Online Advertising is Broken & We Need a Plan to Fix It: Introducing CDT’s Future of Online Advertising Project

CDT Policy Fellow Cami Goray also contributed to this post.

The online advertising ecosystem is at an inflection point: too broken and politically contentious to continue in its current form, yet too important to publishers, small businesses, creators, campaigners, and other stakeholders to throw out altogether. The moment is ripe to imagine what a better system—one that respects privacy and that works for advertisers, publishers, the public, and our democracies—should look like, and how to get there. And CDT, in consultation with others, is working on a plan.

The current system clearly isn’t working for too many of its stakeholders:

• Around the world, civil society organizations, scholars, policymakers, businesses, and members of the public increasingly call surveillance-based targeting methods into question and call for their prohibition, notably highlighting how the ad system as a whole can be abused for anti-democratic ends;
  
• Advertisers’ reputations are threatened by fraudulent ‘made for advertising’ sites and by the risk of unintentionally funding extremist groups and bolstering disinformation;
  
• Publishers are suffering a loss of revenue and a similar lack of control over ad content;
  
• Content creators are fighting for a more equitable share of revenue streams;

• Last but certainly not least, internet users face a barrage of frustrations and potential rights violations, including ubiquitous tracking and surveillance, and unavoidable exposure to potentially distressing and manipulative ads, many targeted to children and other vulnerable audiences.

Ensuring that online advertising respects human rights, bolsters democracy, and enables legitimate commercial activity in a transparent and accountable way has never been more important. Doing so will require reconciling competing interests, recognizing aligned incentives, and resolving perceived tensions between core values like privacy, free expression, protection from discrimination, and market competition. To this end, CDT’s Privacy & Data team launched its Future of Online Advertising project with a Working Group call on October 10, bringing together experts from a range of backgrounds—notably the ad industry, academia, and civil society—and perspectives. (Watch the recording of CDT’s presentation on YouTube, or view the slides here).

CDT envisions a competitive online advertising ecosystem that respects human rights, supports independent media, enables the creation and availability of content—including from journalists and artists—and is accountable to its stakeholders, including the public, advertisers, publishers, and government regulators. This blog post provides an overview of CDT’s thoughts on the state of online ads today, as well as an initial roadmap for crafting both a blueprint of the future we want and an advocacy agenda that will get us there.

The Status Quo Has Got to Go

Until recently, the online advertising industry has thrived in a regulatory vacuum, with scant restrictions on either the collection and use of personal data for ad targeting or on ad content. Self-regulatory frameworks from industry groups and individual company policies have somewhat filled the gap at a normative level, but implementation and enforcement have been uneven. Moreover, such self-regulation fails to account for the more fundamental critique leveled by many scholars, activists, and policymakers in the US and the EU: that business models centered on commercial surveillance and data-driven discrimination are inherently at odds with fundamental human rights.

But all that is starting to change. Europe has been leading the charge with the General Data Protection Regulation (GDPR), Digital Services Act (DSA), and Digital Markets Act (DMA). The GDPR (approved in 2016, fully implemented in 2018) imposes a number of obligations on the processing of personal data. The DSA (approved in 2022, to be fully implemented by 2024) reinforces the GDPR and prohibits advertising based on profiling (as defined by GDPR) using sensitive data categories or targeted to minors. The DMA (approved in 2022, to be fully implemented by 2024) imposes specific obligations on designated gatekeeper companies, several of which relate to advertising. Finally, trilogue negotiations surrounding the Political Ads Regulation have resulted in a consensus text that reaffirms GDPR and DSA prohibitions on ad-targeting based on sensitive data categories, narrowly scopes “advertising” in a manner that respects free expression, and mandates the creation of an EU-wide repository of online political ads.

Many analysts conclude that prevalent ad-targeting methods—which use personal data without the data subject’s express permission as required by GDPR—and other forms of online manipulation are now illegal in the EU. Yet much of the ongoing litigation concerning GDPR enforcement centers on how data can be used to target ads, and CDT expects similar DSA and DMA litigation to follow once those laws are implemented.

Meta, which derives the overwhelming majority of its revenue from personalized ads, is at the center of many such disputes. An EU court ruled in July that the company could not target people on the basis of data it collects about them without first gaining their consent, and in August, Norway (an EEA country) banned targeted advertising for a 90-day period—or, to be more precise, it banned surveillance advertising targeted on the basis of data collected without consent. On October 31, the European Data Protection Board (EDPB) extended the ban to the entire European Economic Area (EEA) and made it permanent (Meta is appealing in both cases). Consequently, Meta changed its legal basis for processing EU user data from “legitimate business need” to “consent” and has now introduced subscription-supported options for Facebook and Instagram. TikTok also has plans to launch an ad-free subscription service, joining YouTube, Netflix, Hulu, and other over-the-top services in offering both subscriptions and ad-supported options in at least some parts of the world. 

Meanwhile, in the US, longstanding claims about anti-competitive behavior in the ad-tech industry are having their day in court. For example, the Department of Justice (DOJ) is suing Google for alleged abuse of its market position in several layers of the ad stack: After several acquisitions, Google now owns the ad exchange AdX, the publisher server Google Ad Manager, and two ad-buying tools, which the DOJ alleges has given it monopoly power that it is unlawfully leveraging to block others from competing, and to keep prices advertisers pay Google higher, and payments publishers receive from Google lower than they would be with competition.

Antitrust is a complicated area of law, and many such cases will hinge, at least in part, on how courts determine the scope of the relevant market for assessing the effects on competition in that market. What’s undeniable, though, is that some of the largest, wealthiest, most powerful companies on the planet are online advertising behemoths, and getting bigger every year: according to one accounting, together, Alphabet (Google), Amazon, and Meta control two-thirds of the global digital ad market—up from half in 2022. 

Public and political pressure continues to build for baseline privacy protections, as well. While the American Data Privacy and Protection Act (ADPPA), which CDT endorsed in 2022, still awaits reintroduction in the 118th Congress, a growing number of state privacy laws now place some restrictions on commercial data practices and provide users with additional control. The Federal Trade Commission (FTC) is poised to announce details of its forthcoming rulemaking on commercial surveillance, which we expect to impact advertising among other sectors of the economy (read pp. 20-25 of CDT’s comment responding to the FTC’s 2022 Advance Notice of Proposed Rulemaking on Commercial Surveillance, and Nathalie Maréchal’s comment, submitted while at Ranking Digital Rights, focused on surveillance advertising).

In addition to regulatory and public pressure, we also see changes coming to the technical infrastructure. Browsers, operating systems, and privacy-enhancing add-ons are increasingly providing protections against the online tracking that undergirds behavioral advertising. In response to the technical and policy changes, industry stakeholders are working on potentially more privacy-preserving technologies and technical standards. Done effectively, those techniques could enable some amount of measurement, attribution, targeting, and fraud mitigation without tracking individual users.

The Road Ahead

With this project, CDT aims to provide careful, nuanced analysis, and bring together key experts with diverse perspectives to identify win/win policy solutions on advertising that advance human rights and democracy. Further, this project will build on our existing body of work on advertising, notably our advocacy in the US and Europe and engagement with technical standards bodies. We also plan to convene quarterly CDT Working Group calls, and to publish blog posts, reports, and working papers about the challenges facing online advertising and new ways to confront them. Our initial work will focus on diagnosing the specific problems that plague online advertising and evaluating some of the new proposals on the table, before moving on to the even more challenging task of crafting a proactive policy agenda. We have our work cut out for us, and look forward to rolling up our sleeves in partnership with many fellow travelers.

If you’d like to learn more or partner with us, please email [email protected].