Irish Council for Civil Liberties: data brokers collect and sell browsing data in greater detail than previously known, including on those in sensitive jobs
Campaigners warn proliferation of categories describing sensitive professions could leave users open to blackmail
Context & Ripple Effects
This warning extends a long-running concern that adtech and broker markets turn routine online activity into tradable profiles. Earlier coverage found UK health sites sharing sensitive user data with adtech firms and brokers, while the ICO said real-time bidding was failing to protect sensitive personal data.
The new focus on categories tied to sensitive occupations makes the issue less abstract: browsing-derived data can expose people to targeted coercion as well as ordinary advertising. It also sharpens the enforcement stakes around the European data protection supervisor's call to keep browsing history out of credit scoring.
First-order effects
- People in sensitive roles face greater exposure if detailed browsing-based professional categories can be bought and matched to them, creating a potential blackmail vector.
- Data brokers and the adtech systems supplying or using such profiles face intensified scrutiny from privacy campaigners and regulators over how sensitive inferences are collected, classified and sold.
Second-order effects
- Buyers of audience and risk data may have to reassess whether occupational or browsing-derived segments create compliance and reputational risk, particularly where the data could reveal sensitive circumstances.
- The finding adds pressure to resolve complaints over real-time bidding: ICCL has already challenged delays in investigating the ad industry's real-time bidding practices, making enforcement speed part of the market's uncertainty.
Third-order effects
- If regulators treat inferred occupation and browsing patterns as sensitive in practice, data markets may shift from broad behavioral segmentation toward tighter limits on profiling, resale and downstream access.
- The case illustrates a wider test of whether GDPR enforcement can constrain cross-border adtech data flows; persistent gaps between rules and enforcement would leave brokered profiling structurally resilient.
The trend: Detailed behavioral data is increasingly being judged by the harms its inferences enable, not merely by whether a dataset contains obvious identifiers.