UK's Privacy International files complaints against Oracle, Acxiom, Criteo, Quantcast, Tapad, Equifax, and Experian over potential GDPR violations
Rebecca Hill / The Register :
Context & Ripple Effects
Privacy International built its name on state surveillance — after losing its UK challenge over bulk hacking powers it took that fight to the European Court of Human Rights (its earlier ECHR case). This complaint marks a pivot to the commercial side: seven data brokers and adtech players — Oracle, Acxiom, Criteo, Quantcast, Tapad, Equifax, Experian — accused of GDPR violations.
The filing lands two months after Brave's GDPR complaints against Google and others targeted the same behavioral-ad machinery, and it foreshadows what came next: the ICO's finding that real-time bidding undermines GDPR, and the €10B+ Oracle and Salesforce class actions over cookie consent.
First-order effects
- All seven named companies face potential investigations by UK and EU data protection authorities, with Equifax and Experian newly exposed on the advertising-data side rather than their traditional credit-reporting business.
Second-order effects
- Regulators already skeptical of adtech get a ready-made case file: the complaints hand the ICO and counterparts a template to probe the same consent practices across the wider broker ecosystem, raising legal costs industry-wide.
Third-order effects
- If the pattern holds — complaints to class actions to regulator reports — data brokerage shifts from an unexamined supply chain to one where lawful consent is a precondition, forcing consolidation around players who can afford compliance.
The trend: Civil-society GDPR complaints are becoming the primary lever for policing the data-broker economy, extending privacy enforcement from government surveillance into commercial profiling.