EDPB final guidance: cross-site ad tracking rarely qualifies as legitimate interest under GDPR
· 22h ago · Originally reported by PPC Land
The European Data Protection Board adopted final guidelines on November 10 covering the use of legitimate interest as a legal basis for processing personal data. The text states that cross-site tracking for advertising will rarely pass the legitimate interest test, and extends protections to all profiling of children for marketing purposes, not just extensive profiling.
Why it matters
This narrows one of the legal bases ad tech companies rely on for behavioral targeting in Europe, potentially pushing the industry further toward consent-based models and affecting how programmatic advertising operates in the region.
Explain it like I’m new here
It's like a referee saying companies can't claim 'it's in my interest to follow you around the mall and record what you look at' as a valid excuse anymore.
Terms in this story
Legitimate interest
Legitimate interest is one of the GDPR's six lawful bases for processing personal data, allowing processing without consent when it is necessary for a genuine interest not overridden by the individual's rights.
Guidance (forecast)
Guidance is a public company's own forecast of its future results, such as next quarter's revenue or full-year adjusted EBITDA, usually given as a range alongside an earnings report.
GDPR
The GDPR (General Data Protection Regulation) is the European Union's data protection law, applying since May 2018, which governs how organisations collect and use personal data about people in the EU.
PII (personally identifiable information)
PII (personally identifiable information) is information that identifies, or can be used to identify, a specific person, such as a name, email, phone number or government ID number.
Go deeper
Related stories
Role-Based Access Control Defined for Ad Accounts and DSPs
Role-based access control (RBAC) is a security model that grants system permissions based on job roles rather than individual users. This approach is currently the standard model for managing user access within advertising accounts and…
Apple's German ATT settlement lets apps re-prompt users who previously declined tracking
Apple reached an agreement in Germany that allows apps to show a fresh App Tracking Transparency prompt to users who previously declined tracking. The seven-year terms also prohibit fees for IDFA access and set a 15-working-day App Review…
Samsung's Gemini glasses launch Dec 10 with ad-targeting limits on camera data
Samsung's Gemini-powered smart glasses go on sale December 10 in the US starting at $395. Camera images captured across 30 frames are excluded from ad targeting and AI training, but voice requests carry no equivalent written commitment on…
Agent Identity: Verifiable Credentials for AI Agents Explained
Agent identity refers to giving AI agents a verifiable name, credential and permission set so websites and systems can identify who operates them and what actions they are allowed to take. The concept addresses how autonomous software…
RIPD guidance bars vendors from using client data for AI training by default
The RIPD has issued guidance stating that vendors may not use client data to train AI models unless clients explicitly opt in. Data inferred by AI about health, beliefs or sexual orientation is treated as sensitive, with implications for…
Google ad tags to expose full IP addresses from January 11 unless sGTM fix applied
Google is changing how IP addresses are handled for its advertising tags, with full IPs set to be sent for Ads, DV360, SA360 and CM360 tags starting January 11 unless server-side Google Tag Manager owners implement a workaround. The…