A Study on Consent of the GDPR in Advertising Technology Focusing on Programmatic Buying

Online targeted advertising which conveys its advertising message to a target individual based on an accumulated data analysis across multiple external websites about a user's online activity. Basically, the targeted advertising is based on programmatic buying. In the past, advertisers could use a limited advertising space to attract potential customers such as a full-page advertisement at an influential daily or out-of-home(OOH) in the downtown. The advertisers had to win an auction, e.g. a private auction at offline venue, in order to get the space. Nowadays, however, as increasing online media’s influence, e.g. web portal, influencers’ blog, demand for the online advertising inventory is increasing faster than ever. The inventory can be supplied into the advertising market, because it has a feature as intangible resource. Under this circumstance, a method of the traditional action between advertisers and publishers became no longer working in the era of digital media. Hence, programmatic buying was introduced, because it provides that connect between advertisers’ demand and publishers’ supply automatically through an algorithm has already been set up. Moreover, the algorithm can support that advertisers the ability to reach potential customers. Using a personal data helps to select the potential customers. The personal data has been collected on the basis of individuals’ consent. The targeted advertisement is good for potential customers, giving them better access to information about what is being offered, however, it also has privacy risk to users. Therefore consent for marketing purposes become increasingly important in due course. Article 4(11) of the General Data Protection Regulation (GDPR), which was adopted on 14 April 2016, and became enforceable beginning 25 May 2018, states that “any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”. Usually, to use a web portal, the potential customers as user has to consent for the personal data to be used for marketing purposes, at the same time, the web poral as online media, known as publishers in programmatic buying, has a role to supply(or sell) advertising inventories for advertisers. Supply Side Platforms(SSPs) help publishers manage and sell the advertising inventories. Advertising exchanges(Ad exchanges) as mediators, connects between SSPs and Demand Side Platforms(DSPs), which is in charge of managing advertisers’ demand to buy the inventories. Advertisers conduct to bid in real-time to serve advertising impressions to webpage visitors. The highest bidder ‘wins’, and their advertisement will be presented on the webpage to the potential customer via the Real-Time Bidding(RTB) process. The whole process simultaneously takes place in milliseconds based on the authorism in embedded platform. Furthermore, the participants use multiple DSPs and/or SSPs to enable more accurate targeting of advertisements to individuals, i.e. potential customers, and to gain higher revenue, hence, it is hard to figure out that each of participants comply with Article 4(11) of the GDPR, step by step. Although the Article 29 Working Party(WP29) provides ‘Guidelines on consent under Regulation 2016/679’(Guidelines) to help the European Union Member States comply with it, and interpret a notion of consent in GDPR. However, in practice, it is hard to be applied in all cases. In this article, the author will analyze discuss the issue relating to consent of the GDPR in the programmatic ecosystem in accordance with WP29’s Guidelines. Hence the author will suggest participants, data protection authorities, and lawmakers to comply with Article 4(11) of the GDPR in practice, considering a feature of the RTB process.