Top five client concerns regarding the new ePrivacy rules for contextual ads

So consent will be needed for contextual ads? Why limit ourselves then?” Top 5 concerns and questions shared with me by various clients re new EDPB�ePrivacy�guidelines:
1. “Do they even understand the technology?”: Overbroad notion of “access” is regulatory activism at its worst, coupling active notion of “access” to passive receipt, conflating individual entering into a terminal with generic protocol-based instructions that are not specific to a given website/app/… but are built in to a computer before it is even fully operational. When�cookies�and the like were covered, that made sense technically; now, though, the scope is seen as excessive and not at all aligned with the legal text.

2. “What’s the point?”: Fear that the EDPB won’t care about any responses from businesses to the public consultation, because of 100% opposite view
[On that: if you include a disclaimer questioning their authority+ voice your content-related concerns, that can be a useful blueprint for defence in case of regulatory action against you. And we are helping companies submit comments through our intermediary to protect their identity while still allowing them to push back]

3. “What then doesn’t require consent?”: The exceptions to consent are still interpreted too restrictively and too inconsistently by authorities to be useful for businesses active in more than one EU Member State. Plus, that old WP29 document is contradicted by Member States’ positions today.

4. “Why go for less?”: If they are allowed to expand the scope and don’t provide new, broader guidance on exceptions, why would anyone use a less “invasive” technique, given that ultimately consent will nearly always be needed? For instance, contextual advertising would require consent. Why not do profile-based ads then?
[Basically, the EDPB’s guidance might not have the desired effect but perhaps even just the opposite]

5. “Bye bye legitimate interests under GDPR in digital world”: This one is about parallels between ePrivacy and the�GDPR. The broader the scope of ePrivacy, the more scenarios where both it and GDPR apply. Given the links between “consent” in ePrivacy and�data protection�+ the parallels between “necessity for a contract” (GDPR) and “strictly necessary for provision of an information society service” (ePrivacy), there are many scenarios where legal grounds will be aligned. If you then take point 3 above and think about GDPR compliance, there are fewer and fewer scenarios where consent will not be the outcome desired by authorities under ePrivacy… so bye bye legitimate interests as possible legal ground in many cases where personal data is concerned.

Still unsure what these guidelines mean for your business and whether/how to respond? Get in touch – and rapidly. Deadline for comments: 28 December 2023.

More in-depth analysis of these guidelines here:
– Part I: By what authority?�https://lnkd.in/ekdviZ_K
– Part II: Overbroad notions and regulator activism?�https://lnkd.in/eDV4NSRX