We are still being targeted by ads, no matter the GDPR regulations and everything to "control what you see".
Under GDPR, you only need to have a "lawful basis" to process someone's data. Article 6.1 of the GDPR legislation explains that consent is one of the
six lawful bases - meaning that actually consent
isn't always required.
Processing personal data is generally prohibited, unless it is expressly allowed by law, or the data subject has consented to the processing. While being one of the more well-known legal bases for processing personal data, consent is only one of six bases mentioned in the General Data Protection Regulation (GDPR). The others are: contract, legal obligations, vital interests of the data subject, public interest and legitimate interest as stated in Article 6(1) GDPR.
https://gdpr-info.eu/issues/consent/The Information Commissioner's Office (UK) covers these five alternatives to consent. You can process personal data if it’s necessary for:
- A contract with the individual: for example, to supply goods or services they have requested, or to fulfil your obligations under an employment contract. This also includes steps taken at their request before entering into a contract.
- Compliance with a legal obligation: if you are required by UK or EU law to process the data for a particular purpose, you can.
- Vital interests: you can process personal data if it’s necessary to protect someone’s life. This could be the life of the data subject or someone else.
- A public task: if you need to process personal data to carry out your official functions or a task in the public interest – and you have a legal basis for the processing under UK law – you can. If you are a UK public authority, our view is that this is likely to give you a lawful basis for many if not all of your activities.
- Legitimate interests: you can process personal data without consent if you need to do so for a genuine and legitimate reason (including commercial benefit), unless this is outweighed by the individual’s rights and interests. Please note however that public authorities are restricted in their ability to use this basis.
https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/when-is-consent-appropriate/#when6These means that companies are
at first glance technically able to apply the legitimate interests basis under 'commercial benefit'.
However, the individual's rights and interests also come into account here. The Information Commissioner's Office adds:
You are also likely to need consent under e-privacy laws for many types of marketing calls and marketing messages, website cookies or other online tracking methods, or to install apps or other software on people’s devices. These rules are currently found in the Privacy and Electronic Communications Regulations 2003 (PECR). The EU is in the process of replacing the current e-privacy law (and therefore PECR) with a new e-privacy Regulation (ePR). However the new ePR is yet to be agreed. The existing PECR rules continue to apply until the ePR is finalised, but will apply the GDPR definition of consent.
So currently PECR/GDPR rules mean that you
do need consent for e-tracking practices.
... which brings us (finally) to how these companies are breaking the law: consent must be explicitly given.
From the GDPR legislation again (link above):
consent must be unambiguous, which means it requires either a statement or a clear affirmative act. Consent cannot be implied and must always be given through an opt-in, a declaration or an active motion, so that there is no misunderstanding that the data subject has consented to the particular processing.
Instead of 'opt in' many companies are treating consent as a failure to opt-out, which is a very different thing, and against both the spirit and the letter of the law. Particularly as this often results in nested consents, where permission is assumed by the company, they sell the data to their clients, you then in turn sell to their clients under the initial assumed permission.
I think the failure here is not in GDPR itself, but rather that compliance is not being policed effectively. Perhaps ePR, once finalised, will lead to greater compliance - although the ePR is
not expected to come into force until 2022.
How this will apply to the UK (which obviously is leaving the EU) is unclear; the general assumption is that alignment with the EU will continue, although obviously this may change.