GDPR complaint against Google and IAB by privacy advocates claims that ad category lists enable mass broadcasting of intimate personal data
Male impotence, substance abuse, right-wing politics, left-wing politics, sexually transmitted diseases, cancer, mental health.
Context & Ripple Effects
This complaint lands weeks before GDPR enforcement begins, and it extends a pattern already visible in the coverage: an investigation had just found Facebook lacking privacy controls over inferred sensitive details used in ad targeting ahead of GDPR. Privacy advocates are now aiming at the plumbing rather than one platform — the standardized ad category lists that flow through real-time bidding to Google and the IAB's members.
The categories named in the description — sexual health, substance abuse, political leaning, cancer, mental health — are exactly the data types regulators would spend the following years circling: the UK's ICO later concluded the RTB industry undermines GDPR's protections for sensitive data in its 2019 report, and the EU found the IAB's own consent framework legally deficient in 2020.
First-order effects
- Google and the IAB become named respondents in a GDPR complaint that frames their shared category taxonomy as mass disclosure of intimate data, putting both under pressure from EU data protection authorities from day one of the regime.
- Advertisers and publishers using those standard category lists face immediate legal exposure, since every bid request carrying a sensitive label is arguably an unlawful data transfer under the new law.
Second-order effects
- The IAB's response path is already foreshadowed by the corpus: it built a consent framework adopted by Google and others, which the EU authority later ruled inadequate — meaning the industry's self-regulatory fix became its own liability.
- Google's product countermove shows up years later in expanded user controls over sensitive ad categories across its Display network dating, parenting, weight loss and more — a defensive concession that concedes the categories exist while limiting their visibility.
Third-order effects
- If the pattern holds, adtech's structural fix is not better consent banners but removing sensitive inference from the bid stream entirely — yet the 2025 finding that Google's DV360 still allows Americans' sensitive-data targeting despite its own rules suggests enforcement, not policy, remains the binding constraint.
- The longer trajectory points toward ad targeting splitting into a compliant tier with coarse, non-sensitive categories and a gray market operating outside GDPR's reach, with regulators forced toward systemic audits of RTB rather than case-by-case complaints.
The trend: Adtech is being pushed from self-defined category taxonomies toward regulator-enforced boundaries on sensitive data, with each complaint and audit narrowing what real-time bidding may lawfully carry.