As the ICO returns to RTB, are you ready?

There was a time - pre-pandemic - when the ICO’s investigation into ad tech and real-time bidding was THE topic of conversation in our industry. Articles dissecting what the ICO’s ‘Update report’ meant for real-time bidding abounded, while the ICO’s Simon McDougall and his colleagues were regulars on the industry events circuit, getting its messages out to the masses. At the IAB, the ICO’s report resulted in the creation of a six-part action plan to address the key concerns raised by the regulator. Our message was clear: for those involved in ad tech or RTB in any way, educate yourself, review your processes and, if necessary, take action. 

Fast-forward a year and that hasn’t changed. In fact, the urgency to act and, excuse the cliche, get your house in order, has never been greater. When the ICO paused further investigation into ad tech and RTB in May 2020, some industry commentators speculated about whether it was letting ad tech off the hook. The answer was, and is, an emphatic ‘no’. While the ICO’s ongoing investigation was temporarily suspended, our commitment to deliver on the actions already agreed has continued largely as planned, despite the impact of the pandemic. 

Now it’s back to business for the ICO’s RTB work. The regulator will shortly begin issuing assessment notices and initiating a number of audits, starting with data management platforms - although it has made clear that DMPs will not be the sole focus of these audits. Speaking at our member briefing, the ICO’s Director of Regulatory Assurance, Anulka Clarke, said that while the regulator realises it will not be able to audit every company in the RTB space, it will be prioritising based on risk. So what should the industry expect next? 

Key areas of focus for the audits will include the issues the ICO identified in its initial ‘Update report’: cookies, special category data, transparency and fairness, data controllership and data sharing within the ecosystem. Over the past year, we at IAB UK have been working with our members to develop guidance in response to these concerns that is designed to help you ensure you are complying with your legal obligations in practice, including guides relating to cookies and consent, special category data, data protection impact assessments and legitimate interest assessments. The ICO also has a wide range of resources that you can draw on, available here. Essentially, making sure you are up-to-speed with this guidance and making any necessary changes to your current practices is crucial. Planned future changes to cookies and User ID practices do not alter that. 

While the prospect of an audit is inevitably a daunting one, Clarke made clear at our event that the ICO is not setting out with the aim to punish or penalise - rather, its objective is compliance and minimising the risks to individuals. This means that, typically, if an audit identifies compliance issues, the ICO is likely to make recommendations to the organisation in question, so that it can implement the necessary changes to rectify the issue - although the ICO does, of course, have enforcement powers it can use if that becomes necessary. Ensuring that your company’s practices are up to scratch now can only be a benefit - to both you and your users. 

And what if you're not audited? Does that mean you can continue as usual? Only if you’re certain that you can demonstrate that you are already complying with the law and current industry best practice. Even if your organisation is not audited directly, the ICO will be publishing over-arching findings from its audits at an industry-wide level to drive change more widely and call out bad practice - although we don’t expect to hear much more until the process is complete as the regulator won’t be commenting on live work. 

For the industry as a whole, this is a reminder that the ICO’s concerns remain, and its close scrutiny will continue. It’s therefore an opportune time to review how you are using personal data and ensure that any necessary changes are made without the need for further regulatory action. Ad tech is fundamental to the sustainability of the ad-funded, open internet and the outcome of this process will shape the future of RTB - a technology that underpins our robust and diverse digital economy. It’s in all of our hands to make the most of this opportunity and drive change from within. My message is simple: if you haven’t already, act now.