• 

Online Behavioural Advertising Restrictions.

Online Behavioural Advertising Restrictions 

Online Behavioural Advertising (OBA) refers to targeted advertising that tracks a user’s online activities—websites visited, searches, purchases, clicks—to deliver personalized ads. While effective for marketers, it raises privacy, data protection, and consumer rights concerns, prompting regulatory restrictions globally.

1. Legal and Regulatory Framework

(A) Global Regulations

1. European Union – GDPR & ePrivacy Directive
   • Requires informed consent for tracking cookies and personal data processing
   • Users must have the right to opt-out of behavioural advertising
2. United States – FTC Guidelines
   • Focus on transparency, user choice, and data minimization
   • “Do Not Track” signals, privacy policies, and behavioral targeting disclosures
3. United Kingdom – PECR & ICO Guidance
   • Restricts tracking via cookies without consent
   • Requires clear notice for profiling and targeted ads
4. India – Data Protection Framework (Draft Personal Data Protection Act)
   • Proposes explicit consent for profiling and targeted advertising
5. Canada – PIPEDA
   • Protects personal information; consent is required for online tracking and targeted ads

2. Key Principles in Behavioural Advertising Restrictions

3. Compliance Requirements for Advertisers

1. Cookie Banners & Consent Management
   • Obtain explicit consent before setting cookies or trackers
2. Privacy Policies
   • Must clearly explain data collection, profiling, and ad targeting
3. Data Anonymization
   • Use aggregated or pseudonymized data when possible
4. Third-Party Data Sharing
   • Must disclose sharing with ad networks or analytics providers
5. Regulatory Reporting
   • Maintain records of consent and profiling activities

4. Key Case Laws and Enforcement Actions

(1) Google Spain SL v. Agencia Española de Protección de Datos (AEPD) & Mario Costeja González (2014)

• Introduced “Right to be Forgotten” under GDPR
• Users can request deletion of personal data used for targeted ads

(2) Facebook Ireland Ltd. v. Belgian Privacy Commission (2020)

• Belgian regulators fined Facebook for tracking users without proper consent
• Reinforced GDPR requirements for online behavioural advertising

(3) Schrems II Case (Data Protection Commissioner v. Facebook Ireland) (2020)

• Invalidated EU-US Privacy Shield
• Highlighted cross-border data transfer restrictions affecting targeted advertising

(4) FTC v. Snapchat, Inc. (2014)

• Snapchat settled FTC allegations of misleading privacy claims about data sharing
• Emphasized requirement for truthful disclosures in behavioural advertising

(5) UK ICO v. DeepMind/Google (2017)

• Sharing of health-related data for behavioural analysis deemed non-compliant with PECR
• Reinforced need for explicit consent when using sensitive data for ad targeting

(6) CNIL v. Google (2019)

• French regulators fined Google €50 million
• Failure to provide transparent information and consent mechanism for ads

(7) Belgian Privacy Commission v. IAB Europe (2021)

• Challenges against industry-standard cookie consent frameworks
• Court highlighted inadequate consent under GDPR for programmatic ads

5. Challenges in Enforcement

• Programmatic Advertising Complexity
  • Multiple intermediaries complicate consent tracking
• Cross-Border Data Flows
  • Data processed in multiple jurisdictions, conflicting privacy laws
• User Awareness
  • Users often unaware of tracking and profiling
• Emerging Technologies
  • AI-driven personalization and predictive analytics raise new compliance concerns

6. Best Practices for Compliance

1. Implement consent management platforms (CMPs)
2. Use privacy-by-design principles for ad targeting
3. Conduct Data Protection Impact Assessments (DPIAs)
4. Provide clear opt-in and opt-out mechanisms
5. Limit tracking cookies to essential or consented purposes
6. Regularly audit third-party advertising vendors

7. Conclusion

Restrictions on online behavioural advertising are designed to protect privacy, ensure informed consent, and prevent misuse of personal data. Courts and regulators globally, especially under GDPR, PECR, and FTC guidelines, have established that non-compliance can lead to significant fines and reputational damage.

RELATED Blog

Corporate Law at Afghanistan

Corporate Law at Albania

Corporate Law at Algeria

Corporate Law at American Samoa (US)

Corporate Law at Bangladesh

Corporate Law at Andorra

Corporate Law at Angola

Corporate Law at Antigua and Barbuda

Corporate Law at Anguilla (BOT)

Corporate Law at Argentina