A07 - The Industry of Personal Data
„The project contributes to critical empirical studies as well as to the legal evaluation of the intransparent, complex and dynamically developing practices of sensing and sense-making in digital advertising.“
Executive Summary
Digital advertising is considered to be the most essential business model of the Internet. It is based on the expansive sensing of and algorithmic sense-making about users by means of social media platforms, search engines, and smart devices. Behavioral and sensor data are used to determine users’ wishes and interests as well as their personality traits. These are then used in programmatic advertising for the software-supported, automatic placement of personalized advertising. At the same time, tracking and targeting practices are becoming the subject of both public controversy and political regulatory efforts. Online advertising relies on a complex ecosystem of marketing technologies and actors. This subproject will examine these as constitutive of an industry of personal data. Terms such as “customer data platforms” (CDP), “data management platforms” (DMP), and “consent management platforms/providers” (CMP) refer to key intermediaries in the progressive collection, accumulation, integration, analysis, and operationalization of personal data. However, the contours of the personal data industry are blurred. Moreover, the role of data intermediaries has not been adequately explored from the perspective of media or legal studies. In view of the lack of transparency and the complexity of the personal data industry, it is important to ask which actors are involved with which business models, which data is collected, shared and traded and how, and how these practices should be evaluated from a legal point of view.
This is the starting point of the project, which is situated at the intersection of media studies and legal studies and examines the complex network of trade in personal data with a special focus on the role of sensor data. The project pursues two core objectives: Firstly, the project sets out to develop innovative methods to reconstruct and analyze the collection and circulation of data in the personal data industry. To achieve this, methodological approaches of digital methods, critical code, and software studies will be linked with legal instruments, such as the systematic inclusion of rights of access to information according to Art. 15 GDPR or information about marketing parameters according to Art. 26 DSA. Secondly, the project will explore the tension between personalized advertising, the underlying networks of trade in personal data, existing data protection law, and the envisaged development of a European data economy. For example, while the GDPR and the entire approach to European data/privacy protection deny industrialized trade in personal data, they contain loopholes for its far-reaching economic use. At the same time, the constant criticism directed at the GDPR is already leading to its containment by case law.
The project focuses on the networks and practices of programmatic advertising. We will examine which centers of calculation and circulation can be identified and how the actors involved negotiate the boundaries between identifiable personal data and anonymized target group data on a practical level. Following on from this, the study will address the jurisprudential question as to how far the networks and practices to be researched are compatible with data protection law, as well as how “stretchable” the GDPR and the ePrivacy Directive are. From the point of view of legal policy, the question also arises as to which consequences can be derived from this for future regulation that includes or will include laws for an emerging European data economy, such as the Data Act, the Data Governance Act, the AI Regulation (draft), and the Digital Services Act.
A07 explores how the boundaries between identifiable personal data and anonymized target group data are negotiated in digital advertising practices and evaluates their compatibility with data protection law.
Situated at the intersection of media studies and law, it investigates practices of tracking and targeting by data intermediaries that serve as infrastructural backbone of the digital advertising industry.
Focusing on the domain of programmatic advertising, A07 explores the tensions between personalized advertising, data protection law, and the goal of EU to establish a data economy. The project pursues two main objectives:
- Development of methods for analysis and monitoring of the industries of personal data
- Legal evaluation of the empirical findings
The interdisciplinary project develops inventive methods for empirical observation and critical analysis of the personal data industries through the combination of
- Digital methods, critical code and software studies with
- Legal instruments, such as the systematic inclusion of information requests according to Art. 15 GDPR or information about marketing parameters according to Art. 26 DSA
WP1 coordinates the interdisciplinary collaboration and synthesizes the empirical with the legal findings:
- Recontstructing distributed media and data practices in programmatic advertising
- Collaborative analysis and iterative refinement of the joint research approach
- Building a network of relevant stakeholders in online advertising and data protection
WP2 pursues two complementary case studies for mapping the industries of personal data:
- Large scale information requests (Art. 15 GDPR) to reconstruct how users are constituted and categorized as data subjects by DMPs, CMPs, CDPs, data brokers, and others
- Analysis of OpenRTB protocol and the TCF standard to reconstruct data flows in programmatic advertising
WP3 focuses on the legal evaluation of the empirical findings on the personal data industries. Central institutes of data protection law are questioned and further developed:
- Personal data in EU data protection and the European data economy
- Identity and Identifiability
- Problems of consent
- Liability and allocation of responsibility
Publications
Current