to comply with the requirements of the law from a technical point of view. This is
because software-based “real-time bidding” and ad delivery makes it virtually impossible for the
publisher actually to know ahead of time exactly which of the partner companies he is working with,
and which of their clients, will process the personal data of his readers in order to deliver ads. However,
it is possible to provide full transparency and control after the fact, in line with comprehensive
information obligations laid down in the GDPR and the right to object.
The predictable consequences will be less revenue going to European media, meaning less money to
invest in journalists and innovation, leading to a decline in media plurality and independence, and,
beyond news, a broader impoverishment of information and other online services available to
European citizens.
Of course, media always have the option of asking consumers to pay for content. But this approach will
not be for everyone, and nor will every European citizen be willing or able to pay for quality news. Far
1 Data-driven advertising is the single largest revenue source for European digital media, making up more than 75 per cent of
the online revenues for publisher’s journalistic content and more than 50 per cent of mobile application revenues. Cf. IHS
TECHNOLOGY, Paving the way: how on line advertising enables the digital economy of the future, available at
http://www.iabeurope.eu/wp-content/uploads/2016/01/IAB IHS Euro Ad Macro FINAL.pdf.
2 Interest-based advertisements generate 200 per cent more revenue on average compared to generic or contextual
advertisements.
Cf.
Howard
Beales,
The
Value
of
Behvioral
Targeting,
available
at
http://www.networkadvertising.org/pdfs/Beales NAI Study.pdf.
from it. Only a small fraction on online users are paying for online access to news and services3. Indeed,
a subscription-only Internet would obviously disproportionately penalise less well-off consumers and
SMEs, raising important issues of equality of access to information and other services.
Instead of achieving the hoped-for “level playing field”, the future ePrivacy Regulation may reinforce
the advantages already accruing to the (mostly international) vertically-integrated, consumer-facing
platforms, to the detriment of the smaller European publishers and third party business service
providers serving those publishers. Advertisers seeking to spend their money efficiently would invest in
the actors best able (if able) to provide the data-driven advertising evoked above, and those would be
the first-party, vertically-integrated actors.
With the legitimate interest as a possible legal basis under the GDPR, and to a lesser degree with less
prohibitive consent rules (as was the case under Directive 95/46/EC) third parties could provide
European media with an alternative to the first party consumer-facing platforms, allowing them to
compete for a share of brand advertising revenue. Under the ePrivacy Regulation without a legitimate
interest legal basis, this leverage will disappear.
The solution
IAB Europe member companies have no desire to process users’ personal data against their will or
without their agreement. The essential question is whether that agreement absolutely must be via prior
opt-in consent, or whether there is not some range of low-risk processing, e.g. of non-sensitive
categories of pseudonymised data, that could be subject to ex post control. Such control has no
meaningful reduction in user privacy or data protection, on the one hand, but provides important gains
in consumer access to quality news and other online services, on the other. Such after-the-fact control
is exactly what the legitimate interest legal basis laid down in the GDPR foresees. The proposed
ePrivacy Regulation needs to be adapted to create an exception to the consent rule for data processing
that would meet all the requirements for the legitimate interest legal basis under the GDPR. In addition,
the ePrivacy Regulation needs to maintain the ePrivacy Directive’s clarification that access to a website
or service may be made conditional on the well-informed consent of a user.
Brussels, 5th April 2017
3 Only 9% users average in English-speaking world have paid anything at all for online news in 2015. Cf. Reuters Institute Digital
News Report 2016, available at http://reutersinstitute.politics.ox.ac.uk/sites/default/files/Digital-News-Report-2016.pdf.