• by Ray Schultz , November 16, 2018

The French Supervisory Authority for Data Protection (CNIL) has ordered Vectaury, an online advertising network, to change its consent program and purge all data it collected from consumers, according to the National Law Review.

The order, contained in a formal warning to the company, enforces GDPR requirements for consent.

Vectaury buys advertising space for brands. It also has software that advertisers can use to collect geolocation data, device and browser information, then integrate into their apps, per the National Law Review.

The company does provide a “consent experience.” But CNIL contends the information provided to consumers is unclear and not easily accessible. Especially vague is the list of third parties getting access to the data.

In addition, CNIL also argues the firm only had two options: to consent or refuse. It did not ask consumers to consent to processing of geolocation data for marketing.

Finally, users trying to customize their preferences were brought to a pop-up with pre-checked options; the choices did not entail affirmative action.