As anticipated, the Commission published its Regulation repealing and replacing the ePrivacy Directive on 11 January, alongside a communication on building the European data economy (see below). The proposal is slightly changed from the version which was leaked in December, including in terms of substantive rules. The most notable change is that many of the privacy by design (and by default) obligations have been changed. In the leaked version of the proposal, much stricter rules were proposed, which would have the effect of making the Do Not Track standard enforceable and on by default.
However, the proposal still represents a severe threat to the online advertising ecosystem. Cookies and similar technologies used for digital advertising will continue to require consent, but consent will now have to comply with the higher standard set by the General Data Protection Regulation (EU) 2016/679 (GDPR). Users can make use of browser settings, which IAB Europe believes to be a direct reference to the Do Not Track protocol, to indicate consent or a lack thereof. Under the proposed Regulation this becomes enforceable against third parties, but is not required to be set on by default. In addition, all browsers and apps which allow access to the internet will now have to offer users the possibility to block all third party cookies, letting them determine their preferences on first install or first use, but no default setting will be prescribed.
In a press release, Townsend Feehan, CEO of IAB Europe said: “While the Commission finally acknowledged the important role of advertising for funding free content online, it does so at the same time as presenting a law that as a practical matter would undeniably damage the advertising business model – without achieving any real benefits for users from a privacy and data protection point of view“.
The full press release is available here.
The proposed regulation will now undergo the legislative process where it can be amended by the European Parliament, under the leadership of the Civil Liberties Committee, and the Council of the EU, where the Telecommunications and Information Society Expert Group takes the lead.
For more information, please contact Matthias Matthiesen, Senior Manager, Privacy and Public Policy at IAB Europe (email@example.com).