The substance of this story is that Tanya O’Carroll settled out of court with Meta with the result that she will no longer be profiled for targeted advertising. As an out-of-court settlement it doesn’t create a binding precedent, something that Meta has been very keen to point out. What can get lost in that nuance, though, are the implications behind the ICO’s support for Ms O’Carroll’s case. The critical point is that the ICO has confirmed unequivocally that targeted advertising constitutes direct marketing.

People have the right to object to their personal information being used for direct marketing, and we have been clear that online targeted advertising should be considered as direct marketing.

Article 21 and the right to opt out

Why does this matter? It comes down to the wording of Article 21 of the GDPR. That article grants a conditional right to opt out of processing which is being performed on the basis of the controller’s legitimate interest. Conditional because the controller is given the opportunity to argue their case, based on their Legitimate Interest Assessment, for their interests outweighing the data subject’s rights and freedoms. Indeed, this argument has been precisely what Meta and others have been deploying to push back against opt-out requests.

However, Article 21 provides an unconditional right to opt out of processing performed for the purposes of direct marketing, and the processing covered by this right includes “profiling to the extent that it is related to such direct marketing”.

2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

The consequences of categorising targeted advertising as direct marketing are profound and far-reaching. Firstly, and most obviously, it is a problem for the internet advertising industry – not just Meta, Tiktok, Alphabet and Snap, but also the ad exchanges, brokers and agencies that constitute their ecosystem. Should people opt out in numbers, especially if this interpretation of direct marketing is adopted by EU regulators, much of their revenue will dry up. I will talk to possible options for this industry later in this piece, but none of their available routes seem to me likely to be as lucrative as the present situation.

Wider consequences

However, the ecosystem also includes businesses such as Experian which, in addition to their operations as a credit referencing agency, also sell so called “data enrichment” allowing businesses to deepen their understanding of a prospect. This data is used by, among others, advertisers, platforms marketing eyeballs to advertisers, and – an example which may surprise some – charities researching possible benefactors. What Experian and their peers do is plainly “profiling”, and where it is done for the purposes I list here, it is clearly “related to  […] direct marketing”. So it too will have to permit opting out.

Then there is the question of the core algorithms in the social media platforms. Clearly these are also profiling – their function is to build an understanding of your individual likes and dislikes in order to feed you content that will hold your attention. But the business model of the platforms is to sell that attention to advertisers to perform targeted advertising – they are not selling you anything directly. So is not the algorithm also profiling related to direct marketing? Whether users would wish to opt out of feed personalisation is a separate question, but it seems to me that the right to do so follows from this ICO position.

We have also to consider the recommendation engines in e-commerce: Amazon Marketplace, eBay, Temu and the rest. These too are profiling, and the sponsored content, presentation order in search and so forth that they present to users are direct marketing. As, to bring this list to a close, are the ads and sponsored content in internet search; this interpretation also brings Alphabet and Microsoft into the frame.

Options for advertisers

What can the platforms and the advertising ecosystem do? Some things are ruled out. The EDPB was clear in 2021 that contract cannot be a basis for such processing.

Finally, the EDPB is of the opinion that the processing of personal data described in the Example 1 cannot be justified on the basis of Article 6(1)(b) by neither the social platform nor the targeter.

The same guidance sets out clear rules and requirements around consent, and as we all know consent has it own inherent limitations both with obtaining it and then with the inalienable right to withdraw it at any time with immediate effect. I should think consent will nonetheless be tried.

They may, as the press has suggested, try subscription models, but YouTube Premium has not been a conspicuous success and such models (as newspapers are finding) preclude occasional consumption, which reduces ad revenue further. They also make it far less likely that under-18s will have access, since they often lack the payment cards needed to subscribe; we may of course see this as a virtuous consequence.

What’s left? A return to the past – untargeted “banner” advertising based on subjective assessment of content backed by user surveys, like television and newspaper ads before the internet era? Perhaps, but there is an ocean of content where once there was a pond; fishing in it will be much harder. “Pay to play” where you agree to be profiled and see ads in return for content access? Surely, but this is just consent relabelled and has all of its drawbacks. Further growth in the value of influencers, affiliates and other content creators who can verifiably attract an identifiable audience? This seems to me the most likely outcome.

None of this helps search providers or data brokers; for them I suspect the golden age may simply be over. Which may mean that paid search becomes a reality, although whether that will be subscription, microtransaction or some other exchange of value I know not.

Will it matter?

The big if, of course, is whether consumers care enough to opt out en masse - on their own, or supported and encouraged by campaigners. And if they do not, whether regulators or governments are moved to do it for them. With the present furore over the UK’s Digital Services Tax, perhaps about to be ditched, and the degree of influence that data-intensive tech firms seem to have in the White House at the moment, I would be disinclined to bet on the latter.