Google has once again had its wrists slapped by a European regulator - in this case, the data protection commissioner for Hamburg (acting on behalf of Germany as a whole). The demand is that users of the search engine giant (and its other owned services) should be asked for consent before any data captured on them is used for profiling. (For more on this story, go here)
Two major issue jump out of this ruling (which it is far from clear that Google will actually respond to and respect - part of the company’s current slew of legal challenges across Europe stem from an unwillingness to act on previous demands relating to search rankings). The first is that Hamburg is acting ahead of what current European Union legislation actually requires. Since the “Cookies Law” amended the Privacy and Electronic Communications Regulation, website users have had the right to refuse a cookie (or any other piece of information stored on their device). Consent to marketing in electronic channels was moved to an opt-in when PECR became law in 2002.
But profiling was not specifically considered either in PECR or the Data Protection Directive of 1998. As digital (and mobile) technologies have advanced, almost everything that drives services and marketing in those channels is based on some form of profiling, whether it is an A/B test of ad content or targeting to behavioural activity through to specific audience segmentation.
To catch up with this progress, the proposed Data Protection Regulation includes a requirement to opt-in to profiling (although exactly what falls under that definition remains unclear). One way or another, when the Regulation gets passed by the European Parliament - and make no mistake, it will get voted through in 2015 - consent may become essential. Even if Google has not acted on Germany’s demands, European website publishers and ad networks will have to deal with another layer or opt-in.
Which leads to the second issue from this ruling - how it will impact on digital business. For a service funded on advertising, like Google (as well as social networks and other search engines), the ability to profile audiences and deliver relevant advertising is critical. Take away insight into who each visitor is and how like others they are behaving and advertising will become even less targeted than the early days of commercial TV. Selection by day part, in-site channel or possibly region may be possible without being considered profiling, but the benefits would be limited.
That is likely to mean a lot of lobbying, protesting and even disobedience. Always assuming, that is, that gaining consent to profiling is considered an obstacle to digital business. But is that necessarily the case? Fears about the impact of the Cookies Law were massively over-exaggerated - the vast majority of consumers now simply click and carried on when served an opt-in. Who’s to say that, with a similar degree of education and marketing effort, the same business-as-usual experience might not also result?