IAB UK: Proposed response to ICO’s adtech report

What have we done?

Since our event with the ICO on 5 November we have been working on developing specific proposals for how we, together with our members, can address the concerns identified in the ICO’s Update report into ad tech and real time bidding, which is essential reading for everyone in this industry.

The ICO’s six-month window for the industry to absorb its report, explore the issues and identify responses ends next month. As set out at our event, IAB UK together with IAB Europe, IAB Tech Lab and our respective member working groups, have been working hard to develop a response to the ICO. We have put together a set of proposals that we are now sharing with you for feedback.

These proposals are set out in the matrix below, which identifies each issue and key principles, actions and next steps for each one. IAB UK will develop detailed plans for implementing the actions that will form a clear roadmap for delivering against our commitments in a phased manner, addressing the higher priority areas first. More details will be shared once these plans are further developed.

What are we proposing?

In most areas the solutions are not technical but focused on supporting accountability by setting out what ‘good’ looks like. This will

help companies to understand what the law requires and provide the knowledge and the tools to comply with it in practice, driving up standards across the board. Achieving this will require a combination of education and guidance, identifying existing and new good practices and standards and, where necessary, developing technical solutions. Where possible, IAB UK, IAB Europe and Tech Lab want to develop approaches that can be applied in a harmonised way at EEA level to avoid fragmentation and maintain the consistency envisaged by GDPR.

Two specific points we want to draw your attention to are:

• Transparency and Consent Framework (TCF): The TCF clearly has a critical role to play in helping publishers, intermediaries and advertisers to meet the transparency and consent requirements of the GDPR and ePrivacy legislation. It is a key tool in addressing some of the ICO’s concerns and, more generally, in helping deliver collective industry improvements in data and privacy compliance. We urge every company to whom it’s relevant to ensure they are signed up and putting in place plans to implement version 2 of the framework.

• Content categories: One specific, short-term proposal is related to minimising the potential risks that content categories can pose. Used in bid requests to describe the page context of an impression, content categories could be associated with user IDs or other personal information and inadvertently become special category data, which cannot be processed without the user’s explicit consent (which is a separate requirement under GDPR to consent for processing non-special category data). This is an area of significant concern for the ICO. To address this we plan to adopt some ‘rules’ for the UK market that would minimise the inclusion of content category data in a bid request when it is generated (i.e. in the site object field ‘site.pagecat’, that draws on the IAB Tech Lab Content Taxonomy). Our understanding is that this information is not critical to the ad serving process or other associated processes (such as content verification, which uses other data). We are working on how we define these ‘rules’ and how they can be technically implemented in practice. We will provide more details when we can, but we intend to make a specific commitment to the ICO on this in our response.

Next steps

We welcomed feedback on the proposals in the matrix, and the specific proposal described above relating to content categories. The deadline for this was Monday 2 December.  

On Wednesday 4 December, we hosted an event to give members the opportunity to hear what feedback we’ve had, ask questions and hear about next steps.

We are in the process of reviewing members’ feedback and finalising our response to submit to the ICO in mid-December. We will continue to keep you updated through emails and via our website.

If you would like to get in touch with us then please email [email protected].