EU targets online behavioural adverts[fr][de] 

Information Society Commissioner Viviane Reding is requiring the British authorities to modify national legislation in protection of personal information. The move follows a series of user complaints triggered by the use of Phorm, a behavioural advertisement technology, which was tested by British Telecom without informing customers.

Phorm allows Internet service providers, such as BT, to track the surfing activities of Internet users. The user data collected are used to build profiles, which are then sold to advertisers. Thanks to Phorm, companies have a better idea of customers' interests and can thus improve their marketing strategies. The result is that if a consumer often goes to pharmaceutical websites, he will receive drug-related ads.

The problem is that BT did not ask for the consent of users before tracking their movements on the Internet. Electronic profiles of thousands of users were created between 2006 and 2007 without their knowledge. Nevertheless, BT's actions were in line with UK rules on data protection.

In fact, Britain only loosely interprets European rules on data protection, which specify that user consent must be "specific", "informed" and "freely given" before their data can be processed. British legislation instead states that data can be collected if there is "reasonable grounds for believing" that consent has been given.

"I call on the UK authorities to change their national laws and ensure that national authorities are duly empowered and have proper sanctions at their disposal to enforce EU legislation on the confidentiality of communications," said Commissioner Reding in a statement .

A warning to Google?

The timing of the decision was maybe not chosen at random, as it comes just a few weeks after Google, the main seller of online targeted advertising, started providing YouTube visitors with behavioural adverts. These adverts are also applied to visitors of websites equipped with the ubiquitous AdSense software, distributed for free by Google to help Web editors raise advertising revenue.

'Interest-based advertising', as Google refers to behavioural adverts, allows users to change or delete interest categories for which they do not want to receive adverts. "We put users in control of data," explained a Google representative in Brussels. Ultimately users can opt-out of the service if they do not want to receive interest-based adverts at all.

However, the problem with this approach lies precisely in this 'opt-out' option. A more restrictive interpretation of EU data protection rules, which is emerging within the EU institutions and is proven by the Phorm case, seems instead to be moving towards the opposite 'opt-in' approach. 

"The opt-out system is not allowed in the EU," stated Martin Selmayr, Commissioner Reding's spokesperson. This implies that Google and whoever else wants to use behavioural ads will be forced to ask for the prior consent of users, a system which could kill the entire business model.

Reding's move follows the tough line against behavioural adverts adopted in April by Consumers Commissioner Meglena Kuneva (EurActiv 01/04/09), and the harsh opinion adopted in 2008 by the group of EU national data protection authorities (EurActiv 09/04/08).