Digital Fairness & Personalized Advertising: FEDMA calls for a holistic approach before moving to new legislation
Last week, the European Commission published its long-awaited report on the fitness check of EU consumer law on digital fairness. Aimed at assessing whether the current regulatory framework sufficiently addresses the challenges of a rapidly evolving digital environment, the report portrays a multifaceted picture with problematic practices unclearly tackled by existing rules, while stressing the need for a holistic approach and further assessments.
Among the practices analyzed in the report, personalized advertising leveraging consumers’ vulnerabilities seems lacking a clear regulatory framework. Even looking at the ban on personalized ads based on sensitive data under the Digital Services Act (DSA), the Fitness Check points out that it only applies to online platforms and it may not cover consumer data that could be broadly considered as sensitive in the B2C context, e.g. data regarding behaviors or mental states such as emotions, moods or thoughts, or data regarding negative events such as relationship problems, death of a family member, financial challenges or gambling problems.
More broadly, according to the Fitness Check, commercial personalization in the form of advertising, pricing, and recommender systems still raises significant concerns among consumers who find difficult to understand how their personal data is used, and how to opt-out of personalized content. The section on personalisation therefore concludes that an effective response would require further assessment under both consumer protection and data protection frameworks.
FEDMA agrees that online advertising that target consumers' vulnerabilities is an unethical practice which exploits individuals’ weaknesses, potentially harming their well-being and autonomy, but also undermining the advertising industry’s credibility and long-term sustainability. However, this does not mean that new rules are necessary.
First, the report itself concedes that manipulative or opaque personalization practices could entail a breach of several GDPR provisions. Indeed, companies should always consider the impact on data subjects when processing their personal data and adopt appropriate measures to mitigate risks to the rights and freedoms of the data subjects. Recital 75 of the GDPR also clarifies some situations where such risks may arise, including where the personal data processing could lead to financial loss, significant economic or social disadvantage or where personal data of vulnerable people is processed, etc. In other words, the types of vulnerabilities mentioned in the report seem to be covered by the GDPR.
Second, the Commission report itself points out that enforcement of existing rules is currently insufficient: consumer protection authorities lack resources, technical expertise, and monitoring tools to address the problematic practices identified in the Fitness Check. This is not only a case limited to consumer protection. Earlier this year, the Commission’s second report on the application of the GDPR raised similar concerns regarding the enforcement of data protection rules.
Third, the report rightfully calls for further assessment under both consumer protection and data protection frameworks. In this context, not only relevant provisions on online advertising under the DMA and DSA have just started applying, but the Commission also launched in July a tender for a study on online advertising. In line with the conclusions of the Fitness Check, the study will aim to map the main issues in the sector, identify possible regulatory gaps, and assess the impact of the DSA and DMA on the sector. Any Digital Fairness Act potentially (further) regulating online advertising should not be presented before the results of the forthcoming study come in.
In this context, FEDMA supports the Commission’s conclusion that further exploration of personalization issues is necessary, but a holistic approach is also mandatory. The complex regulatory framework applying to online advertising requires a combination of dialogue with stakeholders, enhanced enforcement and cooperation between different competent authorities, legal certainty and harmonization.
