For years, data privacy regulators didn’t have the tools – or the teeth – they needed to effectively enforce proper standards on the internet. Then came GDPR.
Now they have the tools and the teeth. But, still, privacy enforcers are mostly unable to disrupt the status quo. At least to hear Johnny Ryan tell the story on this week’s episode of AdExchanger Talks.
Ryan, a former ad tech exec at PageFair, a publisher solutions provider (an early ad blocker-blocker), was red-pilled, so to speak, when the text of the GDPR first came out in the year before it was enacted. By Ryan’s interpretation, Google’s and the IAB-backed digital ad industry’s RTB systems are built on legal quicksand.
Although, many share his cause. And he’s convinced others to back the case against RTB. Since leaving PageFair, Ryan did a stint at Brave, a privacy-focused browser, before settling into his current role as Senior Fellow at the Irish Council for Civil Liberties. The ICCL is currently suing the Irish Data Protection Commission in the country’s high court for allegedly failing to act to investigate Google.
Aside from the suing the Irish data enforcer, Ryan and the ICCL are active advocates against the IAB Europe’s Transparency & Consent Framework, a solution for conveying consent signals in RTB, which was declared illegal by the Belgian data regulator this year and has some months to come up with a workable update. The TCF is in a Schrodinger’s cat box, since within the year the Belgian data protection authority will decide whether it lives on or is dead for good.
“I think what needs to happen is a market-wide shift imposed by an enforcer or a court,” Ryan says. The GDPR does give regulators the power to compel substantive business changes, as opposed to the focus on landing fines that have made up enforcement decisions to date.
Are enforcers going to take up the tools they have to overhaul online advertising?
“My years of optimism are long behind me,” he says.
