With the EU elections in May 2024 fast approaching, policymakers in Brussels are scrambling to close open files, plan their next move and set the groundwork for the upcoming mandate. At this stage of the legislative cycle, the European Commission assigns external studies that provide significant indicators of its future areas of interest.

Online advertising seems to have caught the regulators’ attention in the digital domain. The appetite to regulate this sector became evident during negotiations on the Digital Markets Act and Digital Services Act, when a coalition of left-to-center EU lawmakers tried to push a total ban on targeted ads.

While this ambition was only partially satisfied in the two landmark regulations, the idea that the advertising technology sector would benefit from reform seems to have stuck. That is particularly the case as the ePrivacy Regulation, meant to become the new EU “cookie law,” is bogged in a legislative conundrum concerning data retention.

If no way out of the stalemate is found before the end of this mandate, the European Commission might withdraw the draft law altogether and propose something new. In this regard, a recent study commissioned from legal agency AWO by the EU executive’s digital department provides some precious insights into what might come next.

Although it does not reflect the views of the commission directly, the report makes “a strong case to reform digital advertising” and indicates “the status quo is unsustainable for individuals, publishers and advertisers.”

State of play

Digital advertising economically helps a large part of the internet remain freely accessible. In turn, online ads have grown to the point they generate more revenue than all other advertising channels combined.

However, while online platforms have seen their advertising revenues grow by two digits in the past decade, authors stress the combined publishers’ revenues have stagnated.

At the same time, the market share of the so-called "Google-Meta duopoly" recently eroded, as more Big Tech companies entered the market together with increasingly specialized adtech companies.

Google estimates advertisers use three different buying platforms on average, while publishers sell their media space to six different online ad marketplaces.

However, according to AWO’s study, Big Tech companies and adtech intermediaries manage to capture the lion’s share of the online ad revenues due to a mix of extensive tracking, the opaque nature of the advertising ecosystem and a growing imbalance in bargaining power.

Personal data

“We know digital advertising is at a crossroads and change is needed to maintain consumers’ trust. We are building new technologies, like Chrome and Android’s Privacy Sandbox, to meet people’s increasing expectations for privacy online,” said Dan Taylor, Google’s Vice President for Global Ads.

The authors underline that advertisers and publishers believe this use of personal data increases revenues. Still, they cannot assess the effectiveness of more privacy-friendly solutions like contextual advertising.

Advocacy for contextual advertising is nothing new. In 2021, the Greens/EFA political group in the European Parliament published a study reaching similar conclusions that counted among the interviewees representatives from AWO and several publishers involved in the AWO study.

However, here the agency goes one step forward, arguing the lack of transparency in the broader industry limits the emergence of alternative solutions.

Transparency

The picture is further complicated by the wide range of intermediaries that work with advertisers and publishers to buy and sell advertising through different channels.

The supply chain complexity of the online advertising sector is a long-standing grievance. In 2020, the Incorporated Society of British Advertisers commissioned consulting firm PwC to conduct a study determining it was impossible to say where 15% of ad spending went.

“Individuals’ lack of control over their personal data contributes to how the current model works: the less control individuals have, the more tracking can be done, and the more value can be derived by digital advertising services providers — including large platforms,” AWO Senior Policy Associate Nick Botton said.

Power relations

The study connects the obscurity of the adtech system to the growing market power of Big Tech companies and other intermediaries, which have both profound insights into people’s online behavior and the ability to limit the capacity of publishers and advertisers to interact with their user base.

“The adtech market is dominated by the duopoly of Google and Facebook, who have not only abused their market power but given birth to polarising content-recommender algorithms, intrusive tracking and aggressive microtargeting,” said Member of European Parliament Paul Tang.

In describing the advertising ecosystem, AWO reports publishers and advertisers feel a sense of dependency on large online platforms, which is also due to their capacity to capture user data.

“Data processing within the same context is often in line with user expectations while the unbridled tracking and profiling across the vast web and app ecosystem, sometimes controlled by the same company, not only violates those expectations but is the source of market power for a few key gatekeepers,” said Jason Kint, CEO of Digital Content Next, an association of media outlets.

User control

The European Commission’s external study notes users have little control over how their data is used for digital advertising, since existing ad preference tools are considered difficult to access, understand and use.

At the same time, research suggests dark patterns have become a common practice for collecting users’ consent to process their data since the implementation of the EU General Data Protection Regulation. The European Commission is already discussing the regulation of these manipulative techniques, as they prepare the groundwork for what some policymakers have already dubbed the Digital Fairness Act.

At the same time, it is unclear what phasing out third-party cookies would entail for the market structure. For instance, the U.K.’s Competition and Market Authority estimated a 70% drop in publishers’ revenues.

Notably, AWO criticizes the consent legal basis for falling short of allowing individuals to control their data and the ads they see. Consent has been one of the predominant legal bases for processing personal data since the GDPR, pushed by several EU data protection authorities and confirmed in recent legislative deliberations.

Regulatory framework

AWO indicates gaps in the current regulatory framework enable many of the issues highlighted to persist. These legislative layers have proven complex to combine and enforce uniformly.

“Time and time again, we have seen that adding more safeguards around use of targeted ads may not be successful as the industry seems to be finding ways to evade those or come up with alternatives that bypass them,” said Estelle Massé, CIPP/E, global data protection lead and Europe legislative manager at Access Now.

The Digital Services Act introduces transparency obligations for digital advertising. Online platforms must provide recipients with essential information, like the parameters used to target the ad and who is paying for it, while larger platforms must maintain a public ad repository.

Still, for the report, these provisions will not shed light on how intermediaries process personal data for advertising purposes.

On the competition side of things, the Digital Markets Act requires Big Tech companies to provide advertisers and publishers with the tools to verify the performance of their ads, including aggregate and nonaggregate data.

Also, in this case, the study raises concerns about these measures not being enough to reverse what it considers unbalanced power relations. In particular, the types of accessible data is criticized as too broad, and the absence of standardized data formats would prevent cross-platform comparisons.

Policy recommendations

The study makes several policy recommendations. For instance, creating a single online interface where individuals can indicate their preferences regarding data collection and targeting across different websites was put forth to increase people’s control over their data.

Enrico Girotto, head of policy at the Federation of European Data and Marketing, noted centralizing consent functionalities at the web browser level was already heatedly debated within the ePrivacy Regulation. However, he believes it might come back through the back door.

Moreover, AWO proposed three possible solutions to rebalance the market: allowing advertisers and publishers to rely on legitimate interest as a legal basis for processing personal data, banning gatekeepers from relying on consent for ads and possibly from profiling linked-to ads altogether, and limiting digital advertising intermediaries to data controllers.

Ruth Boardman, a partner at the law firm Bird & Bird, considers these proposals radical. In particular, while she recognizes the problem of adtech intermediaries making independent use of personal data, she believes the suggested solution is problematic.

“It risks a return to the approach of some years ago, when intermediaries often positioned themselves as processors, pushing compliance responsibility onto (often smaller) publishers or advertisers,” Boardman said.

Whichever direction the next European Commission takes, there seems to be little doubt that the online advertising sector is set to change, be it for regulatory compliance or technological development like integrated artificial intelligence.

“Everybody in the market knows that the current system is not sustainable, but also that the transition to a new approach might be very painful,” said Matthias Horn, a lawyer at medical technology company Ottobock, who previously worked at European media group Axel Springer.

“Maybe we are already at the end of an era in digital advertising,” he said.