First a brief roll of thunder from the EP – now a surprising and sky clearing draft by the Commission. Updates on targeted advertising in the EU

The EU Digital Services Act is taking shape - with potential changes for the advertising industry. While voices from the European Parliament (“EP”) preferred a rather restrictive approach, the EU Commission, under the leadership of the responsible Commissioner Vestager, recently released a press release and the proposal for a “Regulation on a Single Market For Digital Services (Digital Services Act)”, or “DSA” for short. The draft follows a more liberate path that focuses on mandatory transparency obligations.

The DSA and targeted advertising

The Digital Services Act is intended to replace the E-Commerce Directive and create a single European market for digital services. Currently, the individual member states have their own national regulations in addition to the E-Commerce Directive. The digital single market is therefore highly fragmented, an obstacle to a strong European digital industry.

The declared goal is also to create monitoring structures for large digital corporations and to restrict their position of power. Thereby a market environment shall be created, in which the large digital groups cannot exploit their market position in an unfair and dominant manner. The strategy for this is based on several pillars. Among other things, the pre-installation of own apps and the preferential treatment of own services are to be regulated. In addition, transparency through explicit consent requirements, for example for the combination of data is part of the discussion.

There was no doubt this would also affect possibilities to conduct targeted advertising. A report by the European Parliament's Legal Affairs Committee, together with a recommendation to the European Commission, was adopted by a relatively narrow majority in the Parliament. The report assumes that the creation of user profiles by tracking user behavior in conjunction with targeted advertising leads to an emphasis on content that primarily appeals to emotions. This – critics worry - promotes sensationalism in news feeds and recommendation systems and, thus, ultimately impairs the free formation of users' opinions.

This assumption is based on the consideration that context-based advertising encroaches on the privacy of users to a lesser extent than emotional advertising and is therefore preferable. The report further assumes that the decision-making logic behind the provision of targeted advertising is non-transparent and that targeted advertising therefore escapes any oversight.

As a resume, the report called for the examination of options for strongly regulating targeted advertising, – amongst other options – supported even a ban on targeted advertising via the intermediate step of gradual restrictions, and clearly favored context-based advertising without the need for user profiles. Dark clouds rose over players who thrive on targeted advertising as their main or only income model. However, luckily for those, the report’s demands have not been entirely picked up by the EU Commission.

Transparency instead of bans

The draft regulation now proposed by the EU Commission – a, in their eyes specific and comprehensive, rulebook – favors transparency over bans. Right at the beginning, in the explanatory memorandum of the draft regulation, the Commission points out that it will be enforcing users' rights through transparency obligations and will enable authorities and researchers to review the way advertising and its targeting is carried out. In the recitals, it also emphasizes the importance of user consent before the targeting of advertising begins. The above-mentioned information would be a prerequisite to consent (see recital no. 52). Furthermore, the public should be granted access to all advertisements published on the platforms in order to enable monitoring, especially where targeted advertising is used (see recital no. 63).

What does that mean legally?

To break it down: more transparency. First, there shall be a legal obligation to clearly identify advertising on platforms as such (Article 24). This also means that, according to Article 30 of the draft, the public must be informed about the content of the advertising, the advertiser, the time frame in which it has been published, whether it was targeted and, if so, to whom, the actual number of recipients reached, and the number of recipients reached in a targeted manner. This information must be available for one year after the last publishing of the advertisement. Naturally, the information must be presented free of personal data of possible recipients of the advertisements. Furthermore, according to Article 31 of the draft, there are obligations to release data to the newly introduced “Digital Services Coordinator” upon justified request as well as to groups of researchers that match certain criteria. These requests can only be objected if the data is non-existent or the passing on of the data would pose a possible threat to the security of the system. The probably most sensitive new rules for operators of online platforms are the envisaged comprehensive inspection rights of the Commission into their databases and algorithms (e.g., Art. 57).

Lastly, according to Article 34 of the draft, the Commission wants to promote voluntary standards in the relevant industries. This also includes a “Code of Conduct” for online advertisers and platform operators under Article 36. It is not yet possible to say specifically what these voluntary measures will look like, but it will certainly keep players busy.

Significance for users of targeted advertising

Admittedly, this article only represents what at a first glance seems most relevant, but what can be taken away from the legislative package with regard to targeted advertising? Companies and platforms – relatively to their size - will be subject to comprehensive obligations. Although the “DSA” will finally bring establish harmonization of the European digital single market and thus strengthen legal certainty, the transparency obligations for targeted advertising will represent an additional burden and may even affect security-relevant areas of the IT infrastructure. Those affected can continue to exert influence and counteract negative developments via the voluntary associations and voluntary commitments suggested by the Commission under Articles 34 ff. In any case, it remains to be seen whether the comprehensive package of obligations will prove useful in practice. However, we may say that the dark clouds announcing a storm which rose after the EP’s legal committee report have vanished for the moment.

The “DSA” is of course even more far-reaching in its entirety. This article does not take into account obligations with regards to the deletion of illegal content, for example. We will provide you with information on this and other topics relating to the DSA in the coming months. Should you already require individual advice on this or a related topic, please do not hesitate to contact us.