What's the issue?
Online advertising fuels the internet, particularly the parts we don't have to pay for. Where those adverts are targeted, the system becomes complex and opaque to users who are not always aware of how their data is being used in such a fast-moving environment.
Targeted advertising has been the focus of data protection regulatory activity for some time. The UK's ICO has been looking at this since 2019, although activity has slightly stalled. The UK government is also considering this as part of its consultation on the future of the UK data protection regime.
There have been industry initiatives to tackle privacy issues in targeted advertising, most notably the IAB Europe's Transparency and Consent Framework, but that has run into trouble with the Belgian regulator and its future is uncertain. The European Data Protection Supervisor has argued for provisions in the draft EC Digital Services Act to be strengthened to ban advertising based on pervasive tracking, and called for a restriction on the categories of personal data which can be used for targeted advertising purposes. In particular, he says special categories of data or other data that can be used to exploit vulnerabilities should not be used to target ads.
Concerns do not just focus on targeted advertising though. Adverts which are harmful or misleading are also high on the regulatory agenda, whether or not they are targeted, although sometimes it is the way in which they are targeted which produces the potentially harmful effect, for example if they are targeted at children or other vulnerable groups.
As things stand, the UK regulates placement and content of online adverts largely through the CAP Code and consumer protection legislation. Compliance with the CAP Code is overseen by the Advertising Standards Authority, but the regime has been criticised as toothless given the ASA has relatively restricted powers based around 'naming and shaming' and banning offending ads.
What's the development?
The UK government is consulting on its Online Advertising Program which will review the regulatory framework of paid-for online advertising. The intention is to bring more businesses within scope and to create a more transparent, accountable and safer advertising market.
At the same time, it announced new duties to be included in the Online Safety Bill. These will require the largest social media platforms and search engines to take steps to prevent fraudulent paid-for adverts appearing on their services.
What does this mean for you?
Online platforms, advertisers (including agencies), a wide range of adtech intermediaries (including ad servers and demand and supply side intermediaries), publishers of online ads and internet served video-on-demand services are all currently within scope of the Online Advertising Program and should consider responding to the consultation which closes on 1 June 2022.
Those caught by the newly announced Online Safety Bill duties will need to keep a close eye on developments. As with much of the Online Safety Bill, precise requirements will be contained in a Code of Practice but the scope of the Bill has already moved away from focusing solely on user generated content, and may continue to widen on its route to enactment.
Read more
UK government consultation on reform of online advertising industry
The government consultation considers the current regulatory environment across the supply chain and whether more needs to be done to tackle harmful paid-for advertising (including paid-for influencer advertising), particularly by ad-funded platforms like Meta, Snap, Twitter and TikTok, and intermediaries including Google, TheTradeDesk and AppNexus.
Views are sought on three main approaches:
- Self-regulatory – this would be centred around the ASA's existing regulatory role in enforcing the CAP Code and the proposed ASA Online Platforms and Network Standards which are still in development.
- Self-regulatory + statutory regulator – the ASA would be supported by a new statutory regulator to provided additional and tougher enforcement options.
- Statutory – a new statutory regulator would issue Codes of Practice and would be responsible for regulation and enforcement, with a range of enforcement powers.
The consultation considers a wide range of harms, including to advertisers and industry, looking at brand safety concerns driven by placement of advertising next to inappropriate or harmful content. Harmful or misleading adverts such as those promoting negative body images, and adverts for illegal activities or products (eg prescription medicine and counterfeit products) could be subject to new rules. Influencers who breach rules on advertising transparency may face tougher penalties. Cryptojacking – using legitimate-looking adverts containing malware to allow unauthorised use of devices to mine cryptocurrency is another focus.
Some issues are outside the scope of the consultation including:
- Privacy issues – the ICO is looking separately at the use of adtech in targeting adverts to consumers through programmatic advertising
- Data policy – while use of data is relevant for targeting, data policy is covered under the separate consultation, 'Data: a new direction'
- User generated content (except where it is also paid-for content) – covered by the Online Safety Bill
- Political advertising – the government believes having political advertising vetted or censored would have a chilling effect on free speech.
- Competition issues – dealt with by the new pro-competition regime for digital markets.
The consultation closes on 1 June 2022.
New duties to tackle fraudulent online advertising to be added to Online Safety Bill
The government is adding a new legal duty to the Online Safety Bill. This will require the largest social media platforms and search engines to take steps to prevent fraudulent paid-for adverts appearing on their services.
The first version of the Bill only covered user-generated content. The new version brings paid-for adverts in scope, whether or not they are controlled by the platform or an advertising intermediary. Large social media platforms and search engines in scope will be required to put in place proportionate systems and processes to prevent (or minimise in the case of search engines) the publication and/or hosting of fraudulent advertising on their services. They will also be subject to takedown requirements once made aware of such adverts.
The detail of what will be required will be set out in a Code of Practice by Ofcom. The government suggests this could include making firms scan for scam adverts before uploading, using identity verification, and checking financial promotions are made only for FCA-authorised products, but until further detail is published, precise duties are unclear.
