Are privacy-enhancing technologies facing death by ePrivacy regulations?

Privacy-enhancing technologies: “death by ePrivacy”? PETs were on the agenda of the IAPP DPC24 in Brussels this week, but few talked about the dangers to PETs caused by evolving positions of regulators.

PETs (for ads with less data, content-focussed analytics, etc.) are being worked on by companies of all backgrounds and sizes and touted as less intrusive, even for some a solution to the PayorOK debate.

Yet the European Data Protection Board’s Guidelines on the technical scope of Article 5(3) of the ePrivacy Directive (ePD) are precisely of a nature to kill the utility of PETs. (The UK approach too – see below)

Why is this?

Because PETs are often built around technologies *other* than cookies and the like, they do not typically rely upon actual storage in computing terms. Server requests regarding interactions with content or advertising replace the storage of such information in a cookie or local storage. Surely that is less intrusive and should not require consent, right?

Wrong, according to the EDPB. Its interpretation of Art. 5(3) ePD covers not only computer storage but also computer memory, and also the user of information transmitted automatically by way of a communication over the Internet. So those PETs are (almost?) invariably covered.

Don’t believe me? Read my in-depth article about that here: https://lnkd.in/eDV4NSRX
(And no, nothing has changed in that respect in October 2024 – seehttps://lnkd.in/eVSWbbjG )

Surely that’s OK and we can anyway benefit from a consent exemption?

Wrong again. The EDPB has left consent exemptions untouched and non-harmonised, so we can only rely on diverging national approaches and an older position by the EDPB’s predecessor. Many authorities say that this means *technical delivery* of the service, and that you should only look at it *from the user’s perspective* (also explicitly said by the UK ICO).

Contextual ad solution providers, for instance, would do well to realise this. Possible exceptions in one country or another (e.g. Spain, France, Italy or Netherlands) for analytics (= performance of content) *are not interpreted* as covering also contextual ad selection, delivery or attribution. Even ad reporting is doubtful.

So maybe it is time for the EDPB to dare. If it wants PETs to stand a chance, it needs to propose a broader interpretation of the “service” consent exemption (read my op-ed on that here: https://lnkd.in/ezYeGSi4 ).

“But the EDPB doesn’t have the power to do so”. Is that right? Well, it believes it is competent to adopt guidelines on the scope of the law (though I disagree: https://lnkd.in/epba2Bam ) – so why should the interpretation of the service exemption be excluded?

Without such an approach, it’s PET death by ePrivacy. After all, if I need consent anyway, why bother with a PET instead of something that gives me better and more data?

GDPR data protection