In a report, the ICO, UK's data protection regulator, says the real time bidding ad industry is undermining GDPR and failing to protect sensitive personal data
The online behavioural advertising industry is illegally profiling Internet users. — That's the damning assessment …
Context & Ripple Effects
This 2019 ICO report was the opening shot in a regulatory arc that has since run through the adtech industry: the UK regulator concluded that real-time bidding's mass broadcast of user profiles is structurally incompatible with GDPR consent and fails to safeguard sensitive categories like health and political affiliation. The finding landed just before Brave's report showing 198 UK council websites running RTB ads, which turned the complaint into a concrete compliance problem for public-sector bodies.
What followed validated the report's thesis rather than refuting it: an EU authority later found IAB Europe's consent framework — adopted by Google and others — legally deficient, and measurement work showed the scale of exposure, with Europeans' activity and location broadcast 376 times per day on average. The ICO's framing of RTB as systemic illegality, not a fixable bug, became the template regulators kept returning to.
First-order effects
- UK publishers and adtech intermediaries running RTB face direct legal exposure: the ICO has put them on notice that broadcasting sensitive personal data without valid consent is unlawful, making their current consent flows indefensible.
- Google and the IAB, whose frameworks the industry relies on for compliance cover, now have a national regulator formally asserting that the standard machinery does not meet GDPR standards.
Second-order effects
- Advertisers and brands buying programmatic inventory inherit reputational and legal risk by proxy, pressuring them to demand auditable consent chains from exchanges — shifting cost onto the RTB supply chain.
- Rival approaches that avoid broadcasting raw personal data gain a regulatory tailwind, as buyers look for targeting methods that do not depend on the practices the ICO flagged.
Third-order effects
- If enforcement follows the report's logic, behavioral advertising consolidates around players who can rebuild consent infrastructure at scale, while smaller adtech intermediaries exit — echoing the pattern where GDPR compliance costs concentrated the market.
- The report establishes the precedent that industry self-regulation cannot substitute for lawful basis, pointing toward sustained multi-regulator action against RTB rather than one-off fines.
The trend: Regulators are moving from critiquing individual adtech practices to treating real-time bidding's core architecture itself as incompatible with data protection law.