The European Union’s chief privacy and data protection regulator has urged EU policymakers to strengthen proposed ‘transparency’ rules for political ads — calling instead for meaningful limits that would fully ban microtargeting for political purposes.

The Commission proposal to regulate political ads, last fall, fell very far short of that — offering what this publication characterized at the time as a very “tepid” set of political ads transparency rules, riddled with loopholes which election fiddlers and propaganda muck-spreaders would find all too easy to exploit.

It seems the European Data Protection Supervisor (EDPS), Wojciech Wiewiórowski, takes a similar view, recommending in an opinion (PDF) yesterday — after the usual courtesies welcoming the “overarching aims” of the Commission proposal — that the regulation needs to be strengthened and that it should include “a full ban on microtargeting for political purposes”.

“Political communication is essential for citizens, political parties and candidates in order to fully participate in democratic life. To preserve our democracy, we also need strong rules to combat disinformation, voter manipulation and interferences with our elections. We need to do more if we want to tackle the many risks surrounding the use of targeting and amplification techniques for political purposes,” he said in a statement accompanying his opinion.

The EDPS’ call for a ban on political microtargeting is not a great surprise as Wiewiórowski has previously called for EU lawmakers to ban behavioral advertising entirely.

In February last year he warned that transparency measures may not be enough to prevent the myriad manipulative harms linked to microtargeting (such as discrimination; the exploitation of vulnerable or protected people and groups; the amplification of hate and fraud; and election interference, to name a few).

In his opinion on political ads now he argues that the case for a ban here is even stronger.

“The existing business models behind many online services have contributed to increased political and idealogical polarisation, disinformation and manipulation. Targeted advertising and amplification mechanisms have been instrumental in provoking such harms,” he argues, adding: “The EDPS considers his recommendations about online targeted advertising are even more valid in the political context, having in mind its potential negative impact on the integrity of democracy and its representative institutions.”

“Targeted advertising can be used to unduly influence individuals when it comes to political discourse and democratic electoral processes,” Wiewiórowski continues. “While ‘traditional’ offline political campaigning intends to influence voters’ behavior via message that are generally available and retrievable (verifiable), the targeted advertising makes it possible to target individual voters as well as group with tailored messages, specific to the particular needs, interests and values of the target audience.

“The EDPS concurs with the Commission’s conclusion that such practices have specific detrimental effects on citizens’ fundamental rights and freedoms, including their freedoms of opinion and of information, to make political decisions and exercise their voting rights. Moreover, he is convinced that they present increasing risks not only for the fundamental rights of individuals, but also for society as a whole.”

He goes on to warn that use of personal data allows for different groups of voters or individuals to be segmented and “characteristics or vulnerabilities exploited” — such as by serving an ad at a particular moment in time or a place when a person or group may be more sensitive to the messaging.

And of course democratic accountability and oversight over political messaging when, in the case of ads delivered via microtargeting platforms like Facebook, there may be literally hundreds of thousands (or more) permutations of marketing, tweaked and tailored to specific individuals, is simply not realistic.

To be clear, when the EDPS talks about targeted ads, he’s specifically concerned about the use of personal data for microtargeting — and how such data may be analyzed to infer characteristics (or otherwise derive information) about individuals which is then used to selectively target that person with messages judged to be most likely to have the desired impact — so his call for a ban on political microtargeting is not a call for a blanket ban on being able to target political ads.

(Contextual advertising, for example, which does not rely on processing individuals’ personal data to determine which ad to show — and where targeting is based on a general location, say, or limited to certain (non-sensitive) search keywords — seems unlikely to invoke the same suite of concerns.)

As well as calling for a full ban on political microtargeting, the EDPS wants to see further restrictions on the categories of data that can be processed for political targeting under the proposed law.

The Commission proposal did suggest some limits on the personal data that can be used for political targeting — focused on so called “special category” data, which refers to personal data considered the most sensitive (such as health data, political or religious affiliation, ethnic or racial origin, sexuality and so on).

However the EDPS wants the provision strengthened — pointing out that the Commission’s suggested limitations include two gaping exceptions which essentially make the claimed limits worthless (as TechCrunch also pointed out in our analysis last year).

“The EDPS considers that, in practical terms, Article 12 of the Proposal does not appear to offer any additional protection in comparison to existing Union legislation on data protection,” writes Wiewiórowski in a particularly awkward line of assessment for the Commission.

He goes further, too — essentially saying it’s unlikely that political microtargeting that makes use of such sensitive personal data would have a valid legal basis under EU data protection law (so, er, legally you probably can’t do that anyway) — with Wiewiórowski pointing out that current cookie consent practices are hardly renowned as paragons of compliance…

France spanks Google $170M, Facebook $68M over cookie consent dark patterns

He also highlights “the growing use of complex and often opaque algorithms” — and AI — being used for ad profiling and targeting, asserting that: “[I]t is questionable to what extent the consent of the citizen will actually be sufficiently and meaningfully informed”.

He also adds: “More fundamentally, however, the EDPS questions whether practices which have been identified by the Proposal of having specific detrimental effects should be allowed at all to take place and whether the individual’s consent would be sufficient to mitigate the risks posed by them.”

In short, this is a very polite — but very firm — slapdown to the Commission’s whole approach (and its trumpeting of an “ambitious” proposal — which it claimed last year would usher in “strict conditions” and “secur[e] the use of personal data in context of political targeting, protecting the democratic process”). 

In essence, the bloc’s chief data protection supervisor is saying the proposal will do none of the things claimed in the Commission’s PR.

Ouch.

The Commission was contacted for a response to the EDPS’ opinion. At the time of writing it had not responded — but we’ll update this report if we get a comment.

It’s fair to say that the EU’s executive is not a fan banning very much when it comes to problematic digital practices.

A proposal to regulate AI introduced by the Commission last year did — unusually — propose some outright bans on certain use-cases. However civil society has warned the text added so many limitations, dilutions and exceptions to the suggested prohibitions it’s hard to see how they would have a meaningful effect on limiting harms.

Europe’s AI Act falls far short on protecting fundamental rights, civil society groups warn

When it comes to microtargeting, the Commission evidently also isn’t at all keen on a ban.

Indeed, a number of commissioners — including EVP Margrethe Vestager — have been straight-up parroting the adtech industry talking points on the topic in recent months (per Politico), seemingly in a bid to influence the European Parliament’s negotiating position on the legislation to prevent MEPs adding restrictions on adtech business as usual. (Not very successfully, however — given MEPs just gave a thumbs up to some major limits on tracking ads.)

Tracking industry lobbyists with links to the adtech duopoly — who of course have the most to lose if surveillance advertising actually gets banned — have argued that the survival of small businesses is dependent upon Internet users giving up their privacy en masse in order that everyone can be profiled and targeted cheaply enough to spark joy for SMEs’ marketing budgets.

Vestager appears to have made a similar point to a European Parliament committee last November — apparently favoring transparency and user friendly controls — aka, exactly the sort of measures adtech lobbyists like to suggest to try to fend off meaningful regulation — rather than anything more substantial measures. Such as the EDPS’ recommended outright ban.

Still, the Commission as a whole, and Vestager too, evidently sees the need for political ads to have different rules vs commercial marketing — so at least for there to be a perception that political ads are being dealt with more strictly in the EU.

In practice, though, their proposal looks closer to delivering yet more tedious and exhausting regulatory theatre than meaningful limits on serious harms. EU citizens should not be impressed.

While adtech lobbying to defend privacy-hostile microtargeting continues to try to chainlink the mass tracking, profiling and behavioral targeting of Internet users to the economic survival of SMEs, a YouGov survey earlier this month (via Euractiv) offers a very different perspective — finding a majority of French and German SMEs actually oppose microtargeting yet feel they have no choice but to use these ad tools given the market dominance of Facebook and Google.

So not exactly a ringing endorsement of creepy ads from (some) European SMEs.

Vestager — who remains the bloc’s competition chief — has made it clear for years that she’s not a fan of boosting competition by breaking up Big Tech, which could be one way to ensure SMEs have a better choice of ad tools.

Nor indeed is she a fan of blocking Big Tech M&As which may further entrench  dominance — preferring behavioral remedies, and/or regulation, rather than stronger intervention to restore competitive balance to tipped markets.

Such as the ten year ban on Google using Fitbit heath data for advertising — which was one of the “commitments” Vestager accepted to waive through that particular acquisition back in 2020.

Adtech has been a particular Vestager blindspot — as the Commission only opened a formal probe of Google’s adtech stack last summer, lagging way behind complaints and investigations across multiple jurisdictions.

When it comes to Big (ad)Tech’s market power, the Commission EVP has championed a package of ex ante rules as the best way to clean up abusive practices — aka the Digital Markets Act, which is fast making its way through the EU’s co-legislative process. Although here too MEPs have found her approach lacking — since the parliament voted for restrictions on microtargeting to be added into that law too.

The Commission is duty bound to listen to the other EU institutions as it draws up regulatory proposals. So how long it can keep sticking its fingers in its ears on the need to reform adtech is an interesting question to ponder.

Europe offers tepid set of political ads transparency rules

Europe to put forward rules for political ads transparency and beef up its disinformation code next year