Is The IAB’s Consent Framework In Trouble?

Through bid requests, Vectaury was able to collect more than 42 million advertising identifiers from over 32,000 apps. But when the CNIL audited Vectaury’s server logs, the company couldn’t provide a consent string through its CMP for every single ID.

Downstream partners in a supply chain – DSPs, SSPs and DMPs, for example – aren’t in a great position to collect user consent on their own, so if they want to comply with GDPR, they generally depend on consumer-facing publishers to get consent on their behalf and pass it along within a secure CMP.

That’s fine, if the controller – which is Vectaury, in this case – can prove that users have given consent to have their personal data processed. But this can’t, in the CNIL’s view, “be fulfilled by the mere presence of a contractual clause guaranteeing an initial consent validly collected.”

In other words, the CNIL is implying that controllers can’t just rely on their partners to gather consent for them. If you receive a consent string, it’s also your job to verify it.

“This means that if someone gains consent for you, and you have a contract saying it’s their responsibility to do so, you *still* have the obligation to verify that the consent is valid,” Robin Berjon, executive director of implementation and data governance at The New York Times tweeted on Friday in reaction to the CNIL’s notice.

But there’s nothing wrong with the concept underlying the framework, according to the IAB.

“A story like this just reinforces to me the need for legal compliance, but also the degree to which the framework ticks all of those boxes,” Feehan said. “The conclusion I would draw from the CNIL’s decision is that it’s perfectly comfortable with consent at a legal basis – but you need to be in compliance with the rules.”

The CNIL recently expressed cautious approval of the work that the IAB has been doing with its consent framework. In September, during a panel at DMEXCO in Cologne, Armand Heslot, a privacy and security expert at the CNIL, said that although the framework is “of course not perfect, it’s going in the right direction.”

“Overall, that is a good approach, and that’s what we would like to see from the industry,” Heslot said, giving succor to an audience of ad tech folks.

But even with a perfect consent system, there are problems, said Johnny Ryan, chief policy and industry relations officer at open-source web browser Brave, who called the IAB’s framework “quicksand upon quicksand.”

“[Vectaury] is clearly just the tip of the iceberg,” Ryan said. “Billions of bid requests are broadcast each day, with no control over what ad tech companies do with the data.”

In September, Brave filed a complaint in the United Kingdom and Ireland arguing that real-time bidding and the systematic sharing of bid request data by Google and other ad tech companies constitutes a data breach under GDPR.

It’s worth pointing out that Google still hasn’t adopted the IAB framework, which many believe reflects that Google doesn’t consider it to be GDPR compliant. To get in line with GDPR, Google released its own CMP, called Funding Choices.

But if the CNIL is questioning the notion of how consent strings function, Google could find itself in the same, possibly leaky boat as the rest of the ad tech industry.

The warning against Vectaury is the fourth issued by the CNIL since August. In September, the CNIL cautioned two French geolocation data companies, Teemo and Fidzup, for processing data without consent. Teemo was cleared early last month, with no word yet on Fidzup’s progress. In late October, another French startup that collects geolocation data for advertising purposes, SingleSpot, was called out by the CNIL for not gathering informed consent.

This post was syndicated from Ad Exchanger.