The regulatory insider

On the 17th April 2024, the EDPB published an Opinion on the “Pay or Okay” model from Meta, stating that such online platforms should offer users a real choice and that the consent as it stands is not valid to confirm the free use of their personal data. Meta will therefore have to adapt to those recommendations to change this model, embrace another one or manage to get a proper ‘freely given’ valid consent from their users with a genuine yes/no option for personalised advertising, especially when it comes to tracking.

Internal documents from the UK privacy regulator (ICO) were leaked, where the ICO states that the Google Privacy Sandbox changes fall short. Google’s proposed replacement for cookies need to better protect consumer privacy, as gaps were identified leaving opportunities for what the ICO calls ‘systemic industry noncompliance’. The ICO works closely with the CMA in monitoring the roll out of the Privacy Sandbox, and the report is set to be published at the end of April 2024.

Targeted advertising is set to change in the near future with the implementation of new tools such as Google’s Privacy Sandbox marking the end of third-party cookies on Chrome. Best practices in the advertising industry will have to be reevaluated and adapt to the changes brought in by the big platforms in this privacy-centric era, whether it concerns ad targeting or switching to the use of contextual targeting, sign-in environments or alternative IDs for publishers and advertisers.

While the DMA has been praised as a major step towards fairness in online markets, voices in the industry are starting to question its concrete feasibility going as far as already categorizing it as a failure. Critics are considering the degradations of consumers’ experience online due to the heavy-handed regulation with adversarial enforcement on top of it, while providing less procedural safeguards, using brute force to reopen old competition litigation cases. Gatekeepers could possibly end up choosing to remove features to avoid impossible compliance, eventually harming consumers.

The UK’s antitrust regulator is gathering industry feedback on the Chrome Privacy Sandbox proposals as they are tasked to assess whether Google’s deprecation of third-party cookies will be infringing competition rules. The ad tech companies’ opinions will be precious as the CMA has the prerogative to delay the Sandbox implementation if they determine that concerns remain.

Meta confirmed that they plan to substantially reduce the price of their advertising-free subscription model, aiming to appease and end the EU scrutiny of how Meta uses users’ personal data following pressure from the EU online privacy and competition regulators, especially with the recent enforcement of the DMA. The EDPD is set to issue an opinion in the coming days.

EU Commission opened non-compliance investigations into Alphabet, Apple and Meta under the DMA following the three companies’ suggested solutions which appear as lacking, especially regarding the steering rules in Google Play, Google Search, App store policies and choice screen, and Meta’s pay or consent model.

The Court of Justice of the EU (CJEU) confirmed that the strings of data that IABs Transparency and Control Framework generates in response to users’ privacy choices are personal data, within the meaning of the bloc’s General Data Protection Regulation (GDPR), as they contain a personal identifier.

Once third party cookies fully disappear Amazon will stand as one of the few and largest platforms where marketers can precisely target and measure their advertising.

Latvia cuts down on illegal gambling advertisements: Amendments to the law on advertising plan to restrict illegal gambling advertisements as well as the distribution of non-compliant lottery advertisements by designating a supervisory authority.

“By cooperating in this way, ProSiebenSat.1 and RTL Deutschland are laying the foundations for full-stack ad tech that is made in Europe,” said Carsten Schwecke, CEO of Seven.One Media. “Both companies invested in advertising technology early on, with the most effective medium, TV, undergoing a process of comprehensive digitalisation. In the future, technology based on artificial intelligence (AI) will further improve the efficiency of linear and digital advertising. This will make booking innovative, cross-platform TV campaigns easier and more efficient for both advertisers and agencies.”

The President of the General Court dismissed Bytedance's (TikTok) arguments according to which their designation as gatekeeper would cause the disclosure of highly strategic information concerning TikTok's user profiling practices, which is not in the public domain. According to the Order, Bytedance has failed to demonstrate the urgency required for an interim order in order to avoid serious and irreparable damage.

Google, again, delayed further their third-party cookie deprecation, putting the brakes on the roll out of the Privacy Sandbox, now set for 2025. This new postponing came despite new assurances made by the giant and its start of cookie deprecation in 2024. In addition to the CMA and ICO remarks, and after some testing and finding out some possible alternatives, ad executives expressed their will to not rush this so they can have enough time to figure out solutions. But down the line, despite slow progress, Google will move forward with cookie deprecation, and marketers will need to adapt their data strategies and be prepared for it.

The ‘Cookie pledge’, an initiative led by the European Commission to let Big Tech companies choose to allow consumers make more effective choice when it comes to tracking-based advertising models, notably when it comes to cookie banners, has failed to gain traction. The Commission will probably look towards other solutions to tackle those issues, including the possibility to legislate or redesign consumer data regulation.

Lady Gaga posted an ad on her Instagram account sponsoring a Pfizer migraine drug, when advertising prescription medication to the general public is illegal in the EU. The DSA and DMA however only allow the EU to intervene after the illegal content has been flagged by the people seeing it and only if it is not removed after these complaints were made. However, even after flagging it, the ad remained visible, thus showing the possible difficulties and shortcomings in the application of EU digital laws.

Self-regulation rules on gambling-style loot boxes in video games were broken by developers, with the UK advertising regulator (ASA) upholding complaints against companies failing to disclose that their games contained such loot boxes. Loot boxes present risks akin to gambling, but the UK government decided not to follow countries such as Belgium in regulating them as gambling products back in 2022. Yet, many games are reported as potentially breaching these self-regulation rules.

Data privacy laws are multiplying not only in the EU but also in the US, and the days of self-regulation in the online ad-industry are numbered. Compliance with those privacy laws must therefore prioritized, with the help of technical standards and privacy compliance frameworks which are currently being developed.

Google’s Privacy sandbox, aiming to replace cookies online, is starting a critical phase, becoming more concrete, prompting evaluations from ad executives to figure out alternative tracking solutions (e.g. Protected Audiences API, Topics API, Attribution API).

Guidelines were set out by the FCA (Financial Conduct Authority) to tackle misleading adverts on social media and warn influencers that promoting a financial product without regulatory approval could amount to a criminal offence.

The US House of Representatives has passed a bill which would force TikTok’s owner ByteDance to divest the app, or else place a nationwide ban on the app. The bill, which was introduced last week, passed by a landslide with 352 members voting for it and just 65 against. The proposed law already has the backing of the White House, but will still need to pass in the Senate if it’s to come into force.

The EU’s landmark Digital Markets Act (DMA) came into force on March 7th. It will have a profound effect on the tech that European use on an everyday basis.

Origin, the cross-media measurement solution managed by trade body Isba, will have received £52m in funding from UK advertisers by the end of this year. The figure is over five times the amount disclosed by Isba in its annual accounts filed for the previous financial year and will fund a new Origin organisation that is being created separate to the advertiser trade body.

Alphabet’s Google was hit with a €2.1bn ($2.3bn) lawsuit by 32 media groups including Axel Springer and Schibsted on Wednesday, alleging that they had suffered losses due to the company’s practices in digital advertising.

On February 27th, Parliament adopted new rules on transparency and targeting of political advertising, which will make election and referenda campaigns more transparent and resistant to interference. The new rules will regulate political advertisements, notably online ads, while also providing for a framework for political actors to advertise more easily across the EU. The Council still needs to formally adopt the text next. The rules will apply 18 months after the entry into force, while the definitions and measures on the non-discriminatory provision of cross-border political advertising (including for European political parties and political groups) will apply already 20 days after the publication in the EU Official Journal.