Ad tracking rules could become much stricter in Europe; Apple on the right

A European court ruling could make ad tracking rules much stricter in the future. The court essentially created a precedent that deducted the data remains personal data.

This means that if a company can figure out things about you, then that information is protected just as much as the personal data you provided directly…

Ad Tracking Rules

App tracking on iPhones works by Apple assigning a unique ID to your device. It does not reveal any details about you, but allows an advertising network to see (for example) that iOS user 30255BCE-4CDA-4F62-91DC-4758FDFF8512 has visited gadget websites and would therefore be a good target for advertisements of gadgets.

It also allows them to see that iOS user 30255BCE-4CDA-4F62-91DC-4758FDFF8512 saw an advertisement for a particular product on a particular website and then went to a particular retailer’s site for the ‘buy – so this advertisement was (probably) successful.

Europe’s strict GDPR privacy law means that EU citizens must agree to the use of their data (with some exceptions), but it has so far been assumed that this only protects data directly provided by an individual. The type of inferred data used in ad tracking was not meant to be covered by the GDPR.

Alleged data is also protected, says Europe’s highest court

Tech Crunch reports that the specific case concerns the publication by the Lithuanian government of the name of someone’s spouse – from which it could be inferred that he is homosexual. The court ruled that this type of inferred data is also protected and cannot be used without consent.

The relevant part of the referral to the Court of Justice of the EU (CJEU) concerned the question of whether the publication of the name of a spouse or partner amounted to the processing of sensitive data because it could reveal the sexual orientation. The court decided yes. And, by implication, the same rule applies to inferences related to other special category data types.

Dr. Gabriela Zanfir-Fortuna, vice president for privacy at Washington-based think tank the Future of Privacy Forum, sums up the CJEU’s “binding interpretation” as confirmation that data capable to reveal the sexual orientation of a natural person “by means of an intellectual operation of comparison or deduction” are indeed sensitive data protected by Article 9 of the GDPR.

It could have huge implications on the type of data processors allowed to do when it comes to profiling customers and advertising targets.

“I think this could have broad implications in the future, in all contexts where Article 9 is applicable, including online advertising, dating apps, location data indicating places of worship or clinics visited, food choices for air travel and the like,” Zanfir-Fortuna predicted. .”

Prior to this decision, the consensus among companies dealing with data was that they could combine all the knowledge they had about someone in order to create a profile, and that any data they inferred rather than directly collected belonged to them. to be used as they wished. The decision says that is not the case.

This impacts ad tracking, as companies make these kinds of inferences all the time and design custom ad targeting based on them.

For example, if someone buys products associated with pregnancy (like maternity clothes), they will likely be portrayed as an expectant parent and targeted with ads for products designed for pregnant women and parents of newborns. . Similarly, if you watch MacBook reviews on YouTube, you are likely to be targeted with advertisements for MacBook accessories, such as sleeves, cases, docks, dongles, etc.

Justifies application tracking transparency approach

Apple’s App Tracking Transparency was designed to allow iPhone users to choose whether or not to allow this type of profiling. The court ruling may well mean that it is illegal to do this with EU citizens, even if they opt in to tracking.

Dr. Lukasz Olejnik, an independent consultant and security and privacy researcher based in Europe, was unequivocal in predicting serious impacts, especially for adtech.

“This is the single, most important and unambiguous interpretation of the GDPR to date,” he told us. “This confirms Apple’s approach.”

FTC: We use revenue-generating automatic affiliate links. After.

Check out 9to5Mac on YouTube for more Apple news: