The UK’s ICO has issued a report on data protection in the adtech process of real time bidding (RTB).

RTB relies on the potential advertiser seeing information about you. That information can basic … but it can have a more detailed picture, including the websites you’ve visited, what your perceived interests are, even what health condition you’ve been searching for information about.

Key takeaways:

  • In RTB the privacy information provided to individuals often lacks clarity and does not give an appropriate picture of what happens to the data.
  • The creation and sharing of personal data profiles about people, on this scale, feels disproportionate, intrusive and unfair, particularly as people are often unaware it is happening.
  • One visit to a website … can result in a person’s personal data being seen by hundreds of organizations, in ways that suggest that changes need to be made in order to comply with GDPR /Privacy and Electronic Communications Regulations (PECR).
  • Consent is the most appropriate legal basis for RTB.
  • Organizations are legally required to perform Data Protection Impact Assessments (DPIA) for RTB.

Details from the UK ICO.