The wrong question in the online advertising privacy debate

The online advertising policy debate is stuck in a loop. 

As the U.K. government sets out its thinking on the future of online advertising, and as the EU Digital Omnibus potentially reopens the EU General Data Protection Regulation and ePrivacy files, data protection authorities on both sides of the Channel seem to treat one distinction as settled: Personalized advertising bad, contextual advertising good. 

On one side, privacy advocates champion contextual advertising as the clean, risk-free alternative to tracking. On the other, publishers and platforms defend personalized advertising as fundamental to the open web. Both sides talk past each other, and both are wrong to frame it this way.

What is personalized and contextual advertising?

Personalized advertising targets users based on inferred or declared attributes: behavioral history, cross-site tracking, purchase data and look-alike modeling. It requires processing personal data. Contextual advertising works differently. It reads the content of the page being consumed and places ads based on the page's keywords and themes. In its purest form, it requires no knowledge of who the user is, only what they are reading, watching or consuming.

The privacy case for contextual is real. Pure contextual advertising can be implemented without cookies, device IDs or user profiles, making compliance with the GDPR and cookie rules simpler. Regulators have increasingly signaled to industry and consumers that contextual advertising can more readily satisfy compliance requirements.

The privacy case for personalization is narrower, but it is not empty. Where consent mechanisms function properly, users have genuine agency over their data, and transparency tools such as "Why am I seeing this ad?" are far more developed in the personalized ecosystem than in the contextual one. Other advantages often claimed for personalization, such as fewer irrelevant ads or more granular frequency capping, are real, but they are benefits to users as consumers and advertisers, not to privacy as such.

Neither is risk-free

The problem with treating contextual as the "privacy-safe" default is that it isn't. Contextual advertising can still involve processing IP addresses, approximate location and browser characteristics, reintroducing the personal data considerations it was supposed to avoid. This difference of degree matters: contextual processes less data and is less intrusive than behavioral targeting. But less is not none, and less data is not the same as "no regulatory question."

There is also an audience safety problem. Without user-level signals, advertisers cannot confirm that a particular demographic saw the ad. That may sound like an advertiser inconvenience, but eligibility restrictions attach to the person, not the page or their location, so a financial promotion or an age-restricted ad could reach people it should not. Contextual advertising displaces the risk rather than resolving it.

For some providers, contextual advertising can be a reasonable fallback: e-commerce, review sites, lifestyle news and specialist online forums can offer attractive context. But for certain other digital services, for example email, there is no context to target against; and for others, such as current affairs, there is often context that advertisers seek to avoid being placed adjacent to, such as war, famine, a pandemic, or a terrorist incident, even though demand for such journalistic content would be high. Pushing providers toward contextual would therefore cut ad revenue and threaten those services, even those that can support contextual advertising.

Personalized advertising has its own, more familiar problems with consent quality, sensitive information being inferred, and data maximization. These are serious failures. But they are failures of implementation and enforcement, not inherent properties of personalization as a technique. Fixing them requires better regulation of specific data practices, not a wholesale shift to a single advertising format.

The difficulty is that this debate creates an artificial divide which does not reflect how publishers and content providers operate in practice.

The real world runs on both

The commercial reality is more complicated than the advocacy framing suggests. No serious publisher or content provider runs purely contextual or purely personalized advertising. A typical programmatic auction combines contextual signals (page category, time of day, device type, publisher genre), user-level signals (consent-based first-party data, cohort membership), and environmental signals (geography, connection type). In practice, the clean conceptual distinction dissolves in every auction.

What a contextual-only world would cost publishers is contested and being straight about that is more persuasive than the headline figures either side prefers. The most cited independent study, by Acquisti and colleagues, found that the presence of a tracking cookie raised publisher revenue by only around 4%. Meanwhile, other studies put the loss from removing tracking far higher, ranging from roughly 6% to more than 50% depending on the method and market. 

The evidence does not justify the industry's gloomiest projections, but neither does it support the claim that tracking is worth nothing. And the loss, whatever its true size, does not fall evenly. The publishers best placed to command a contextual premium are the premium, brand-safe titles; those who depend most on addressable audiences are smaller regional outlets, niche content providers and independent titles. A shift to contextual advertising would hit them hardest, accelerating concentration among a handful of large players. This is not simply an industry argument. It is a public interest one. It is the citizens who lose out, deprived of genuine choice and plurality. 

Who the false dichotomy serves

The framing persists partly because it suits incentives on more than one side. Contextual-only vendors have a straightforward commercial reason to overstate the gap between the two approaches. Regulators find it convenient to work with clean distinctions that do not reflect how modern advertising actually works. And the advertising industry has its own reasons to defend the status quo. None of that settles who is right. It is a reason to look past the labels to what’s being done with the data.

None of this means the concerns around personalized advertising should be dismissed. But the correct response to poor consent practices in online advertising is to regulate and enforce consent practices in online advertising, not to mandate a format that carries its own unresolved risks and whose economic consequences fall disproportionately on the publishers and content creators who can least absorb them.

So, what is the right question?

The right question in online advertising privacy regulation is about the data practice, not the ad format. Which data is collected, for which purpose, under which legal basis, with which retention limits, shared with which parties, and subject to which user controls: these determine whether an advertising system respects privacy. Whether the resulting ad is labelled personalized or contextual is largely incidental.

That points towards tiered, risk-based standards rather than format mandates. At the high-risk end sit the practices that warrant the strictest controls or outright prohibition: profiling children or inferring and trading sensitive characteristics such as health or sexuality across sites without meaningful consent. At the lower-risk end sit first-party contextual signals or aggregated cohort data held under clear retention limits. A format doesn’t map onto that spectrum; a data practice does. 

The fair objection is that "just regulate the practice" has been promised before, and a sceptic is entitled to point to years of limited enforcement in online advertising. But the lesson of that record is that the standards need to be sharper and genuinely enforceable, not that we should regulate the format in their place. Until the debate makes that shift, it will keep mistaking the label for the substance.