Thread by @johnnyryan

Data Protection Authority investigation of our complaints finds that the IAB Transparency and Consent Framework infringes the GDPR.
iccl.ie/human-rights/i…

Press statement iccl.ie/news/gdpr-watc…

Relevant thread...

https://twitter.com/johnnyryan/status/1163895721625608196?s=20

A big thank you to all of the RTB complainants for helping to get to this step.
@jimkillock @szymielewicz @gemmagaldon @bitsoffreedom @mikarv @LibertiesEU @Jausl00s @liguedh_be. Most particularly, thanks to @RaviNa1k.

I have left many out (for example, @PiDewitte). 22 complainants in 16 countries are involved in this.

The APD Inspectorate Service agreed with our complaints, and concluded that the IAB "TCF" allows companies to swap sensitive data about people even when this is not authorised. It says IAB Europe "neglects the risks that would impact on the rights and freedoms of data subjects”.

In addition, “The TCF does not provide adequate rules for the processing of special categories of personal data. However, the OpenRTB standard, framed by IAB Europe’s TCF, does allow the processing of special categories of personal data".

See this thread for a reminder of just how intimate RTB data can be. Example: LGBTQ+ people were profiled by a data broker using RTB data to influence a national election.

https://twitter.com/johnnyryan/status/1307942003636948993?s=20

The APD Inspectorate Service also said “the Inspection Service believes that IAB Europe is trying to avoid its liability to the GDPR, constituting an aggravating circumstance”. #IABTCF #TCF #GDPR

It also found that IAB Europe had failed in the most basic aspects of GDPR compliance.

It reports that the privacy policy on IAB Europe's website is not compliant. (I filed a formal complaint about that in 2019 brave.com/iab-cookie-wal…)

In addition, the APD found that IAB Europe failed in other basic GDPR compliance measures. Nor did it appoint a data protection officer, or maintain a registry of what it does with personal data, or have clearly defined controller/processor relationships with its own vendors.

This is significant for the IAB's attempt to market a variant of the TCF as a solution for the CCPA and CPRA.
@ashk4n @caprivacyorg

The IAB "Framework" is used by Google and others to paint a thin legal veneer over the vast data breach at the heart of the behavioural advertising system. Now, the APD-GBA is peeling this veneer off.

This is good news for publishers, which have had their audiences stollen from them for a decade, been subject to tracking based bot fraud, and subject to vast adtech taxes. Here's the view from a smart colleague working at the NYT.

https://twitter.com/robinberjon/status/1317104189596749824?s=20

For a 4 minute mini-documentary about RTB with the added bonus of my own crappy sound editing, watch this
vimeo.com/451973748