Google real time bidding (RTB) categories share highly intimate consumer data: what US-based pharma clients should know

In a seemingly endless wave of General Data Protection Regulation (GDPR)-related lawsuits filed in the EU, one could have a massive effect on contextual and programmatic vendors who leverage Real Time Bidding (RTB) utilizing ad categories provided by Google and Internet Advertising Bureau (IAB). If Google is forced to change how it labels and shares ad categories, and many of the partners CMI/Compas works with are GDPR compliant, this could influence how contextual and programmatic partners can target users of their respective content networks.

With GDPR going into effect this past May (read more about GDPR in our backgrounder here), consumer privacy is to be protected within the EU – keeping consumer data strictly confidential. In a complaint originally filed in September by privacy browser Brave, additional documents from Google showing the ad categories third party vendors can leverage for contextual and programmatic targeting were added to the complaint.

A few examples include cancer, sexually transmitted diseases, mental health and political affiliations.

These data categories in Europe are considered special category personal data, which is the most sensitive type of personal data. Under GDPR a user would have to provide consent for this data to be used. According to TechCrunch, the original complaints argue that Internet users are unlikely to be aware such labels are being routinely stuck on them, let alone how widely their personal data is being shared with third parties participating in programmatic ad auctions that rely on scale as a core function.

These complaints are currently being reviewed by the UK’s Information Commissioner’s Office (ICO), Ireland’s Data Protection Commissioner (DPC) and now Polish anti-surveillance NGO, the Panoptykon Foundation — which has notified its local DPA of what it describes as “massive GDPR infringement.”  While still under review, these complaints could have a massive effect on how publishers leverage Google data to serve ads across their contextual networks.

We are continuing to monitor and will alert clients to any needs. Currently there is no immediate impact to our US-based clients’ business.