CNIL Imposed GDPR Consent Requirements On An Advertising Network Company

Author:Herzog Fox & Neeman
Profession:Herzog Fox & Neeman

The French Supervisory Authority for Data Protection ("CNIL") has issued a formal warning to the start-up company Vectaury, according to which the company has failed to meet the conditions for valid consent under the GDPR. Vectaury is an advertising network that buys online advertising space for its customers (advertisers) and offers them a tool that enables them to collect geolocation data on devices and browsers of users, and, in turn, processes, for profiling purposes and advertising targeting, geolocation data that it receives via real-time bidding offers, in order to allow the company to purchase advertising space.

CNIL ordered the company delete all data obtained on the basis of invalid consent, and noted that the entire industry should view this case as an example. CNIL has become very active lately in the field of behavioural advertising, as this is the second time within a few months that CNIL has issued a formal warning relating to this type of issue (see our related report here). In both cases, CNIL's enforcement action was focused on the advertiser and not on the publisher.

CNIL stated that Vectaury is unable to demonstrate that the data it collects through real time bid requests is subject to informed, free, specific and unambiguous consent. Although the company provided a short notice explaining that the application collects users' data for the purpose of targeted marketing, and offered users three options - to...

To continue reading