14 November 2024
With the Christmas and new year sales seasons fast approaching, it’s vital that your organisation is aware of, and complies with, its legal obligations when it comes to targeted advertising.
Targeted advertising can dramatically improve the effectiveness of marketing campaigns and plays an ever-increasing role in today’s digital landscape. However, in recent years the European Data Protection Authorities have issued a number of fines for non-compliance with data protection laws in the context of targeted advertising, underscoring the importance of compliance in this regard.
In this article, we highlight the dangers associated with targeted advertising and explain how you can ensure compliance so that your ultimate focus can be on building a successful marketing campaign.
Targeted advertising has come under intense scrutiny in recent times due to heightened privacy concerns and a growing number of regulatory actions. The practice of behavioural analysis and targeted advertising is a marketing strategy where ads are directed towards specific audiences based on their traits, interests, and behaviours. Data is used to segment audiences and create personalised ads that are more likely to resonate with them. Failure to comply with data protection laws in relation to targeted advertising practices can result in significant penalties.
Several recent high-profile cases have shown a readiness on the part of the Data Protection Commission (“DPC”) and other data protection supervisory authorities to investigate and clamp down on non-compliant targeted advertising practices. Targeted advertising was central to the landmark case, C-252/21 Bundeskartellamt, where the European Court of Justice ruled against a major tech company and as a result imposed strict limitations on the personalised use of consumers’ personal data by social media platforms. This ruling emphasised the necessity for companies to obtain clear and informed consent from users for data processing activities such as targeted advertising.
The lawful bases primarily relied on for targeted advertising under the GDPR are consent and legitimate interests. When issuing a recent fine of €310 million against a major social media platform, the DPC noted that:
"The lawfulness of processing is a fundamental aspect of data protection law and the processing of personal data without an appropriate legal basis is a clear and serious violation of a data subject's fundamental right to data protection.”
Another key issue for targeted advertising is transparency, as organisations often do not provide clear and accessible information about how personal data is collected, used, and shared. This can lead to a lack of consumer trust and regulatory penalties. Recent cases highlight common mistakes that companies make in terms of compliance, including lack of valid and informed consent, misuse of legitimate interests and inadequate transparency.
Choosing the appropriate legal basis for targeted advertising, particularly between consent and legitimate interests, is crucial for ensuring compliance, although it can be a complex task.
Organisations should assess case-by-case which legal basis can be considered the most appropriate one before starting a campaign involving targeted advertising. If consent is the chosen one, organisations must ensure they have the permission from users to collect and use their personal data for targeted advertising.
Here are some key points to consider:
Legitimate interests can be relied on as a legal basis when the data processing is necessary for the purposes of the legitimate interests pursued by the data controller or a third party, provided these interests are not overridden by the data subject’s rights and freedoms.
One of the key requirements to be able to rely on legitimate interests as a legal basis is to demonstrate that the processing is justified and proportionate. This requires completing and documenting a thorough Legitimate Interest Assessment to ensure that the organisation’s interests do not override the rights and freedoms of the individuals.
Learn more about how to carry out a detailed Legitimate Interest Assessment here.
To understand more about how to select the most appropriate legal basis please check our Refresher on Legal Basis article.
At KPMG Law, we excel in helping clients navigate the complexities of targeted advertising. Our team of experts ensures that your advertising campaigns are compliant with data protection laws, allowing you to focus on your marketing strategy.
We offer:
If you have any queries related to targeted advertising, please do not hesitate to contact our team below. We would be delighted to hear from you.
