Included in this issue of Data & Privacy News: Google to phase out third-party cookies over the next two years; ICO launches consultation on draft direct marketing code of practice and more...

Google to phase out third-party cookies over the next two years

Google has confirmed that it will phase out third-party cookies over the next two years, in response to calls for greater privacy controls.

Third-party cookies, small text files that track users browsing habits across the web, have already been banned by Apple, Microsoft and Mozilla. 

Google and other websites will still be able to use their own first-party cookies to follow users.

Ireland's data protection authority, the Data Protection Commission, is currently investigating Google's online advertising business, as well as the practice of real-time bidding for online ads (an area which the UK ICO is also investigating, see below for further commentary on this).

ICO launches consultation on draft direct marketing code of practice

The ICO has launched a consultation on a draft direct marketing code of practice, which aims to help organisations and their direct marketing activities comply with GDPR, the Data Protection Act 2018 and the Privacy and Electronic communications Regulations 2003. 

The draft code of practice builds on the ICO's previous direct marketing guidance and take a practical life-cycle approach. 

The consultation closes on the 4 March 2020 with a final version of the code expected later in the year.

EU consumer groups urge data protection authorities to investigate breaches of GDPR by online ad-tech companies

EU consumer groups are urging their data protection authorities to open an investigation into systematic breaches of GDPR by online advertising tech companies following a report released by Norwegian consumer organisation, Forbrukerrådet

In the report, Forbrukerrådet provide evidence on how ad-tech companies collect personal data from mobile devices without a valid legal reason or consumer awareness. Advertising companies and marketeers then use this information to target consumers with personalised ads. 

Forbrukerrådet has filed several complaints against providers of dating and fertility apps and other online ad-tech companies, stating they had no valid legal reason to process and share the personal information they are receiving. 

US consumer and civil rights groups are calling for similar investigations by the Federal Trade Commission. The ICO are currently investigating these practices (see below for an update on this), however they have yet to issue any enforcement action in this area.

ICO blogs on investigation into the ad-tech industry

Simon McDougall, ICO Executive Director of Technology and Innovation, has published a blog on the ICO's adtech investigation, following a second Fact Finding Forum in November 2019 and a progress report in December 2019. 

Mr McDougall has said that two key organisations in the industry are starting to make the changes needed; the Internet Advertising Bureau has agreed a range of principles which align with the ICO's concerns and is developing its own guidance for organisations on data minimisation, data retention and security. Google will remove content categories, improve its process for auditing counterparties and start to phase out support for third-party cookies (see commentary above).

Though too early to speculate on the outcome of the investigation, Mr McDougall is urging organisations to engage with ad-tech industry reform to avoid possible regulatory action in the future.