Brave browser report: 198 local UK councils' websites are using real-time bidding advertising, which is the subject of a number of data protection complaints
Brave has spent two years building a legal case against real-time bidding: it filed GDPR complaints against Google and others in the UK and Ireland in 2018, then handed the Irish regulator evidence alleging Google passes user data to advertisers via hidden webpages. The UK's ICO had already concluded in its own report that RTB undermines GDPR and fails to protect sensitive personal data.
The new move shifts that campaign from big tech platforms to the public sector: Brave's report finds 198 local UK council websites running RTB advertising, and data protection complaints are being filed over it. Public bodies sit under stricter GDPR accountability than commercial publishers, which makes them a softer target for the same argument Brave has been pressing against Google.
First-order effects
The 198 named councils now face active data protection complaints over their ad stacks, forcing each to either defend its use of RTB or strip behavioral advertising from public-facing services.
The adtech intermediaries supplying those council sites inherit the compliance exposure, since the complaints target the RTB mechanism rather than any single publisher.
Second-order effects
Other UK public-sector bodies running programmatic ads face pressure to audit their own suppliers before becoming the next complainants' targets, shrinking inventory for RTB across government web properties.
Regulators like the ICO, having already flagged RTB as unlawful in principle, gain a concrete public-sector test case that is harder to deprioritize than complaints against commercial giants.
Third-order effects
If the complaint pattern holds, behavioral advertising becomes untenable on government websites first, establishing a public-sector baseline of consent-based or contextual ads that could later be cited against commercial publishers.
Browser makers are emerging as de facto privacy enforcers, using GDPR complaint mechanisms to do what regulators have been slow to do — a structural shift in who drives adtech accountability.
The trend: Privacy-focused browser vendors are weaponizing GDPR complaints to push real-time bidding out of the web, starting with the most legally exposed publishers: public authorities.
New report from @Brave: people seeking help for addiction, disability, and poverty on council websites are profiled by private companies in the UK. https://brave.com/... https://twitter.com/...
@brave @BrendanEich @ICOnews @simcd @IanCLucas @RaviNa1k @jimkillock @mikarv @jason_kint @sloumarsh @OpenRightsGroup I found a small RTB company called “The Council Advertising Network”. It's a header bidding firm, sharing people's data from 34 council sites with 22 companies, ma…
“More than 400 local authorities allowed at least one third-party company to track individuals who visit their website. [Some included] sensitive sections of their sites, such as when people were seeking financial help or support for substance abuse.” https://www.theguardian.com/…
Excellent work @johnnyryan We really need to be looking at our consent for our data use in this way. Present arrangements unknown by the public. https://twitter.com/...
The Castle Doctrine should apply to all browsers. Also to emails, cars and other personal digital conveyances. http://blogs.harvard.edu/... https://twitter.com/...
A scary report from @johnnyryan and @brave on how private companies surveil people seeking help for addiction, poverty, and disability. Read the entire thread here: https://twitter.com/...
Data broker misled @Guardian about selling data to Cambridge Analytica, easily fact-checked by reviewing the outstanding creditors list from the SCL Elections Ltd liquidation filings on Companies House. Data brokers cannot be trusted. #TheGreatHack https://www.theguardian.com/ ..…