Recently issued regulator rulings on Google, ad tech companies and Facebook challenge prevailing online advertising practices of obtaining user consent under the EU’s General Data Protection Regulation (GDPR)

Rulings from France on Google and ad tech partners of media owners called them out for inadequate disclosure to users, and excessive merging and processing of data

In a landmark precedent for Germany, the Federal Cartel Office found that Facebook lacked “freely given” consent from users, calling its terms “exploitative” and an abuse of its dominant position, also harming competitors

Contents

Why consent matters

Managing consent in the publisher ad tech ecosystem

The Vectaury ruling

Facebook & Google: “walled gardens” as special cases

Google decision from France

Facebook decision from Germany

Conclusions

• The rulings are complements
• Did Google get off lightly?
• What’s the damage to Facebook’s core business?
• UK implications, and the risk for other platforms
• What’s in store in for publishers?

List of charts/tables

Figure 1. CMPs implementations used by the Guardian (above) and Mail Online

Figure 2. 2018 UK online ad spend by channel (£bn)

Figure 3. Appendix: Comparison of the relevant European privacy rulings