ITsecurity
twitter facebook rss

Advertising Industry to Sue AdBlock Plus

Posted by on December 10, 2014.

In the news this week (French) is the story regarding GESTE and the French Internet Advertising Bureau threatening to sue Eyeo GmbH – the company behind AdBlock Plus.

Now don’t get me wrong, I am no fan of AdBlock Plus, I think their “Acceptable Advertising” racket is amoral and indefensible, but I do believe that Internet users should have the means and right to block tracking and profiling as well as protecting themselves from malware and other undesirable software which often invades poorly managed advertising platforms.  Furthermore, the European Commission, European Parliament and Council of Europe also believe they should have that right which is why they amended Article 5(3) of Directive 2002/58/EC (ePrivacy Directive) to further define and protect those rights back in 2009.

But what is particularly interesting is the hypocrisy of the advertising industry with regards to the issue of blocking scripts which track and profile users online activities.  You see, during the process of making the changes to Directive 2002/58/EC, there was a phase of panic lobbying throughout the industry.  I recall one European Commissioner explained to me they had been visited by IAB lobbiests over 20 times during the 2008/2009 period trying to push the issue of implied consent favouring the industry over explicit informed consent which would favour citizens.

We also saw an attempted coup d’état orchestrated by the UK Government in November 2009 where they sent a memo to the Council of Europe expressing concerns over the Telecoms Reform Package (which included the changes to 5(3) of the Directive) stating:

Article 5(3) of Directive 2002/58/EC concerns the conditions under which information, including unwanted spy programs or other types of malware may be placed on an individual’s terminal equipment. It also applies to “cookies” and similar technologies, the use of which may in many instances be legitimate. The amended text of Article 5(3) clarifies that the existing consent requirement for the use of such technologies, applies regardless of whether they are delivered via electronic communications networks or other technical means.

These Member States] (sic) recognise that this clarification may require the modification of some national laws. However, as indicated in recital 52( a) {66} , amended Article 5(3) is not intended to alter the existing requirement that such consent be exercised as a right to refuse the use of cookies or similar technologies used for legitimate purposes. These Member States also stress that the methods of providing information and offering the right to refuse should be as user-friendly as possible.

To put this into context the UK along with 12 other Member States, were basically arguing that despite the changes to Article 5(3) of Directive 2002/58/EC, Recital 66 meant that nothing had changed with regards to the consent requirements and that companies could continue to assume implied consent if the user had not changed settings in their browsers to indicate otherwise.  The UK asked the Council to publish the memo on behalf of all Member States despite there only being 13 signatories – the Council rightly refused on that basis and Commissioner Vivianne Reding was furious at the move giving the following statement during her speech at Electronic Communication Networks and Services Debate (Second Intervention):

Second, the question of cookies. Now the Commission was, like Mr Harbour, surprised that certain Member States appeared to call the agreed text on cookies into question. Let me be very clear: we agreed with Parliament, and we believe that the final text is unambiguous. First, there must be clear and comprehensive information to users on the basis of which second users must give their consent. That is that and that should be applied now in the Member States. I do not appreciate it that after everything has been agreed, some like to manoeuvre in order not to keep 100% to the agreements pacta sunt servanda in politics.

That said, industry from that point onwards used Recital 66 to warp the interpretation of the amendment and various regulators (including the UK Information Commissioners Office) based their advice and enforcement policy on the same recital.

Now, if a user chooses to install an extension to their web browser such as AdBlock Plus, it is my belief that that very same Recital 66 acknowledges this as a relevant consent mechanism – because they are in effect configuring their web browser to deny consent to such profiling and tracking by blocking those very scripts from accessing or storing information on their terminal equipment.  You see, if users were to just disable third party cookies using existing browser controls, they would not be afforded the full protection offered to them by Article 5(3) of Directive 2002/58/EC which I recently explained (with the support of the Article 29 Working Party) covers all forms of tracking which rely on accessing or storing information on a users terminal equipment – not just cookies.  These very same advertising corporations when presented with the inability to store a cookie would then circumvent such practices by using other techniques for example, Local Stored Objects in Adobe’s Flash (otherwise known as Flash Cookies) or JavaScript programs which would allow them to identify a user by generating a device fingerprint.

It stands to reason that if the only way a user can configure their browser to prevent such tracking is to install additional extensions or plugins – that is perfectly acceptable under Recital 66 – but it seems that the hypocrisy of the advertising industry know no bounds.  They fought tooth and nail for Recital 66 to be the basis of enforcement but now they are threatening to sue a company that facilitates users’ ability to fully utilise the very same Recital 66 in order to deny consent for tracking and profiling.

This is where I think GESTE and the French Internet Advertising Bureau will ultimately fail in their lawsuit.  The documents and memos discussing the development of the amendments to 5(3) and Recital 66 are all public record and Eyeo GmbH would do well to consider using these records in their defense against the suit – because it is clear that under Recital 66, users have a right to implement technical measures within their browser to indicate whether or not they consent to profiling and tracking.  The Recital does not limit which technologies a user may choose to use – it does not state that users cannot block these scripts and in fact it does not restrict the technical choices of the user in any shape or form; and therefore it must be accepted that the use of adblocking software is not only accepted but encouraged by Recital 66 and that corporations or other entities which provide technical services to facilitate such measures cannot then be subjected to legal action for such services because if they do, then what happens next, do we sue Microsoft, Apple and other web browser vendors for including technical means to block 3rd party cookies; or perhaps ant-virus vendors for allowing users to remove tracking cookies?

The industry have made a move for low hanging fruit – a small company with limited resources, in an attempt to block the tidal wave of privacy enhancing services currently coming to market which could impact their bottom line by stopping their unethical and frankly illegal profiling and tracking practices.  They should lose, because they are responsible for their own demise by spending millions on lobbying to see Recital 66 used to their advantage and now it is coming back to bite them on the ass.  However much I dislike AdBlock Plus’ “Acceptable Advertising” I wish Eyeo GmbH the best of luck in these cases should they ever make it to a court room; and I urge them to look at the history behind 5(3) and Recital 66 with their lawyers and use it to build their defense.


Share This:
Facebooktwittergoogle_plusredditpinterestlinkedinmail

Leave a Reply

Your email address will not be published. Required fields are marked *

Submitted in: Alexander Hanff, Expert Views, News_privacy | Tags: , , , , ,