The closure of four cases involving targeted advertising provides lessons for navigating compliance standards under the GDPR.

By Myria Saarinen and Elise Auvray

Four French advertising technology companies that received a warning in 2018 from the French Data Protection Authority (CNIL) have all implemented the regulator’s required changes. The recent closure of the cases highlights opportunities for businesses at all layers of the adtech value chain to address emerging compliance challenges.

The companies — Fidzup, Teemo, Singlespot, and Vectaury — collect geolocation data for targeted advertising purposes via third-party apps. Initially, the French regulator found that they had failed to obtain an informed, freely given, and specific consent from app users, since:

  • The information provided was insufficient, as it was unclear, used complex terms, and was difficult to access.
  • The consent was not based on an affirmative declaration, as the options were pre-ticked.
  • Users were not asked to consent to the processing of their geolocation data specifically.

Whilst the requirements imposed by the CNIL may have appeared at first sight unduly burdensome to the adtech industry, they are unsurprising since they strictly align with the CNIL’s interpretation of the obligations under the General Data Protection Regulation (EU) 2016/679 (GDPR).

These cases provide helpful guidance to other adtech companies that are developing privacy compliance strategies. In particular, such companies should:

  • Not rely on the sole contractual commitments made by the app providers to collect valid consent, but rather provide for concrete and precise obligations as to how the consent should be obtained from data users (e.g., by agreeing on a banner template to be displayed at the installation of the app)
  • Control if such banner template is actually displayed in practice, if necessary by carrying out an audit
  • Provide users with complete and clear information (including the name of the data controller) at the installation of the app, before the collection process actually begins
  • Enable users to choose the different purposes of processing at the first layer (and not only via the preferences page, in the app settings)

For a full client briefing, see Latham’s Client Alert.