Technologies used in online advertising, and the way they are deployed, have the potential to be highly privacy intrusive and new digital initiatives by tech giants must address the risks that adtech poses and take account of data protection requirements from the outset, UK Information Commissioner Elizabeth Denham has said.

Since 2019, industry has developed several initiatives that seek to address the risks adtech poses and shift towards less intrusive tracking and profiling practices.

These include proposals from Google and other market participants to phase out the use of “third party cookies” and other forms of cross-site tracking and replace them with alternatives.

“The proposals from both Google and other market participants are not yet fully realised. There is a window of opportunity for proposal developers to reflect on genuinely applying a data protection by design approach,” Denham said in an opinion.

The Commissioner expects any proposal to not only engineer data protection requirements by default into the design of the initiative but also offer users the choice of receiving adverts without tracking, profiling or targeting based on personal data. These proposals from the tech giants must “be transparent about how and why personal data is processed across the ecosystem and who is responsible for that processing”. They must also address existing privacy risks and mitigate any new privacy risks that their proposal introduces.

“User choice, consent, control and accountability must be meaningful. First and foremost, they must be shaped around compliance with the law and consideration of individuals’ interests, rights and freedoms,” Denham said.

The tech giants are facing immense scrutiny around targeted online advertising, data privacy and spread of misinformation on their respective platforms.

According to Denham, the 2019 report acknowledged that there are many issues associated with adtech. This includes the market position of so-called ‘big tech’ firms, and the financial vulnerability of some online services (publishers).

One of the most significant is the proposal by Google known as the “Google Privacy Sandbox” (GPS). The GPS intends to replace the use of third-party cookies (TPCs) and other forms of cross-site tracking with alternative technologies for enabling targeted advertising (and the measurement of advertising).

However, the Commissioner reiterated that participants within the online advertising industry should not wait until proposals like the GPS reach a more stable point.

“The principles of data protection by design and by default already apply. Market participants should build these into any solution or technology they currently use to achieve their objectives. Those responsible for the processing activities must demonstrate accountability with the requirements of the law,” Denham elaborated.