Addressing Online Advertising Transparency in the DSA and Beyond
Julian Jaursch / Dec 16, 2024The EU’s Digital Services Act (DSA) calls for voluntary codes of conduct for online advertising to be developed in 2025. These are meant to enhance transparency around online ads. Julian Jaursch, program lead at interface, a tech policy think tank, discusses the DSA ad codes and what needs to happen for them to be useful for consumers and also businesses. He is the author of a policy paper on the topic.
A $115 million settlement for privacy breaches. Categorizing people as “very poor” based on how fast they pay their bills. Unintentional exposure of secret military information. 215,000 metric tons of carbon emissions per month in just five countries. A lawsuit alleging anticompetitive behavior by the biggest market actor.
These incidents all serve to characterize an industry that forms the basis of the world’s online communication and information spaces: the online advertising industry. Billions of online ads are displayed every day, driven by transactions between advertisers, websites/apps and advertising technology companies connecting the two. Given this scale, a couple of lawsuits or privacy breaches might not seem that big of a deal. Yet, these issues point to the structural weaknesses of the online advertising industry. It is opaque and difficult to fully grasp, not just for consumers and regulators but even for the companies involved. This is what makes fraud easier, contributes to ads funding sensationalist, conspiracy, and discriminatory content, and, crucially, risks violations of people’s fundamental right to privacy, as few can truly follow (and thus have a say over) the flow of their personal data and profiles.
A patchwork of self-regulation and laws on online advertising in the EU
By now, the benefits and harms associated with online advertising are well documented. Researchers, practitioners, journalists, and advocates have pointed out potential harms to individuals and societies for years. Lawmakers in the EU, too, have clearly stated some risks associated with online advertising. However, a dedicated legal framework that comprehensively deals with these issues is missing. Instead, in addition to industry self-regulation, various laws from different fields touch upon parts of the online advertising industry.
Against this backdrop, there have been political discussions in the EU about the potential need to improve enforcement and/or establish new rules over the long term. For instance, the European Commission already had one study conducted on this topic, with another one on the way. The European Parliament explored the issue as well. Proposed new legislation might touch upon online advertising, too: A “Digital Fairness Act” is expected to address tracking, influencer marketing, and deceptive design practices, among other things. Taken together, it has become clear that enforcement and regulatory gaps persist. These gaps need to be addressed during the 2024-2029 EU legislative mandate.
What the DSA says about codes of conduct for online advertising
In addition to possible long-term reform efforts, there is a narrower, short-term opportunity to address some issues related to online advertising: the codes of conduct on this matter that the EU’s Digital Services Act (DSA) calls for, to be developed in early 2025. These voluntary codes are supposed to spell out some of the DSA’s transparency rules in greater detail across the entire online ad industry.
The ad industry, together with the European Commission and civil society groups, must develop these codes of conduct with a focus on transparency regarding ad labels, ad repositories (that is, databases collecting platforms’ ads), and how data is being monetized on online ad markets. This rather narrow approach is meant to tackle shortcomings in online advertising transparency and not some of the more structural issues around data protection or competition.
Opportunities and limits of the DSA ad codes
The major draw of this approach in the DSA is that the codes of conduct could expand existing rules. The codes could include ad tech companies that are not in the scope of the DSA; however, these companies – such as ad exchanges that play an intermediary role in serving online advertising – would not be bound by the DSA’s enforcement regime. This shows a major flaw of the DSA’s approach: The reliance on a voluntary self-/co-regulatory mechanism creates few incentives for compliance, as there are no direct sanction mechanisms. Moreover, the focus on transparency topics has limitations. While enhanced transparency is usually helpful, it might not always automatically support consumers, researchers, and regulators. They can be overwhelmed by a deluge of information and have little opportunity and capacity to act on it in some way, for instance, by changing what data is being used for advertising.
Despite these limitations, the DSA ad codes could bring about some improvements for consumers and businesses. This can only work, however, if the industry, Commission, and civil society agree on wide-ranging commitments around “data monetization.” This concept is explicitly mentioned as an element of a code of conduct, but it is not defined in the DSA. Only if it is interpreted broadly can the DSA ad codes lead to potential transparency improvements. In contrast, the potential benefits of dealing with ad labels and ad repositories through a DSA code of conduct are lower. There are better options to address weaknesses in these areas outside of DSA codes, for instance, related to the upcoming regulation on the transparency of political advertising.
Options to enhance transparency on online ad markets via codes of conduct
With a broad interpretation of data monetization, the groups developing the DSA ad codes could consider measures aimed at transparency in the ad market as a whole instead of only focusing on transparency for individual ads. This reflects that in a common programmatic advertising campaign, under current circumstances, all companies involved use data to make money. To provide some simplified examples, platforms, apps, and websites collect and use various types of data by tracking people’s online behavior and other data points, such as location data, to guess their interests and group them into profiles. Advertisers have data about target groups and seek accurate measurement data on their campaigns. During ad auctions, the entire real-time bidding process is based on the data provided by the supply and demand sides.
This expansion beyond a focus on individual ad transparency would be a crucial improvement DSA ad codes could provide. Some commitments the codes of conduct could encompass are expanded supply chain transparency, including by improving existing technical standards, know-your-business customer rules and for platforms, transparency around ad revenue sharing policies and enforcement.
It is not clear whether the Commission, ad industry, and civil society will be able to agree on a rather ambitious approach to data monetization transparency in the DSA ad codes. There are often contrasting interests between publishers, platforms, and advertisers, all of whom are strong lobbying powers in Brussels. Compromise could thus be difficult to find, and, more importantly, there is a risk that consumer interests will fall by the wayside.
The codes as a first step toward more substantive legislative action
If there is no agreement or just a rather basic or minimal understanding of data monetization, it must be questioned whether DSA advertising codes of conduct even have substantive benefits and should be pursued in the first place. It is simply not useful to develop codes for the sake of developing codes. In fact, it would be wasteful, considering the limited resources and staff among stakeholders. Instead, lawmakers could focus more immediately on improving enforcement of existing laws and potentially considering new laws. Especially with the first evaluation of the DSA coming up and a view to a potential Digital Fairness Act or even a stand-alone online ads bill, there are obvious opportunities to consider enforcement and legislative action beyond transparency-focused codes of conduct.
For example, stronger enforcement of the EU’s data protection law should be considered (including fines, if necessary) regarding data minimization and purpose limitation or to address data brokers. Stronger purpose limitations regarding the sale or monetization of data used for online advertising could be discussed. The DSA’s prohibition for platforms to use certain types of data for advertising is also important, arguably more so than the ad label requirements. This restriction addresses online advertising at a more fundamental level, that is, the use of data for tracking purposes, rather than only making this data use transparent. The provision should be enforced strongly right away and an expansion beyond online platforms could be considered in the future.
Ideally, the development of DSA ad codes offers an interdisciplinary setting to critically reflect how codes of conduct, stronger enforcement of laws and new regulation might or might not help to address some of the ills plaguing online ad markets. Codes of conduct by themselves cannot fix the ad tech landscape or gloss over the weaknesses of the DSA, but if understood as a valuable exchange forum, they could be a step towards improving both the ad tech system and platform regulation in the EU.
Related Reading
Authors
